Rosie – the Rose Voucher Recording System for Traders

1. PRIVACY POLICY

The Rose Voucher Recording System for Traders (hereby referred to as ‘Rosie’) is a Progressive Web Application (PWA) – for more information about PWAs, please see https://developers.google.com/web/progressive-web-apps/

Rosie is owned by Alexandra Rose Charity (referred to here as ARC or “we”) whose registered office is Suite 5B, The Oast House, 5 Mead Lane, Farnham, Surrey, GU9 7DY. ARC is registered with the Charity Commission for England & Wales – Charity Number 211535.

ARC takes your privacy very seriously. The policies and procedures we have in place are to protect the integrity and confidentiality of personal data, to comply with data protection legislation including the EU General Data Protection Regulation (GDPR) from 25th May 2018.

The GDPR applies to ‘personal data’ meaning any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier. This definition provides for a wide range of personal identifiers to constitute personal data, including name, identification number, location data or online identifier, reflecting changes in technology and the way organisations collect information about people.

Rosie has four user-categories to which this Privacy Policy applies:

  • Trader - People or Organisations which operate market stalls or other retail outlets

  • User - People who can log in to the site & are authorised to use it on behalf of Traders

  • Admin – staff from ARC and its technology partners who will support Rosie

  • System Administrator – staff from technology services that maintain our data servers

    This Privacy Policy also forms part of our Terms of Use – please see section 2 below.

    Legitimate Interests

    Under GDPR, we have determined that the lawful basis for ARC processing Rosie users’ personal data is ‘Legitimate Interests’. Broadly speaking, Legitimate Interests means that we can process personal information of Rosie users if we have a genuine and legitimate reason and we are not harming any of their rights and interests.

    In practice, this means that when you provide your personal data to us for Rosie, we process your data as part of the day-to-day management the Rose Voucher Project, which is part of our legitimate business interests to carry out our charitable mission & purposes, including tackling poverty and diet related ill-health, strengthening local markets and helping to build more sustainable local food economies.

    We also carefully consider your interests as a Rosie user and the impact of ARC processing your personal data, including how you benefit from Rosie, how important those benefits are and if the processing of your personal data is necessary, proportionate and reasonable.

    Our balanced assessment is that ARC processing the personal data of Rosie users is necessary, proportionate and reasonable, and is clearly in the interests of ARC for its charitable purposes and, crucially, it is clearly in the interests of Traders for the important economic benefits of the Rose Voucher Project, including increased income, customers & trade for their businesses.


How and Why We Collect Personal Data

Signing up for a Rosie account requires a user to provide certain basic information to set up & operate the account:

  • Name

  • Business name

  • Email address

  • Password

  • Market location

  • Telephone number

    Providing this information means that ARC and its technology partners can effectively manage and develop Rosie and keep users up-to-date with useful reminders and notifications. Providing an email address also means that users have a means of resetting their password. Personal financial information such as bank account details are not gathered or stored in Rosie (although Traders need to supply bank account details separately to ARC, so they can receive payment for Rose Vouchers via BACS).

    The GDPR contains important rights for individuals:

    • The right to be informed – ARC has an obligation to provide ‘fair processing information’, typically through a Privacy Notice such as this document. This is about ARC being transparent about how we use people's personal data.

    • The right of access – ARC will provide, on request by an individual, a copy of the personal data ARC holds about them free of charge. This is called a ‘subject access request’ and ARC will respond as soon as we possibly can, but at the latest within one month of receipt of a request.

    • The right to rectification - Individuals are entitled to have personal data rectified if it is inaccurate or incomplete.

    • The right to erasure - This also known as ‘the right to be forgotten’. The broad principle underpinning this right is to enable an individual to request the entire deletion or removal of all personal data where there is no compelling reason for its continued processing. The right to erasure does not provide an absolute ‘right to be forgotten’, but individuals have a right to have personal data erased and to prevent processing in specific circumstances:

      • Where the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed.

      • When the individual withdraws consent.

      • When the individual objects to the processing and there is no overriding legitimate interest for continuing the processing.

    • The right to restrict processing - Individuals have a right to ‘block’ or suppress processing of personal data. When processing is restricted, ARC is permitted to store the personal data, but not further process it. ARC can retain just enough information about the individual to ensure that the restriction is respected in future.

    • The right to object - Individuals have the right to object to direct marketing (including profiling) and processing for purposes of historical research and statistics. The GDPR defines "profiling" as any form of automated processing intended to evaluate certain personal aspects of an individual, in particular to analyse or predict their economic situation, health, personal preferences, reliability, behaviour, location or movements.

    • Rights in relation to automated decision making and profiling - The GDPR provides safeguards for individuals against the risk that a potentially damaging decision is taken without human intervention.

