Skip to content

Privacy Notice

Privacy Notice

Frome Community Bike Project privacy notice

This privacy notice tells you what to expect us to do with your personal information. It applies to customers, staff, volunteers and job applicants.

Contact details

Frome Community Bike Project CIC
Station Approach
Frome
BA11 1RE

Email: [email protected] 

What information we collect, use, and why

We collect or use the following information to provide services and goods, including delivery and third party referrals:

  • Names and contact details

We collect or use the following personal information for the prevention, detection, investigation or prosecution of crimes:

  • Video recordings of public areas (including indoor and outdoor spaces)
  • Video recordings of private or staff-only areas
  • Audio recordings captured as part of video recording systems (primarily when security alarms are activated)

We collect or use the following personal information for service updates or marketing purposes:

  • Names and contact details
  • Marketing preferences
  • Purchase history
  • Website and app user journey information
  • Records of consent, where appropriate

We collect or use the following personal information to comply with legal requirements:

  • Name
  • Contact information
  • Identification documents
  • Any other personal information required to comply with legal obligations
  • Health and safety information
  • Safeguarding information

We collect or use the following personal information for recruitment purposes:

  • Contact details (eg name, address, telephone number or personal email address)
  • Date of birth
  • National Insurance number
  • Copies of passports or other photo ID
  • Employment history (eg job application, employment references or secondary employment)
  • Education history (eg qualifications)
  • Right to work information
  • Details of any criminal convictions (eg Disclosure Barring Service (DBS), Access NI or Disclosure Scotland checks )

We collect or use the following personal information for dealing with queries, complaints or claims:

  • Names and contact details
  • Information relating to health and safety (including incident investigation details and reports and accident book records)

Some of the personal information we process may include special category data and criminal offence data. Where this applies, we only process it where permitted under the UK GDPR and the Data Protection Act 2018, and with appropriate safeguards in place.

Lawful bases and data protection rights

You have rights under UK data protection law, including the right to access, correct, delete or restrict the use of your personal information, and in some cases to object to processing or request data portability. Where we rely on consent, you have the right to withdraw it at any time.

Full details of your rights are available on the ICO’s website.

Our lawful bases for the collection and use of your data

Our lawful bases for collecting or using personal information to provide services and goods, including delivery and third party referrals are:

  • Contract – where processing is necessary to supply goods or services to you, or to take steps at your request before entering into a contract.
  • Consent – where we ask for your permission for optional processing (for example, marketing or where a third-party referral is not necessary to provide the service).

Our lawful bases for collecting or using personal information for the prevention, detection, investigation or prosecution of crimes are:

  • Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
  • We may process audio and video recordings in public and staff-only areas where necessary for the prevention, detection, investigation and prosecution of crime, and for the protection of our property, people and assets. Clear signage is displayed where audio and video recording is in operation. Where this involves your personal information, we rely on our legitimate interests (such as keeping people and premises safe and preventing crime) as the lawful basis for processing, and we ensure that your rights and freedoms are not overridden. Audio recording forms part of our video security systems and is primarily activated when alarms are set and is not used for routine monitoring.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Our lawful bases for collecting or using personal information for service updates or marketing purposes are:

  • Consent – we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

Our lawful bases for collecting or using personal information to comply with legal requirements are:

  • Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

Our lawful bases for collecting or using personal information for recruitment purposes are:

  • Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
  • Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
  • Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
    • We process personal information you provide during recruitment to assess suitability, carry out pre-employment checks, and comply with employment and safeguarding obligations. Where required, we process special category data (for example health information for reasonable adjustments) only where permitted by employment and equalities law or with your explicit consent.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Our lawful bases for collecting or using personal information for dealing with queries, complaints or claims are:

  • Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
  • Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
  • Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
  • We process personal information when responding to queries, handling complaints, and managing or defending legal claims. This processing is necessary to pursue our legitimate interests in providing customer support, resolving issues, maintaining records, and protecting our legal rights, provided those interests are not overridden by your rights and freedoms. Where applicable, we also process personal information to comply with our legal obligations or where it is necessary for the performance of a contract with you.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Where we get personal information from

  • Directly from you
  • Family members or carers
  • CCTV footage or other recordings
  • Councils and other public sector organisations

How long we keep information

We keep personal information only for as long as it is necessary for the purposes for which it was collected, including to provide our services, meet legal, regulatory, accounting or reporting requirements, and to resolve disputes or enforce our agreements.

