Updated and approved in March 2026

1. Who are we?

Epping Forest Heritage Trust was established in April 12 2018 from the merger of the Friends of Epping Forest (established in 1969) with the Epping Forest Centenary Trust (established in 1978), the Centenary of the Epping Forest Act 1878.

Our focus is Epping Forest, managed by the City of London Corporation. We operate throughout the Forest, and our three areas of activity are:

to educate and inspire people about the Forest
to conserve and grow the Forest
to protect the Forest through engagement, policy and campaigning

We work closely with the City of London Corporation, including operating the Epping Forest Visitor Centre at High Beach, contributing to habitat management through our Green Team volunteers and Happy Loppers, a group with learning difficulties. We are also actively involved in consultative committees and responding to development proposals and plans which could threaten the Forest, and engage with policy and decision makers

We work with a variety of adults and young people including schools, special needs groups, volunteer groups and community groups.

2. Definitions

Any references to EFHT, “our”, “us” or “we” refers to: Epping Forest Heritage Trust. We are a registered charity in England and Wales, and our registered charity number is 275076. Epping Forest Heritage Trust, our charitable trading company; (registered company number 1339783).

We use three key definitions to describe people mentioned in this policy. These are definitions used by the Information Commissioner’s Office (ICO), the UK’s independent body set up to uphold information rights (www.ico.org.uk)

‘Data Subject’: this is you. It includes all individuals about whom we hold personal data, for instance an employee, a member, or a supporter. As the data subject, we respect your right to control your data
‘Data Controller’: this is us, Epping Forest Heritage Trust. With your permission, we determine why and how your personal data is used (as outlined in this policy).
‘Data Processor’: this is a person, or organisation, which processes your data on our behalf, with your permission. For example, this might be a mailing house who sends your membership magazine to you, on our behalf; or an impact evaluation consultancy who monitors our programme delivery for funder reporting purposes.

3. Our commitment to your privacy

We are committed to keeping the personal details of our members and supporters safe. This policy explains how and why we use your personal data, to ensure that you remain informed and in control of your information.

When we work with Data Processors, we always set up a written contract/agreement with them to protect your data. The third parties we work with at no point ‘own’ your data, so you will never hear from them independently. We always send your data to partner organisations securely, to minimise the risk of it being intercepted by unknown individuals and/or organisations.

We will never sell your personal data.

Should you wish to find out more about the information we hold about you, or about our Privacy Policy, please contact us:

Email: admin@efht.org.uk
Telephone: 020 8508 9061
The Warren Lodge, Loughton, Essex, IG10 4RN

4. Why do we collect your personal data

We will only ever collect, store, and use your personal data when we have an identified purpose and reason to do so. The ICO refers to this as a ‘lawful basis’. Further information about why we collect your personal data is outlined below.

a. To administer your EFHT membership

We collect your personal data to administer your membership. The ICO defines the lawful basis for processing your data for these purposes as ‘contractual’. This may involve:

Sending you your membership welcome pack when you first join us
Sending your membership publications in accordance with your preferences
Processing your Direct Debit subscription payments, if you have set this donation process up with us
Sending you your membership renewal letter
Getting in touch should there ever be any issues processing your subscription payment
Speaking to you about your membership.

Within the context of your membership, there are two situations where information will not be addressed to the person who supplied the personal data.

Joint membership- If you are a ‘joint’ member, we will address communications to all adults listed on your membership if we have the information. If you wish to update this at any point, please let us know.
Gift membership- If your membership was purchased as a gift, we will use the address provided by the purchaser to send your membership communications in the post. If your membership was not purchased using direct debit, we will send a “renewal letter” to you at the end of your membership to see if you would like to continue being a member.

b. To administer your donation

We collect your personal data to administer your donations, which may involve:

Sending you a thank you letter
To conform to HMRC requirements and to be able to contact you in the case of being unable to process your donation. The ICO define the lawful basis for processing your data for these purposes as ‘contractual’.

c. To enable you to volunteer with us

If you are an Epping Forest Heritage Trust volunteer, we collect your personal data so that we can keep in touch with you. As defined by the ICO, the lawful basis for processing your data for these purposes is ‘contractual’ (where administering your volunteer record) and ‘legitimate interest’ (when sending you information about our work). This will include:

information to keep you up to date with volunteering
changes to planned volunteer programmes that you may be taking part in
the positive impact you have on our work
dedicated volunteer events.

d. To help us understand how members and supporters engage with us, and what their preferred means of receiving information are

e. To gather information on people engaging with Epping Forest, or taking action to protect and preserve Epping Forest, so that we can report on these figures and apply for additional funding. The ICO define the lawful basis for processing your data for these purposes as ‘legitimate interests’.

f. To send you information about our work and ask for your opinion. This information is in addition to that outlined above and is defined as ‘direct marketing’ by the ICO.

We collect your personal data so that we can send you information about our work that we feel will be of interest to you. From time to time, we may also use your personal data to ask for your opinion about our work.

