This privacy notice is to help you understand how and why we collect personal information about you and what we do with that information.It also explains the decisions that you can make about your own information.
If you have any questions about this notice please contact Nicola Spencer, Group Resources Director (Soil Association) whose contact details are 0300 330 0100, Soil Association, Spear House, 51 Victoria Street, Bristol BS1 6AD.
You can click through to the different parts of the notice:
The Soil Association is a charity and certification business made up of several different entities:
Soil Association Limited, which is a charity set up to support organic food and farming through, for example, building public awareness about the benefits of organic food and educating the public.The Soil Association Limited is referred to as the Charity in this notice.
Soil Association Certification Limited, which provides organic, forestry and other sustainable certification schemes.Soil Association Certification is referred to as Certification in this notice.
Soil Association Land Trust Limited, which looks after land donated by retiring farmers and landowners.This is referred to as the Land Trustin this notice.
We are committed to protecting your privacy and security.
Whenever you provide personal information to us, we will treat that information in accordance with this notice and current data protection law.
The Charity, Certification, and the Land Trust are each "data controllers".This means that each is legally responsible for how it uses personal information.
The Charity is the data controller in respect of personal information held in connection with most membership services and programmes.This includes Food for Life.
Certification is the data controller in respect of personal information held in connection with auditors, Certification clients (ie licensees), agents and partners, Certification consumers, forestry stakeholders, Certification training programmes, and the Certification Board and Committees.
The Soil Association entities work closely together.This means that we will often share personal information in relation to the work we do.In these circumstances each Soil Association entity will be a data controllerThe main ways in which we share personal information are as follows:
Information is shared in connection with publicity.For example, a case study about a Certification client may be given to the Charity so that the Charity can use it in connection with Soil Association publicity.
To promote the work of the Soil Association more generally as described below.For example Certification may share client details with the Charity so that the Charity can tell the client about the work of the Charity.
In order to further the work we do.For example, if the Charity was working with experts in a particular field, it may involve other Soil Association entities and share what was learnt with them.
Where a Certification client is involved in something the Charity does.For example, if a Certification client provided organic food in connection with a Charity event.
Personal information may also be shared between the different Soil Association entities where one is providing a service to another.In these cases, the entity which is benefiting from the service is the data controller.
For example:
The Land Trust uses the Charity's CRM system to store Personal Data.The Land Trust is the data controller here.
The Charity sending out publications to Certification clients on behalf of Certification.Certification is the data controller here.
Where we get in touch for marketing or development purposes, then the data controller is the entity which has contacted you.The communication will clearly set out which Soil Association entity is contacting you.
Where we refer to "Soil Association" in this notice, or "we", "us" "our" then we are describing a practice which concerns the Soil Association entities generally.A reference to "Charity", "Certification" or "Land Trust" is describing something specific to that entity.
We may collect, use, store and transfer different kinds of personal information about you.This includes:
Information to help us identify you such as your name and date of birth;
Your contact details;
Financial information such as bank account and payment card details;
Information about your support for us.For example, where you make a donation or you participate in our programmes.This also includes financial information as well as information about your history of giving to the Charity;
Information about you if you are a Certification client, such as your contact details; and
Information about you if you are Certification stakeholder as part of our accreditation and certification process.
We get personal information from a lot of different sources.This includes via our websites, social media channels, responses to our communications, online survey, emails, telephone calls and events as well as through participation in our events and activities.
Under data protection law, we must give you information about the bases we are relying on to process your personal information.These are set out below.
Legitimate interests:This means that the use of personal information is necessary for legitimate interests except when the individual's interests and fundamental rights override those legitimate interests.Legitimate interests covers most of the activities of the Soil Association.In particular, the Soil Association has a legitimate interest in:
Promoting its objects and activities, specifically, to promote interest in organic produce and organic farming;
Raising funds for our activities and ensuring that there is an active community of supporters for what we do.This means that we can do more to support our objects and activities;
Providing education and increasing awareness around organic produce and farming;
Protecting our reputation (for example, if someone was misusing our intellectual property); and
Certification’s work in the delivery of its certification schemes and services.