Retention periods vary depending on the type of information and the purpose for which it is processed. When personal information is no longer required, it is securely deleted or anonymised in accordance with our data retention procedures.

Different retention periods apply to different categories of personal information. For example:

  • Service user, customer and volunteer records are retained for as long as necessary to provide services and manage our relationship with you.
  • Recruitment and employment records are retained in line with employment and safeguarding requirements.
  • Financial records are retained for the period required by tax and accounting laws.
  • CCTV, audio and video recordings are retained for a short period and are only kept longer where required for the investigation of incidents, complaints or legal claims.

We regularly review the personal information we hold and delete or anonymise it when it is no longer needed.

When personal information is no longer required, it is securely deleted or anonymised. Where personal information is processed by our data processors, we require them to retain it only for as long as necessary to provide their services to us and in accordance with applicable data-protection law.

Who we share information with:

Data processors

Square (Block, Inc.)

Purpose: Payment processing, point-of-sale services, invoicing and financial transactions

Summary:

Square processes personal and payment data to enable secure card payments, online transactions and related financial services. It implements encryption in transit and at rest, complies with PCI-DSS standards, and applies technical and organisational security measures. Square acts as a data processor in respect of the payment services it provides to us and processes personal data in accordance with applicable data-protection laws.

Spond

Purpose: Group management, communications and event coordination

Summary:

Spond processes personal data to enable group communications, scheduling and participation management. It operates internal privacy and security controls aligned with UK GDPR requirements, limits data retention to what is necessary for service delivery, and does not share personal data with third parties except where required to provide the service or where legally required.

Xero

Purpose: Accounting, financial management and reporting

Summary:
Xero processes personal and financial data to provide cloud-based accounting and bookkeeping services. It applies access controls, security safeguards and data-protection measures designed to support compliance with UK GDPR and other applicable data-protection standards. Xero acts as a data processor when processing customer data on our behalf.

Hubdoc (Xero Group)

Purpose: Document capture and financial record management

Summary:
Hubdoc processes personal and financial documents to automate data capture and record-keeping. As part of the Xero group, it applies data-protection and security measures aligned with UK GDPR requirements, including secure storage and access controls, and acts as a data processor when handling customer information on our behalf.

Zoho

Purpose: CRM, email, business management and customer support tools

Summary:
Zoho processes personal data to provide business software services such as customer relationship management, email and support tools. It operates a global privacy framework aligned with UK GDPR principles, restricts data access to authorised personnel, and implements technical and organisational measures to protect personal data.

Ring (Amazon group)

Purpose: Security devices and monitoring services

Summary:
Ring processes personal data relating to security devices, video footage and account management. It applies encryption, access controls and data-minimisation practices. Where Ring processes personal data on our instructions in connection with our use of its services, it acts as a data processor; in other contexts it may act as an independent controller.

Google Workspace (Google LLC)

Purpose: Email, document storage, collaboration and IT administration

Summary:
Google Workspace processes personal data to provide email, file storage, calendars and collaboration tools. In providing these services, Google acts as a data processor and applies technical and organisational security measures, including encryption and access controls, together with contractual data-protection safeguards for UK and EU customers.

BrightHR

Purpose: HR management, employment records and compliance support

Summary:
BrightHR processes employee and workforce-related personal data to provide HR management tools, document storage and compliance support. It applies contractual data-protection safeguards, internal security controls and policies designed to support compliance with UK GDPR when processing personal data on our behalf.

Croner

Purpose: HR, legal and compliance advisory services

Summary:
Croner processes limited personal data to provide HR, employment-law and compliance support services. It applies confidentiality obligations, contractual data-protection safeguards and security controls, and acts as a data processor when handling personal data on our behalf.