Your personal data helps us to get to know you better and to develop a ‘profile’ of you on our secure supporter database. This ‘profile’ enables us to send you the information listed above in a timely and relevant way, to suit you. For example, keeping track of the donations you make to our organisation helps us to send you information about fundraising appeals that we feel you would like to hear about.

Likewise, keeping a record of your attendance at our guided walks, helps us to send you relevant updates on walk programme updates or when we are looking for more volunteers to support the walk programmes.

We will not contact you other than if you have opted in to hear from us. Opt-in consent, where you have given us express permission to contact you by particular communication channels, is one of the lawful bases for processing your data for ‘direct marketing’ purposes, as defined by the ICO.

Examples of what we might contact you about are fundraising appeals, events, campaigning opportunities, membership, services, products, newsletter requests, competitions and other activities.

We use opt-in consent to send you the information listed above by post, email, or telephone. Please note that giving opt-in consent to be contacted by telephone overrides any registration with the Telephone Preference Service.

We respect your right to update the way we get in touch with you about our work at any time, you can do this by contact us at admin@efht.org.uk, or call us on 020 8508 9061.

5. What Kind of Personal Data do we Collect? How do we Collect it?

a. Basic information

We will usually collect basic information about you, including your name, postal address, telephone number, email address and your bank or credit card details if you are supporting us financially. Most of the time, we collect this data from you directly. Sometimes this is in person; other times, it is over the telephone, in writing, through our website or through an email.

b. Getting to know you better

We also collect information about you that helps us to get to know you better. This may include:

information about your involvement with our predecessor organisations (Friends of Epping Forest and Epping Forest Centenary Trust), or your memories and stories about the Forest
records of donations you’ve made towards fundraising appeals
your preferences as to how you would like us to contact your
feedback about your volunteering experience through our Volunteer surveys
records of events you’ve attended, or campaigns, volunteering or other activities that you’ve been involved in.

Sometimes we will ask to collect other information about you such as your date of birth and title. We do this in order to analyse data and inform future marketing activity, allowing us to use our resources more efficiently but also to ensure the safety of our supporters in the case of volunteers and safeguarding. If you do not wish for these details to be held about you, you can tell us by contacting us at admin@efht.org.uk

Once again, most of the time we collect this data from you directly.

Other ways in which we collect personal data to get to know you better include:

i) Our website
Our website uses ‘cookies’ to help provide you with the best experience we can. Cookies are small text files that are placed on your computer or mobile phone when you browse websites.

Our cookies help us:

Make our website work as you’d expect
Remember your settings during and between visits
Improve the speed/security of the site
Allow you to share pages with social networks like Facebook
Continuously improve our website for you

For more information on our Cookies Policy, please see section 6.

c. Special category/criminal offence data

We do not normally collect or store what the ICO refers to as special category data (such as information relating to health, beliefs or political affiliation) about supporters and members. However, there are some situations where this will occur. When we do so, we will be very clear as to why we are collecting such information, and we will only do so with your specific consent and permission. In these situations, we collect the data from you directly.

If you are a volunteer then we may collect extra information about you, for example:

references
criminal records checks
details of emergency contacts
medical conditions.

We may also collect special category data if you have an accident on one of our volunteering events. This information will be retained for legal reasons, for safeguarding purposes and to protect us (including in the event of an insurance or legal claim). If this does occur, we’ll take extra care to ensure your privacy rights are protected.

If you are involved with certain activities with us e.g. volunteering, walks, or community engagement events, we may ask for your age, ethnicity, gender, sexual orientation, beliefs, disabilities, in order to inform our understanding of our reach and to provide reporting for our funders.

If you do not wish for these details to be held about you, you can tell us by contacting admin@efht.org.uk

d. Photo/video/voice recordings
Photographs and videos help us to promote our work to preserve and protect Epping Forest now and for generations to come. Contact details and consent will always be taken at the same time to allow us to contact you about the images if needed. By consenting for yourself or your child to be photographed or filmed, you are helping us to spread the word and attract new volunteers, supporters and funders.

Epping Forest Heritage Trust may use the images/video recordings:

On our website and social media channels – this will be public and could be Facebook, Instagram, LinkedIn and other places online.
In Epping Forest Heritage Trust’s magazine and leaflets that we print.
To send to media or social media channels when they want to write about Epping Forest Heritage Trust and our work

e. Children and young people
In line with Data Protection law, we will not collect, store or process your personal details if you are under 18 years of age.

6. Our use of cookies

Our website uses cookies, as almost all websites do, to help provide you with the best experience we can. Cookies are small text files that are placed on your computer or mobile phone when you browse websites.

We use cookies, which are issued by third party service providers that we continuously assess to make sure the data is secure. We collect these cookies in order to ensure that anything we do in our online advertising and campaigns is cost effective and relevant. We track how well our adverts perform and then analyse this data to make sure we can continue to make improvements.

