Mathew Trust website privacy policy
Last updated: 27 October 2026
Who we are
Mathew Trust is a charity registered in Scotland, charity number SC016284. We are responsible for deciding how personal information is used in connection with our website, enquiries and funding activities. Data protection law calls this the “data controller”.
You can contact us about your information, exercise your rights or make a data protection complaint:
Email: trusts@hlca.co.uk
Post: Mathew Trust, c/o Henderson Loggie, The Vision Building, 20 Greenmarket, Dundee, DD1 4QB.
This policy covers visitors to our website, people who contact us, applicants and people whose information appears in our website content. Our separate Funding Application Privacy Notice explains the application process in more detail. Our Cookie Policy explains cookies and similar technologies.
Information we collect and why
Visiting our website
To deliver website pages, our systems and relevant service providers receive technical information, including your IP address and the pages or resources your browser requests. Depending on the hosting and security configuration, diagnostic or security records may also contain request times, browser and device information, referring pages and errors.
We use the information needed to deliver the website, investigate faults and protect our systems against misuse. Our lawful basis is our legitimate interest in running a reliable, secure website. We assess whether that use is necessary and whether your interests and rights outweigh ours.
Contacting us
If you email, telephone or write to us, we receive the contact details you provide, the contents of your enquiry and any related correspondence. We use this to respond, provide information and keep an appropriate record of the matter. Our lawful basis is our legitimate interest in dealing with enquiries and administering the Trust.
You choose whether to contact us, but we may be unable to respond or deal with a request without the relevant contact details or information.
Funding applications
The online application form collects your name, organisation, role, email address, telephone number and completed application document. We also record submission information, including the IP address, date and time, form and page identifiers, and, if you are logged in, the associated website user identifier. Uploaded files have associated information such as their filename, format and size.
Your application and related correspondence may contain project information, budgets, accounts and information about other people. The form asks you to include links to supporting documents held on services such as Google Drive or Dropbox. If we open those links, we receive the information you make available to us through that service.
The website stores application details and uploaded files in its administration system. It is also configured to send application details and the uploaded application document by email to the people handling applications. Copies may therefore exist in the website, email systems and backups.
We use this information to assess applications, communicate with applicants, administer and monitor grants, keep decision records, prevent misuse of charitable funds and handle related complaints or claims. We rely on our legitimate interests in managing a fair, effective funding process and distributing charitable funds responsibly. Where particular charity, accounting or regulatory duties require us to retain or disclose information, we rely on compliance with those legal obligations.
The required fields and application document are needed to submit an online application. If relevant information is missing, we may be unable to assess the application. The privacy acknowledgement on the form records that you have read the notice; it does not make consent the lawful basis for assessing your application.
Please provide only information needed for the application. Avoid including identifiable information about beneficiaries, particularly children, and sensitive details such as health information, unless we have specifically agreed how that information will be handled. If you provide someone else’s information, make them aware of the relevant privacy notice.
Eligibility checker
The eligibility checker uses your answers within the current browser page to display guidance. Its code does not send those answers to us or save them in cookies or browser storage. Ordinary website delivery and technical processing still apply.
The checker gives preliminary guidance. It does not make a funding award decision or influence it in any way.
Stories, photographs and reports
Our website publishes information about the Trust and its funded work, including case studies, quotations, photographs and reports. This content may identify people. We may receive it directly from the people concerned or from the organisations whose work we support.
Fonts and other external services
We use Adobe Fonts to display the website’s typefaces. Your browser connects to Adobe’s servers to obtain the font files, which means Adobe receives your IP address and information about the font request and the website loading it. Adobe says it does not store the IP address or set or use cookies to serve its website fonts. Its use of font-service information includes delivery, fault diagnosis, billing and licensing administration. See the Adobe Fonts privacy information.
Our proposed lawful basis for requesting these fonts is our legitimate interest in presenting the website consistently.
Links to other websites do not mean that we control those services. If you follow an external link, or use an external service to share documents with us, that service’s own privacy information also applies.
Cookies and similar technologies
We use Complianz to display cookie choices and remember your preferences. WordPress also uses functional technologies, including a browser-session record of emoji display support. Cookies used for signing in and administration apply to authorised website users and are not all required for ordinary visitors.
The current Complianz configuration sets a 365-day lifetime for its preference cookies. Some information is held only for the browser session. The Cookie Policy should give the confirmed names, purposes, providers and lifetimes of the technologies actually used.
Where consent is required, optional technologies must remain inactive until you agree. You can change your choices through the consent controls in our Cookie Policy, and use your browser settings to manage cookies. Withdrawing consent does not affect the lawfulness of earlier processing.
Who receives your information
Information may be accessed by authorised Mathew Trust trustees and personnel, and Henderson Loggie personnel who help administer the Trust. Our website, email, IT support and backup providers may process information as needed to provide their services. Adobe receives font requests as described above.
We may share relevant information with professional advisers, auditors, regulators or public authorities where necessary for advice, governance, legal obligations or legal claims. We limit disclosure to what is needed for the purpose.
Providers acting on our instructions must have appropriate contractual obligations. Some organisations, including professional advisers or external service providers, may act as separate controllers for particular purposes; their own privacy information then explains those uses.
Where information is processed
Where we make a restricted transfer of personal information outside the UK, it must be covered by UK adequacy regulations, appropriate safeguards or another permitted legal route. Where contractual safeguards are used, these may include the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, together with the required assessment and any additional protections. Contact us for information about the safeguards applicable to your information and how to obtain a copy.
How long we keep information
We keep personal information only for as long as needed for the purpose for which it was collected, taking account of legal obligations, unresolved matters and the need to establish or defend legal claims. We delete or anonymise information when it is no longer needed.
Records relevant to an active complaint, investigation, audit, grant or legal claim may need to be retained for longer. Backup copies follow a defined rotation and deletion schedule.
Keeping information secure
We use appropriate organisational and technical measures to protect personal information and limit access to people who need it for their work.
Your rights
Depending on the circumstances, you can ask to access your personal information, correct inaccurate or incomplete information, erase it or restrict its use.
Your right to object: you can object to our use of your personal information where we rely on legitimate interests, for reasons relating to your particular situation. We must stop that processing unless we demonstrate compelling legitimate grounds that override your interests and rights, or need it for legal claims. You can object to use for direct marketing at any time.
Where we rely on consent, you can withdraw it at any time. Where we process information automatically on the basis of consent or a contract, a right to receive certain information in a portable format may also apply. That right does not generally apply to application processing based on legitimate interests.
Contact trusts@hlca.co.uk to exercise a right. We may need enough information to confirm your identity and locate the relevant records. We normally respond within one calendar month, subject to lawful extensions and any permitted clarification or identity checks. Some rights have legal limits; if we cannot fulfil your request, we will explain why and tell you how to challenge the decision.
Complaints
If you are concerned about our handling of your information, email trusts@hlca.co.uk or write to the address above. Please describe the issue and how we can contact you. We will acknowledge your data protection complaint within 30 days, investigate it, keep you informed and provide an outcome without undue delay.
You also have the right to complain to the Information Commissioner’s Office, the UK data protection regulator. See how to make a complaint to the ICO.
Changes to this policy
We review this policy when our activities, systems or legal requirements change. We publish the latest version here and update the date at the beginning. Where a material change affects how we use your information, we will provide any further notice required by law.