Contract: This means that the use of personal information is necessary in order to perform our obligations under our contract with you and for you to perform your obligations as well.This applies to many of the activities of Certification.For example, if you become a licensee, we will need to process your data in order to perform our contractual obligations.It also applies to some of the activities of the Charity, for example, if you join as a member of the Soil Association then we will need to use your personal information to provide the membership benefits that you are entitled to.
Legal obligation: We can rely on this when we need to use personal information in order to comply with a legal obligation.
Public task: Performance of a task carried out in the public interest (or carrying out public tasks).We use this basis to process personal information at our events, for example, for health and safety reasons.It also applies to the training we provide, as there is a public interest in providing education.
Consent: Sometimes we are relying on consent to process your personal information.This will be the case for certain types of fundraising communications.For example, we usually need your consent before sending you a fundraising email.If you give your consent, you have a right to withdraw it at any time.Any use of your information before you withdraw your consent remains valid.
This section sets out how the Soil Association entities use personal information.Save where we say otherwise this section applies to all Soil Association entities, including the Charity and Certification.
We use personal information to promote the Soil Association and the work we do:
To keep you informed about events and activities and in relation to your attendance at those events;
To tell you about our products and services;
To tell you about offers from carefully selected partner organisations;
To keep you informed about what is happening.For example, by sending you our newsletters;
In connection with providing financial support to the Charity.This includes donations and legacy gifts made to the Charity;
In connection with the other ways in which you might support us (such as when you volunteer)
To increase engagement in Soil Association activities, for example, through market research and inviting people to take part in surveys and competitions; and
To demonstratethe impact & reach of our campaigns, we may use anonymised data (such as location) as part of press releases or other promotional documents
We may contact you for the above purposes by email, telephone, post, text message and through social media but we will only do so where this is allowed under data protection law (for example, we will sometimes need your consent before sending you an email about a fundraising opportunity).If you tell us that you do not want to be contacted for any of these purposes then we will of course respect that.You can withdraw your consent at any time.
Based on the information we have about you, we may also make suggestions and recommendations to you about goods or services that may be of interest to you.If you tell us that you have a particular interest, we may keep a record of that.
We use personal information to help us improve our products and services. For example, whether a particular campaign was popular with a specific group.
We will use information from public sources to help us tailor our communications to you.As part of this we will obtain information from websites including the following: Zoopla (for house prices), LinkedIn, internet search engines, and the Charity Commission website.
If you wish to make a donation or leave a legacy, particularly a donation or legacy of substantial value, the Charity and / or the Land Trust may need to verify your identity and/or carry out financial due diligence on you.This may involve taking and retaining copies of your identification documents and obtaining your personal information from the sources set out in the paragraph above.This is to help the Charity and / or the Land Trust comply with their legal obligations.
If you make a donation, we may need to share this with HMRC for gift aid purposes.This is to comply with a legal obligation.
We may also contact individuals who we think would help us promote the work we do.For example, we may contact bloggers, influences and journalists to ask them if they would like to participate in campaigns and share stories.
We often use photographs for marketing and promotion purposes.This will include in our publications, in social media and on our websites.Where we consider doing so is necessary, we will seek your consent before using the photograph.We may also use "good news" stories in connection with our publicity.
Save where indicated above, we are relying on legitimate interests in this section - in particular, the first, second and third legitimate interests described under "Our legal bases for using your information" above.
The above covers a lot of what we do.The Soil Association entities will also use your personal information in respect of their specific activities.This is explained in the sections below.
Primarily, the Charity uses personal information to help it deliver its objectives and activities.This includes using personal information to tell people about what the Charity does and to promote interest in organic produce and organic farming.Much of what the Charity does is covered in the section above, but in the sections below we set out more information on how the Charity uses personal information in connection with its specific activities.
Save as indicated otherwise, the Charity is relying on legitimate interests as described under "Our legal bases for using your information" above.
The Charity will use your personal information in connection with your membership of its programmes.The Charity will use your information in order to:
Make sure that you receive the benefits of your membership.For example, we need your contact details so that the Charity can send you a newsletter; and
Administer your membership.For example, by responding to a query you may have or sending you an acknowledgement.