Our cookies help us:

Make our website work as you’d expect
Remember your settings during and between visits
Improve the speed/security of the site
Allow you to share pages with social networks like Facebook
Continuously improve our website for you.

We do NOT use cookies to:

Collect any personally identifiable information (without your express permission)
Collect any sensitive information (without your express permission)
Pass personally identifiable data to third parties
Pay sales commissions.

Most web browsers allow some control of most cookies through the browser settings. To find out more about cookies, including how to see what cookies have been set and how to manage and delete them, visit www.allaboutcookies.org

To opt out of being tracked by Google Analytics across all websites visit http://tools.google.com/dlpage/gaoptout

7. How do we store your data

a. Security
All of the personal data we process is processed by our staff in the UK. However, for the purposes of IT hosting and maintenance your information may be situated outside of the European Economic Area (EEA). This will be done in accordance with guidance issued by the Information Commissioner’s Office.

Electronic data and databases are stored on secure computer systems and we control who has access to information (using both physical and electronic means). Our staff receive data protection training and we have a set of detailed data protection procedures which personnel are required to follow when handling personal data.

b) Payment security
All electronic EFHT forms that request financial data will use the Secure Sockets Layer (SSL) protocol to encrypt the data between your browser and our servers.

If you use a credit card to donate, purchase a membership or purchase something online we will pass your credit card details securely to our payment provider (GoCardless or Stripe). Other payment methods (e.g. ApplePay, PayPal) are handled in a similar manner.

Epping Forest Heritage Trust will never store card details.

Of course, we cannot guarantee the security of your home computer or the internet, and any online communications (e.g. information provided by email or our website) are at the user’s own risk.

8. How long do we store your data?

We will only use and store information for as long as it required for the purposes it was collected. We continually review what information we hold and delete what is no longer required.

When your membership ends we will no longer send you letters or publications as part of your membership.
If you have opted in to hear from us, we will continue to contact you until you tell us that you no longer wish to. You can opt out email communication from the ‘unsubscribe’ option at the footer of the email. Or you can contact us to update your preferences: admin@efht.org.uk or 020 8508 9061
If you have ever made a payment or donation but have not opted in to, or have opted out of, hearing from us, we will retain your personal data for 8 years in line with financial regulations. After this, your personal data will be deleted and the financial transactions anonymised for future financial reporting purposes.
If you have registered to volunteer with us we will retain your data while you are actively volunteering with us. If you have not opted into any other updates from Epping Forest Heritage Trust and have no financial transactions with us, we will delete your personal data after 5 years if you either tell us you have finished volunteering or have not actively volunteered recently and we’re unable to contact you. This is to allow for reporting on our volunteer activities and to ensure a smoother transition should you feel able to join our volunteer teams again in the future. In cases where we can safeguard yourself or others by retaining your personal data, we will do so indefinitely.
If we have gathered your data through you attending an event, purchasing a product online, or holding a membership with us but have no financial transactions and have either not opted in to or have opted out of hearing from us about anything else, we will delete your personal data after 12 months. In the case of memberships this will be 6 years after the end of the membership.
If you have consented to us taking images/video recordings of you, your child or event attendees, we will retain the images for a period of 6 years, along with some basic personal data. You can ask us to stop using images/video recordings in which you or your relative appears at any time, in which case it will not be used in future communications, but may continue to appear in any printed publications already in circulation

9. Your rights

We respect your right to control your data. Your rights include:

a) The right to be informed
This privacy notice outlines how we capture, store and use your data. If you have any questions about any elements of this policy, please contact us.

b) The right of access
If you wish to obtain a record of the personal data we hold about you, through a Subject Access Request, we will respond within one month.

c) The right to rectification
If we have captured information about you that is inaccurate or incomplete, we will update it.

d) The right to erase
You can ask us to remove or anonymise your personal details from our records. However, if any financial transaction has taken place we must retain your information for 7 years and 1 month after the last transaction takes place. We will remove or anonymise your personal details after this point, and confirm that it has been done.

e) The right to restrict processing
You can ask us to stop using your personal data.

f) The right to data portability
You can ask to obtain your personal data from us for your own purposes.

g) The right to object
You can ask to be excluded from marketing activity.

h) Rights in relation to automated decision making and profiling
We respect your right not to be subject to a decision that is based on automated processing.

For more information on your individual rights, please see the Information Commissioner’s Office.

10. Making a complaint

To make a complaint to Epping Forest Heritage Trust about your data and privacy, please contact: admin@efht.org.uk

To view our Complaint Policy, please visit: https://efht.org.uk/about-us/our-policies/

For further assistance with complaints regarding your data, please contact the Information Commissioner’s Office, whose remit covers the UK. Visit https://ico.org.uk/make-a-complaint/ or call 0303 123 1113

11. Leaving our website

We are not responsible for the privacy practices, or the content of any other websites linked to our website. If you have followed a link from this website to another website you may be supplying information to a third party.

Privacy Policy