Privacy notice

Last updated: 21 October 2026
Notice version: 2026-10-21-v2

Who we are

Poltimore House Trust is a registered charity, number 1079947. We work to preserve and restore Poltimore House and Grounds and make them available for public benefit. Poltimore House Trust is the controller of the personal information described in this notice. This means that we decide why and how that information is used.

You can contact us about your personal information, exercise your rights or make a data protection complaint:

• Email: info@poltimore.org?subject=Data%20protectioninfo@poltimore.org, marked “Data protection”
• Post: Data Protection Lead, Poltimore House Trust, Poltimore House, Poltimore, Exeter EX4 0AU
• Telephone: 01392 248938

Our email updates also cover Branches Cafe and Martinsfield Farm Shop, including their news, events and offers. The Trust remains the sender and controller for this combined subscription.

What this notice covers

This notice explains how the Trust uses personal information when you visit our website, contact us, subscribe to email updates, support our work, attend our activities or have a volunteering or other relationship with us.

We may provide additional privacy information for particular activities, such as recruitment, safeguarding or a specific event. That information supplements this notice. Visiting our website does not mean that you consent to every use of personal information described here.

Information we collect and where it comes from

We collect information that you give us through website forms, email, telephone, post, conversations and the activities you take part in. Depending on your relationship with us, this may include:

• Your name, email address, postal address and telephone number
• Your enquiries, correspondence and communication preferences
• The date, source and wording of a marketing subscription, and later changes to that preference
• Details needed to administer an event, booking, donation or membership
• Donation and Gift Aid information, where relevant
• Your volunteering interests, activities, hours and relevant training
• Information needed to manage an authorised CRM user account
• Technical information needed to operate and protect our website and systems, such as connection logs and security events
• Records showing whether an email was submitted for delivery, delivered, rejected or unsubscribed from

Sometimes another person or organisation gives us information, for example an event partner or an emergency contact. We consider whether we have a lawful reason to use it and provide appropriate privacy information. We do not assume that receiving someone’s details from a third party gives us permission to send marketing.

A newsletter subscription asks for your first name, surname and email address. It does not require your postal address, date of birth, financial details or health information.

If an activity requires health information or another special category of personal information, we explain the need and identify both a lawful basis and an additional condition under data protection law before collecting it. We do not collect this information through the newsletter sign-up form.

Why we use information and our lawful bases

We use personal information only where we have an appropriate lawful basis.

• For newsletter and other promotional email updates, we rely on your consent to the subscription described when you sign up.
• For enquiries and ordinary correspondence, we normally rely on our legitimate interests in responding to people and running the Trust. Where an enquiry concerns a contract or steps you ask us to take before a contract, we may instead rely on that basis.
• For bookings and paid services provided by the Trust, we use information where necessary to perform our contract with you or take steps you request before entering a contract.
• For volunteering administration, training and coordination, we normally rely on our legitimate interests in organising our work, supporting volunteers and keeping people safe. Where a legal obligation applies, we rely on that.
• For donations, Gift Aid, accounts and statutory records, we use information to administer the support you give us, meet our legal obligations and pursue our legitimate interests in financial accountability.
• For system security, access administration, troubleshooting and preventing misuse, we rely on our legitimate interests in protecting people and our systems and, where applicable, our legal obligations.
• For recording objections, withdrawals and suppression preferences, we rely on our legitimate interests in respecting your choices and preventing unwanted marketing, together with applicable legal obligations.

Where we rely on legitimate interests, we consider the necessity of the processing and balance those interests against your rights and reasonable expectations. You can ask us for more information about this assessment.

Different activities may have different lawful bases even where they are recorded in the same supporter record.

Email updates and your choices

Our website sign-up is for occasional emails from Poltimore House Trust about the House and Grounds, restoration work, upcoming events, volunteering opportunities, fundraising appeals and Branches Cafe and Martinsfield Farm Shop news, events and offers.

You choose to subscribe by selecting the unticked opt-in box and submitting the form. We add your subscription without asking you to confirm it in a second email. We then send a welcome email explaining your subscription and how to unsubscribe.

We record the information shown when you subscribed, the time we received your request and its source. Your details pass from our website into the Trust’s CRM, which manages subscriptions and email delivery.

Subscribing does not create a membership, apply you for a volunteering role or give you a CRM account.

You can withdraw your marketing consent at any time by following the unsubscribe link in an email or contacting info@poltimore.org.

Unsubscribing stops the Trust’s marketing emails to that email address. If you share an email address, the marketing preference applies to the mailbox, including where it is linked to more than one supporter record. Please contact us if you need help with a shared address.

You may still receive necessary, non-promotional messages about an existing booking, donation, membership, volunteering arrangement or account where we have a separate lawful reason to send them. Unsubscribing from marketing does not itself cancel one of those arrangements.

We may send a one-off preferences update to subscribers whose existing permission covers it. If that message says that no action is needed, not replying leaves valid existing permission unchanged. An affirmative confirmation is recorded separately.

We do not treat silence as new consent and do not use this exercise to reinstate an unsubscribe or expand an older subscription to topics it did not cover. Adding cafe information to a revised notice does not, by itself, authorise cafe promotions to an existing subscriber.