Others we share personal information with

  • Professional advisors
  • Local authorities or councils
  • Other organisations we refer you to at your request (where applicable)
  • The police or other law enforcement agencies (where necessary and lawful)
  • Organisations we’re legally obliged to share personal information with

Sharing information outside the UK

Some of our suppliers and service providers operate internationally. This means that personal information relating to staff, customers and volunteers may be transferred to, stored in, or accessed from countries outside the UK, including where our data processors use overseas infrastructure or support services. Where this happens, we ensure that appropriate safeguards are in place in accordance with UK data protection law, such as adequacy regulations, the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses.

For further information about international transfers or to obtain a copy of the relevant safeguards, please contact us using the contact details provided above.

Organisation name: Square (Block, Inc.)

Category of recipient: Merchant services (payments, point-of-sale services and invoicing)
Country the personal information is sent to:
Square operates internationally and personal information may be transferred to countries outside the UK, commonly including the United States.
How the transfer complies with UK data protection law:
Square’s data processing terms provide for the use of appropriate safeguards for restricted international transfers, including the UK Addendum to the EU Standard Contractual Clauses. Copies of the relevant safeguards are available via Square Support on request.

Organisation name: Spond

Category of recipient: Group management and communications platform
Country the personal information is sent to:
Spond states that onward transfers may occur outside the UK or EU, including via third-party service providers such as Intercom, which may process data in the United States.
How the transfer complies with UK data protection law:
Spond states that appropriate GDPR safeguards are used for international transfers. For the purposes of UK GDPR, this includes equivalent contractual safeguards where required, such as the UK Addendum to the EU Standard Contractual Clauses.

Organisation name: Xero

Category of recipient: Accounting and finance platform
Country the personal information is sent to:
Australia, New Zealand, the United States and other countries where Xero operates or provides support services.
How the transfer complies with UK data protection law:
Xero states that where personal data is transferred internationally, it ensures appropriate safeguards are in place to protect the data in accordance with applicable data-protection laws.

Organisation name: Hubdoc (Xero Group)

Category of recipient: Document capture and financial record management
Country the personal information is sent to:
Hubdoc states that personal data may be transferred outside the UK or EU in order to provide its services.
How the transfer complies with UK data protection law:
Hubdoc states that international transfers, including transfers involving third-party service providers such as Salesforce, are subject to appropriate safeguards. These include standard contractual clauses (model clauses) and, where applicable, binding corporate rules.

Organisation name: Zoho

Category of recipient: Business software (including CRM, email and customer support tools)
Country the personal information is sent to:
The United States, the EEA and other countries where Zoho operates.
How the transfer complies with UK data protection law:
Zoho states that international processing, transfer or storage of personal data is subject to appropriate data-protection agreements and safeguards as required by applicable UK data-protection laws. Copies of the relevant safeguards may be requested from Zoho.

Organisation name: Ring (Amazon group)

Category of recipient: Security devices and monitoring services
Country the personal information is sent to:
The United States and other countries where Ring or its service providers operate.
How the transfer complies with UK data protection law:
Ring states that where personal data is transferred internationally, it relies on adequacy decisions or contractual safeguards such as Standard Contractual Clauses and similar protective measures under UK data-protection law.

Organisation name: Google Workspace (Google LLC)

Category of recipient: Email, file storage and collaboration services
Country the personal information is sent to:
Google operates globally and personal information may be processed or accessed outside the UK or EEA depending on service configuration and support arrangements.
How the transfer complies with UK data protection law:
Google’s Cloud/Data Processing Addendum incorporates Standard Contractual Clauses and related safeguards designed to meet EU, UK and Swiss data transfer requirements, including the UK Addendum to the EU SCCs.

Organisation name: Croner

Category of recipient: HR, employment law and compliance advisory services
Country the personal information is sent to:
Not specified. Transfer destinations depend on the external service providers used as part of service delivery.
How the transfer complies with UK data protection law:
Croner states that it uses data-processing agreements with external service providers and, where international transfers are required, relies on appropriate safeguards such as Standard Contractual Clauses in accordance with UK data-protection law.

How to complain

If you have any concerns about our use of your personal data, you can make a complaint to us using the contact details at the top of this privacy notice.

If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.

The ICO’s address:           

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113

Website: https://www.ico.org.uk/make-a-complaint

Last updated 28th Jan 2026