Please note, the Right to data portability under GDPR does not apply when Legitimate Interests is used as the lawful basis for data processing.

To contact ARC about exercising any of these rights, e.g. to make a subject access request or to rectify personal data that is inaccurate or incomplete, please email [email protected] To find out more about your rights you can also visit https://ico.org.uk/for-the-public/

Surveys and Evaluation Activities

From time to time, ARC may run surveys through Rosie. Surveys may offer you the option to provide your email address for further contact from ARC’s evaluation team.

ARC Mailing Lists

You can also subscribe to ARC’s mailing list by providing us with your contact details via our website www.alexandrarose.org.uk. If you choose to receive electronic communications from ARC (such as newsletters and fundraising information by email), then we will need your consent to communicate with you in this way. This is because such communications may be deemed to be ‘marketing’ for which your explicit consent would be required under the Privacy and Electronic Communications Regulations (PECR), which sit alongside the GDPR.

Our website contains all the necessary information regarding consent and opting in to receive electronic communications. ARC only uses email addresses to send relevant information. We do not pass on personal data to third parties unconnected with ARC. Recipients can unsubscribe simply by clicking the link at the foot of ARC’s emails or by emailing [email protected]

Disclosure and Transfer of Your Personal Data

We do not sell, rent or otherwise disclose personal data with any other parties other than as set out in this Privacy Policy. Your data is stored securely and in line with data protection law. Legislation does however permit certain disclosures without consent when the information is requested for one or more of the following purposes:

  • To safeguard national security;

  • Prevention or detection of crime including the apprehension or prosecution of offenders;

  • Assessment or collection of tax duty;

  • Discharge of regulatory functions (includes health, safety and welfare of persons at work);

  • To prevent serious harm to a third party;

  • To protect the vital interests of the individual - this refers to life and death situations.

    All requests to provide personal data for one of the above reasons will be specifically authorised by ARC’s Business Administrator.

    Notification of Changes to this Privacy Policy

    We may make changes to Rosie to add new features. As a result of these changes & if there are any changes in the law, we may make changes to how we process your Personal Data. If and when we make such changes, we will update this Privacy Policy, so please check it regularly.


2. Terms of Use

These terms of use apply to your use of The Rose Voucher Recording System for Traders (hereby referred to as ‘Rosie’) which is owned and operated by Alexandra Rose Charity (referred to here as ARC or “we”) whose registered office is Suite 5B, The Oast House, 5 Mead Lane, Farnham, Surrey, GU9 7DY.

Please read these terms of use carefully because, by using Rosie, you acknowledge that you have read, understood, and agree to be bound by these Terms of Use, our Privacy Policy and that you will comply with all laws applicable to your use of Rosie. We reserve the right to modify the Terms of Use at any time. You should therefore check the Terms of Use periodically for changes. By using Rosie after we post any changes, you agree to accept those changes, whether or not you have reviewed them. If, at any time, you choose not to accept the Terms of Use, please do not use Rosie.

Links

The Terms of Use apply only to Rosie and not to any other sites/apps which Rosie hyperlinks to. We assume no responsibility whatsoever for websites/apps that Rosie either hyperlinks to or otherwise refers to. In particular, we do not assume any responsibility for any information or content on such sites (including but not limited to any views, advice, opinions, advertising, or recommendations). Nor do we assume any responsibility in connection with any product or service such sites may offer. Under no circumstances will ARC, its officers, employees, contractors or content providers be liable, directly or indirectly, for any loss or damage resulting from you accessing or using, or otherwise in connection with, any website/app either hyperlinked to or otherwise referred to on Rosie.

Disclaimers

While ARC takes reasonable steps to ensure the quality of content and information made available on Rosie in general, neither it nor its officers, employees, contractors or content providers assume any responsibility for the accuracy, correctness, relevance, completeness or currency of the information or other content on Rosie.

ARC does not warrant that any functions contained in Rosie will always be available or will be uninterrupted or error-free, or that content and materials on Rosie or the server that makes it available will be free of viruses or other harmful components. You should take appropriate precautions to ensure that any content you download is free of such viruses and other harmful content.

We control and operate Rosie from our offices in the United Kingdom. We do not represent that the content or other information provided on Rosie (including any advertising, promotion or any service) are appropriate, relevant or available for use outside the UK. The laws of The United Kingdom of Great Britain and Northern Ireland shall govern your use of Rosie and you hereby agree to submit to the exclusive jurisdiction of the UK courts.

Limitation of Liability

Except for death or personal injury caused by our negligence, ARC, its officers, employees, contractors or content providers shall not be liable for any loss or damage arising from or otherwise in connection with your use of Rosie or any information, services or content on Rosie. If you have a query about this policy please email [email protected]