Withdrawing consent does not affect processing that was lawful before withdrawal. We retain the minimum suppression information needed to prevent further unwanted marketing.

Who can receive information

Access is limited to trustees, staff, volunteers and advisers who need information for their role.

We use service providers to host our website, operate forms and the CRM, send email and support our systems. Providers acting as our processors must use information under appropriate contractual instructions and security requirements. We may also share information with professional advisers, HMRC, regulators or other authorities where necessary and lawful.

If you choose to use an external donation, fundraising or social media service, that organisation may collect and use information under its own privacy notice. Check the information on the service before using it.

We do not treat all organisations associated with Poltimore House as having automatic access to all supporter information. Any sharing between separate controllers needs its own lawful justification and appropriate transparency.

Where information is processed

Our CRM uses cloud infrastructure residing within the European Union and UK. Email delivery and website hosting may involve additional service locations and sub-processors.

How long we keep information

We keep information only for as long as it is needed for the relevant purpose, including applicable legal, accounting, safeguarding or dispute requirements. We review records and delete or anonymise information that is no longer needed.

Our retention approach is:

• Newsletter subscription details are kept while the subscription remains active and relevant. We review continuing relevance at least every two years. This review does not make consent expire automatically after a fixed period.
• Website sign-up entries are retained for up to 30 days after successful CRM synchronisation so we can check delivery and resolve problems. Entries that have not synchronised are reviewed and resolved before deletion.
• Ordinary enquiries are normally retained for up to two years after they are resolved, unless they form part of another continuing relationship or record.
• Evidence of marketing permission, preference changes and relevant sending history may be kept for up to six years after the last relevant communication or withdrawal where needed to demonstrate how we respected your choices or deal with a complaint.
• Minimal suppression information is kept for as long as it is needed to prevent unwanted marketing. Deleting an ordinary contact record does not mean we should forget an objection and contact the address again. We may also retain a minimal form-entry identifier to prevent an erased submission being replayed and recreating a deleted contact.
• Donation, Gift Aid and accounting records are retained for the applicable statutory period, normally at least six years after the relevant tax year or accounting period, and longer where the law requires it.
• Volunteering and training records are normally retained for the relationship and up to six years afterwards where needed for accountability, safety or potential claims. More sensitive documents are removed earlier where they are no longer necessary. Safeguarding requirements may justify a different period.
• Security and operational logs are retained according to the service’s documented retention settings and the need to investigate incidents, rather than being kept indefinitely for general marketing.

Backups follow the retention cycles of the systems involved. Deleted information may remain in restricted backups until those copies expire.

We do not use those copies as active marketing lists. If we restore a backup, we will take all reasonable steps to reapply relevant deletion and suppression decisions before using restored information.

Cookies, embedded content and email measurement

Our website uses cookies and similar technologies for functions such as security and remembering choices. We provide information about the cookies and their duration in our cookie information or preference settings.

Where the law requires permission for non-essential cookies or similar technologies, we ask before using them and provide a way to change your choice. Cookie choices are separate from permission to receive email updates.

Content or links from external services may take you to a service that uses its own technologies and privacy terms that are not covered by this privacy notice or come under the responsibility of Poltimore House Trust.

The CRM newsletter workflow records sending, delivery reports and the preference actions you choose to complete.

Keeping information secure

We use proportionate technical and organisational measures to protect information, including restricted access, individual authorised accounts, encrypted connections and controlled administration. We limit the information collected and avoid copying whole sign-up submissions into unnecessary notification emails.

No system can be guaranteed completely secure. If a breach occurs, we assess it and notify the ICO and affected individuals where the law requires us to.

Your rights

Depending on the circumstances, you may have the right to:

• Ask for access to your personal information and a copy of it
• Have inaccurate information corrected and incomplete information completed
• Ask for information to be erased
• Ask us to restrict the use of information
• Object to processing based on legitimate interests
• Receive certain information in a portable format
• Withdraw consent where we rely on it

You have an absolute right to object to the use of your personal information for direct marketing. We will stop that use when you object.

Rights are not identical for every activity. For example, we may need to retain some donation records because of a legal obligation even if you unsubscribe from marketing.

Contact us using the details above to exercise your rights. We may ask for proportionate information to establish your identity. We normally respond to rights requests within one month, subject to the lawful rules on time limits and extensions.

We do not use the newsletter and preferences workflow to make decisions about you by solely automated means that have legal or similarly significant effects. Sending a requested welcome email and recording your choice are automated administrative actions.

Questions and complaints

Please contact our data protection lead through info@poltimore.org if you have a question or complaint about how we use personal information. You can also contact us by post or telephone using the details above.

We will acknowledge a data protection complaint within 30 days, investigate without undue delay, keep you informed where appropriate and explain the outcome.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator:

• Website: ICO complaint information
• Telephone: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

You do not have to give up your right to complain to the ICO by contacting us first.

Changes to this notice

We review this notice when our activities or systems change. We will publish the revised version and its update date on our website and bring significant changes to your attention where appropriate.

Updating this notice does not, by itself, give us permission to use your information for a new purpose. Where a proposed use requires new consent, we will ask for it.