Community HarvestPrivacy Policy
Last updated: 11 May 2026.
Community Harvest Whetstone (CHW) is the data controller for the personal information we hold about our members and applicants. We're a registered co-operative society in England and Wales, based at Whetstone Pastures Farm, Leicestershire.
This page explains what we collect, why we collect it, how we look after it, and the rights you have over it. We've tried to keep it short and readable.
What we collect
- Your name and email address.
- The membership type you've chosen and your share preferences.
- Anything you choose to write to us — application messages, recipes you contribute, wildlife observations you upload.
- Your account login details (we store your password as a secure hash; we never see or hold the original).
- Records the co-op needs to run: volunteer hours, deliveries, membership status changes.
- Limited technical information when you use the site, such as your IP address (used briefly to protect the site from automated abuse).
Why we collect it, and our legal basis
We process your data for the legitimate purposes of running a co-operative — communicating with members, planning harvests and deliveries, organising events, and meeting our obligations under the Co-operative and Community Benefit Societies Act 2014 and our registered Rules.
Our lawful bases under UK GDPR are contract (to provide membership services we've agreed to give you), legitimate interests (to run the co-op effectively and keep the site secure), and legal obligation (for accounting, statutory record-keeping, and society law).
Where it's stored, and who sees it
Your data is held on secure servers located in the UK and the European Union. We do not transfer your data outside of the UK or EU.
Inside the co-op, your data is seen only by the people who need it to do their role: committee members for membership administration, growers for harvest planning, and the staff who handle deliveries and the newsletter.
We also use a small number of trusted service providers — for email delivery, image hosting, and the software our committee uses to keep records. These providers process data on our instructions and may not use it for any other purpose. We do not sell, rent, or share your data with anyone for advertising or marketing.
How long we keep it
We keep your data for as long as you're an active member. If you leave the co-op, we keep the minimum required for legal and financial record-keeping — typically seven years for accounting records — and remove the rest.
You can ask us to remove your data at any time by emailing committee@communityharvest.co.uk.
Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you.
- Ask us to correct anything that's wrong.
- Ask us to delete your data, where we're not required to keep it.
- Object to how we're using it, or ask us to restrict our use.
- Receive your data in a portable form.
To exercise any of these rights, write to committee@communityharvest.co.uk and we'll respond within 30 days.
If you think we've mishandled your data, you also have the right to complain to the Information Commissioner's Office (ICO).
Changes
We'll update this page if our practices change. The date at the top is the most recent revision.