The Charity also uses personal information in connection with its activities and programmes in the following ways:
To manage its programmes with participating organisations.For example, the Charity will have the name and contact details of the main point of contact at the participating organisation;
To support individuals (such as school pupils and their parents) who participate in our programmes.For example, when running activities we will obtain information about how well they have done;
In order to identify individuals and organisations who the Charity considers would be interested in a programme;
To deal with queries from individuals (such as parents).For example, where the individual wants their organisation or school to join a Charity programme;
To recruit volunteers; and
In connection with the administration of our events and activities.
To gain insight, measure and evaluate the impact of our work.
If you are a member of the Standards Board, or are on one of the Standards Committees, or otherwise contribute to the work the Charity does (for example, through taking part in Standards consultations) then the Charity will use information about you to manage your participation in this work.This includes your name and contact details, and also information about your contribution (such as the information you provided to us in response to a consultation).
In addition to legitimate interests, the Charity is relying on public task where it is providing education and training.The Charity will also be relying on contract as well in some cases, for example, where you have purchased membership to one of our programmes.
The Charity also handles personal information through its interaction with individuals more generally.For example, if you contact us with a question about organic farming then the Charity will process your personal information in connection with answering that question.
The Charity also regularly liaises with stakeholders, such as farmers, from whom we seek advice and views.
Where does the Charity get personal information from and with whom does it share that information
A lot of the personal information the Charity collects will come direct from you, but we sometimes obtain information from third parties, for example:
The Charity will obtain information from others (such as friends and family) if they give Soil Association Membership to you as a gift;
The Charity will generate interest in its programmes through word of mouth, research that it carries out, press, social media.The Charity also gets information about contacts at organisations who the Charity considers may wish to participate in Charity programmes.This information comes from companies who sell data and through other similar organisations such as the Children's Food Trust and Jamie Oliver's Kitchen Garden Project.
If you decide to make a legacy or a pledge through a third party (for example, if you decide to provide for the Charity in a will made through the National Free Wills Network) then the Charity will obtain information about you from that third party.
In general terms Certification uses personal information in order to manage its certification services.Not all of the information that Certification holds will be personal information.For example, financial information about a client which is a company will not usually count as personal information but financial information about a licensee who is a sole trader is more likely to count as personal information.
Certification is relying on legitimate interests as described under "Our legal bases for using your information" above and contract.Certification also has a legal obligation to process data in respect of some of its activities, this includes the requirement to comply with rules concerning accreditation and Scheme standards.
Certification uses personal information in connection with assessing for certification and the ongoing management of clients.This includes onsite audits, visits and ongoing assessments and management, and seeking the views of stakeholders such as NGOs, government bodies and tribes.Information from stakeholders will be shared with Certification auditors (including contractors), regional agents, Scheme owners and accreditors.
Certification will also use personal information so that it can meet its own certification and scheme record-holding requirements
Auditors, contractors and regional agents
If you are an auditor, contractor or regional agent carrying out services on our behalf, then we will use your contact details, plus information about your qualifications and experience in order to assess your suitability to become an auditor for us and communicate with you in connection with the management of the audit.
The information Certification hold includes your languages, your role (for example, whether you are an auditor or auditor candidate and so on), whether you are a contractor or an employee, qualifications, education (including level and discipline), whether you have successfully completed tests and / or training, information and your training and development, professional experience.
Certification has a legitimate interest in ensuring that the audit process runs smoothly, that auditors are suitably qualified and that the requirements of Certification auditors are complied with.
Training
Certification also holds information about those who take part in Certification training programmes.This is for the purpose of managing the training programme, and assessing progress and attainment through the programme.
For this purpose Certification is relying on legitimate interests and public task.
Events
Certification will collect and hold information to keep individuals informed about events and in relation to your attendance at those events.
Where does Certification get personal information from and with whom does it share that information?
