Rosie – the Rose Voucher Recording System for Traders
The Rose Vouchers Recording System for Traders (hereby referred to as ‘Rosie’) is a Progressive Web Application (PWA) – for more information about PWAs, please see here.
Rosie is owned by Alexandra Rose Charity (referred to here as ARC or “we”) whose registered office is Community Base, 113 Queens Road, Brighton, BN1 3XG. ARC is registered with the Charity Commission for England & Wales – Charity Number 211535.
UK GDPR applies to ‘personal data’, meaning any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier.
This definition provides for a wide range of personal identifiers to constitute personal data, including name, identification number, location data or an online identifier, reflecting changes in technology and the way organisations collect information about people.
- Trader – People or Organisations which operate market stalls or other retail outlets
- User – People who can log in to the site & are authorised to use it on behalf of Traders
- Admin – Personnel from ARC and its technology partners who will support Rosie
- System Administrator – Personnel from technology services that maintain our data servers
How and Why We Collect Personal Data
ARC needs to collect certain information so that Traders can be part of the Rose Vouchers Project and so that Users can access the Rosie web app to request reimbursement for vouchers. This information is necessary to form a contract and is listed below.
- Stall licensee name and responsible person
- Market name
- Mobile number
- Email address
- Company/shop/stall name
- Bank account name
- Bank account number
- Bank account sort code
- Bank reference
Providing this information means that ARC and its technology partners can effectively manage and develop Rosie and keep users up-to-date with useful reminders and notifications. Providing an email address also means that users have a means of resetting their password. Personal financial information such as bank account details are not gathered or stored in Rosie (although Traders need to supply bank account details to ARC, so they can receive payment for Rose Vouchers via BACS).
From time to time, ARC may run surveys through Rosie. Surveys may offer you the option to provide your email address for further contact from ARC’s evaluation team.
All personal data is obtained for the purposes of administering, delivering and evaluating the Rose Vouchers Project, and will not be kept for longer than necessary for these purposes.
Our legal basis for processing personal data
If we process your personal data for the purposes of administering surveys, we do so for the purposes of our legitimate interests in operating our programmes. Broadly speaking, this means we can process personal data if we have a genuine and legitimate reason to do so, the processing is necessary to achieve that purpose, and our processing doesn’t overly interfere with those individuals’ interests, rights and freedoms. For the purposes of the Rose Vouchers Project, we process survey data in order to carry out our charitable mission, which includes tackling poverty and diet-related ill health, strengthening local markets and helping to build more sustainable local food economies.
In addition, we may process certain financial information in order to comply with comply with legal obligations to which ARC is subject, such as tax and accounting requirements.
ARC Mailing Lists
You can also subscribe to ARC’s mailing list by providing us with your contact details via our website www.alexandrarose.org.uk. If you choose to receive electronic communications from ARC (such as newsletters and fundraising information by email), then we will need your consent to communicate with you in this way. This is because such communications may be deemed to be ‘marketing’ for which your explicit consent would be required under the Privacy and Electronic Communications Regulations (PECR), which sit alongside UK GDPR.
Our website contains all the necessary information regarding consent and opting in to receive electronic communications. ARC only uses email addresses to send relevant information. We do not pass on personal data to third parties unconnected with ARC. Recipients can unsubscribe simply by clicking the link at the foot of ARC’s emails or by emailing firstname.lastname@example.org
Disclosing your personal data
We will not share any of personal data with a third party, except where:
- We are transferring data to one of our service providers, such as those we engage to:
- Host our voucher system
- Send email communications, such as newsletters, on our behalf
- Provide project management software necessary to operate our programmes
- Administer and process donations to ARC
- Carry out finance and accounting services on our behalf
- We are required to do so by law
- In order to protect an individual’s vital interests
- We have obtained your consent
Transferring your data overseas
Some of our vendors are located or process personal data outside the UK. When we transfer your information to them, we take appropriate measures to safeguard your personal data, for example by entering into a contract that includes Standard Contractual Clauses issued by competent supervisory authorities, or by transferring the data to a country that has been designated as providing adequate protection for personal data.
The GDPR contains important rights for individuals:
- The right of access – ARC will provide, on request by an individual, a copy of the personal data ARC holds about them free of charge. This is called a ‘subject access request’ and ARC will respond as soon as we possibly can, but at the latest within one month of receipt of a request.
- The right to rectification – Individuals are entitled to have personal data rectified if it is inaccurate or incomplete.
- The right to erasure – This also known as ‘the right to be forgotten’. The broad principle underpinning this right is to enable an individual to request the entire deletion or removal of all personal data where there is no compelling reason for its continued processing. The right to erasure does not provide an absolute ‘right to be forgotten’, but individuals have a right to have personal data erased and to prevent processing in specific circumstances:
- Where the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed.
- When the individual withdraws consent.
- When the individual objects to the processing and there is no overriding legitimate interest for continuing the processing.
- The right to restrict processing – Individuals have a right to ‘block’ or suppress processing of personal data. When processing is restricted, ARC is permitted to store the personal data, but not further process it. ARC can retain just enough information about the individual to ensure that the restriction is respected in future.
- The right to object – Individuals have the right to object to direct marketing (including profiling) and processing for purposes of historical research and statistics. The UK GDPR defines “profiling” as any form of automated processing intended to evaluate certain personal aspects of an individual, in particular to analyse or predict their economic situation, health, personal preferences, reliability, behaviour, location or movements.
- The right to data portability – Individuals have a right to obtain and reuse their personal data for their own purposes across different services.
- Rights in relation to automated decision making and profiling – The UK GDPR provides safeguards for individuals against the risk that a potentially damaging decision is taken without human intervention.
If you have any complaints about the way in which we have used your data, please get in touch with us using the details in the ‘Contact us’ section below. We would be happy to help and discuss your concerns.
You are also entitled to make a complaint to the Information Commissioner’s Office.
To contact ARC about exercising any of your data subject rights, such as to make a subject access request or to rectify personal data that is inaccurate or incomplete, please email email@example.com.
To find out more about your rights you can also visit https://ico.org.uk/for-the-public/
While ARC takes reasonable steps to ensure the quality of content and information made available on Rosie in general, neither it nor its officers, employees, contractors or content providers assume any responsibility for the accuracy, correctness, relevance, completeness or currency of the information or other content on Rosie.
ARC does not warrant that any functions contained in Rosie will always be available or will be uninterrupted or error-free, or that content and materials on Rosie or the server that makes it available will be free of viruses or other harmful components. You should take appropriate precautions to ensure that any content you download is free of such viruses and other harmful content. We control and operate Rosie from our offices in the United Kingdom. We do not represent that the content or other information provided on Rosie (including any advertising, promotion or any service) are appropriate, relevant or available for use outside the UK. The laws of The United Kingdom of Great Britain and Northern Ireland shall govern your use of Rosie and you hereby agree to submit to the exclusive jurisdiction of the UK courts.
Limitation of Liability
Except for death or personal injury caused by our negligence, ARC, its officers, employees, contractors or content providers shall not be liable for any loss or damage arising from or otherwise in connection with your use of Rosie or any information, services or content on Rosie. If you have a query about this policy please email firstname.lastname@example.org