If you are a Certification client, Certification will share your personal information with its accreditation bodies, regulators, Competent Authorities, agents, auditors and scheme owners in connection with delivering the contracted services, adding value for clients and enabling official recognition of our schemes.For further information on these parties, please contact Nicola Spencer whose contact details are set out at the start of this notice.
Certification may disclose and/or exchange personal information with other certification bodies in case of termination of the agreement with you, transfers of certification, dual certification, subcontracted production or as part of any investigation.
Certification may disclose and/or supply data with third parties under signed confidentiality agreements for the sole purpose of abstracting anonymous certification data for research.
Certification may supply a licensee's name, contact details, general enterprise, product categories and any other information which is public as defined by the relevant qualifying standard, to third parties.
Save where indicated below, we are relying on legitimate interests as described under "Our legal bases for using your information" above.
Events:
If you attend one of our events, we may share your personal information with our partners who are supporting us.We will provide further information on this when you sign up for the event.
We will share your information with event-booking platforms such as Eventbrite.
For these purposes we are relying on contract (where we have a contract with you) in addition to legitimate interests.
Use of contractors:
We use contractors, who may have access to personal information, in the following ways:
We use online "cloud" platforms to help us store and access personal information.This includes our email platform and our CRM (customer relationship management) system;
We share information with our IT contractors, for example, where they need access to our IT systems in connection with providing technical support;
If you use a third party platform to donate, we will receive information about you from them;
We use payment providers; and
We use mailing houses who send out communications on our behalf (this applies to email as well as postal communications).
The Soil Association entities may also share personal information with SA Sales and Services Limited which is a trading subsidiary of the Charity.SA Sales and Services will assist the other Soil Association entities (for example, when you place an order) but the other entities remain responsible for how they process your personal information.
To deal with concerns and to protect our interests
Sometimes we may need to use your personal information to investigate a concern or if we suspect something has gone wrong.This includes:
If we receive a complaint about one of the services we offer; and
If we suspect that something has happened which could damage our business or interests.For example, if someone was using our logo to issue fake certification certificates.
If there has been a public safety incident or potential criminal offence at our Spear House premises we may review footage that we record on our CCTV system.
In some circumstances, we may need to involve third parties.This includes our lawyers, insurers and other professional advisors.We may also need to involve our auditors if what has happened relates to our certification business.In exceptional circumstances, the Charity Commission may need to be told as well.
Primarily, we are relying on legitimate interests here, but details of the exact legitimate interest we are relying on and whether there are any other bases will depend on the circumstances.
Please note that we may process your personal information without your knowledge or consent where this is required or permitted by law.
Contractors and Members
If you provide the Soil Association with goods or services then we may process personal information in connection with what you have supplied.This includes information about your expertise and we may also keep a record if we have a concern about the work you have done.It also includes the names and business contact details of any staff you have.
If you are a Companies Act member of the Charity then we will hold your name, contact details and any correspondence we have had with you.
We are relying on legitimate interests and contract here.
We have extra obligations when we process personal information which is especially sensitive.This is called "special category" personal information under data protection law.These special categories are as follows:personal information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic information, biometric information, health information, and information about sex life or sexual orientation.
We do not generally collect special category personal information but we may do so where you attend one of our events.In these cases, we may need to use information about your health or condition so that we can make adjustments (e.g., in respect of seating or dietary requirements).Using personal information in this way is justified in the substantial public interest.
This notice also applies to how personal information is used through our website.This notice should be read in conjunction with our Website Terms and Conditions:
As you interact with our website, we may automatically collect information about your equipment, browsing actions and patterns. We collect this personal information by using cookies, google tag manager and other similar technologies. For further details please see our cookie policy:
We will use the information we collect through your interaction with our website to:
Ensure network and information security, including preventing unauthorised access to our computer and electronic communications systems and preventing malicious software distribution; and
To use data analytics to improve our websites, products/services, marketing, customer relationships and experiences.
This is for our legitimate interest in giving you content which is bespoke to you and making sure that our website runs smoothly.
You may receive targeted advertisements through our use of social media audience tools. This depends on your settings or the privacy policies for social media platforms - like Facebook, Instagram, and Google. For example, Facebook’s ‘Custom’ and ‘Lookalike’ Audiences’ programmes enable us to display adverts to our existing supporters or other people who have similar interests or characteristics.
We may provide your data (including your name and email address, phone number and postcode) to the social media platforms. This is to check if you have an account and to create a ‘lookalike’ audience. Our adverts may then appear when you use the social media platform. We only work with social media platforms that provide a facility for secure and encrypted upload of data, and immediately delete any records not matching with their own user base.
For more information, or to manage your social media ad preferences, please see:
When we engage with Facebook to identify you on their platform and provide you with our adverts, we are joint controllers of your personal information with Facebook. Our agreement with Facebook sets out our responsibilities to you – for example, we are responsible for informing you about this activity. Both we and Facebook are responsible for keeping your information secure. You can exercise your privacy rights against each of us individually.
If you do not want us to use your data for social media advertising, contact us to opt out:
Email us at memb@soilassociation.org or call 0300 330 0022
If you have asked us not to use your information for targeted social advertising, you may still see adverts related to us. This is because the social media platform or advertising network may hold information about you (such as your age and location, or websites you have visited) that wasn't provided by us.
Where we need to collect personal information by law, or under the terms of a contract we have with you and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with goods or services). In this case, we may have to cancel a product or service you have with us, but we will notify you if this is the case at the time.
In some circumstances, we will send your information to countries which do not have the same level of protection for personal information as there is in the UK.
The European Commission has produced a list of countries which have adequate data protection rules.The list can be found here: https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/adequacy-protection-personal-data-non-eu-countries_en
If the country that we are sending your information to is not on the list, or is not a country within the EEA (which means the European Union, Liechtenstein, Norway and Iceland), then it might not have the same level of protection for personal information as there is in the UK.
We transfer personal information outside of the EEA as follows:
Where you are located outside of the UK.This applies to our international Certification clients in particular.We will send information to you directly, and also to any auditor, contractor or regional agent carrying out services on our behalf;
Where we use cloud based platform to store personal information and that platform stores data outside of the EEA.
We can provide you with further details about the safeguards which we have in place outside of this privacy notice, please contact Nicola Spencer, Group Resources Director, Soil Association.
We will only keep your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements.
In many cases, we will keep your personal information for seven years.
Right to be informed: organisations must tell individuals what data is being collected, how it’s being used, how long it will be kept and whether it will be shared with any third parties.
Right of access: individuals have the right to request a copy of the information that an organisation holds on them.
Right of rectification: individuals can correct inaccurate or incomplete data.
Right to be forgotten: in certain circumstances, individuals can ask organisations to erase any personal data stored on them.
Right of portability: in some circumstances, individuals can request that an organisation transfer any data that it holds on them to another company.
Right to restrict processing: in some circumstances, individuals can request that an organisation limits its use of personal data.
Right to object: individuals have the right to challenge certain types of processing, such as direct marketing.
Rights related to automated decision making, including profiling: under most circumstances, individuals have the right to object to having decisions made about them by automated processes or profiling
To exercise any of your rights you can submit your request in writing to the following individuals:
for the Charity (Soil Association Limited) and the Land Trust (Soil Association Land Trust Limited) please write to Nicola Spencer at Soil Association, Spear House, 51 Victoria Street, Bristol BS1 6AD; or
for certification (Soil Association Certification Limited) please write to Emma Yeats at Soil Association Certification, Spear House, 51 Victoria Street, Bristol BS1 6AD.
If you wish to talk to us about any aspect of this notice or make any changes to how we manage your personal information, please contact:
for the Charity (Soil Association Limited) and the Land Trust (Soil Association Land Trust Limited) please write to Nicola Spencer at Soil Association, Spear House, 51 Victoria Street, Bristol BS1 6AD, tel. 0300 330 0100; or
for Certification (Soil Association Certification Limited) please write to Emma Yeats, Soil Association Certification Limited, Spear House, 51 Victoria Street, Bristol BS1 6AD, tel. 0300 330 0100.
If you consider that we have not acted properly when using your personal information, you can contact the Information Commissioner's Office: ico.org.uk.
