Privacy Policy

How Food Power Together uses your data when you visit our site, your UK GDPR rights, and how to contact our data protection lead.

This privacy policy explains how Food Power Together uses your personal data when you visit our website. It also sets out your rights under the UK General Data Protection Regulation (UK GDPR) and how to reach us if you have a concern.

Food Power Together is the food partnership of the borough of Redcar and Cleveland, convened by Redcar & Cleveland Voluntary Development Agency (RCVDA) and Tees Valley Rural Action (TVRA). RCVDA is the data controller for this website and is responsible for the personal data described here. RCVDA hosts the partnership operationally. TVRA is a co-convening organisation; we cover its role under “Who we share data with” below.

Who we are

Redcar & Cleveland Voluntary Development Agency is a registered charity in England and Wales (charity no. 1135959) and a company limited by guarantee (company no. 2720382). Our registered office is The Palace Hub, 28-29 Esplanade, Redcar, North Yorkshire TS10 3AE. Our Information Commissioner’s Office registration number is Z8779915. You can reach our data protection lead at dpo@rcvda.org.uk.

What this privacy policy covers

This policy covers the public Food Power Together website at https://www.foodpowertogether.org.uk and the contact channels we publish on it. It does not cover the other websites we link out to — partner organisations, food support venues, funders or regulators — each of which has its own privacy notice.

The data we collect

We keep the data we collect about visitors to a minimum. You can browse this site, and use the food-support map, without giving us anything.

  • Site usage data via Google Analytics. We use Google Analytics through the Site Kit by Google plugin to understand how people find and use the site — pages visited, approximate location, and device and browser type. With your consent, Google Analytics sets cookies on your device and reports this usage back to us in a combined form. We use it only to improve the site. Google Analytics is blocked entirely until you give consent, and it does not run in any form before you accept analytics cookies. You can refuse these cookies through the consent banner on your first visit and change your mind at any time.
  • The food-support map and search. Our food-support directory shows service points on an interactive map. The map’s background imagery is provided by OpenFreeMap (using OpenStreetMap data); loading it — like any web request — means your device’s IP address is visible to OpenFreeMap for that request. The map sets no cookies and does not track you. When you search by postcode, the postcode you type is sent to the postcodes.io lookup service to find its location so we can list services near you; we do not store what you search. When you choose “Use my location”, your browser asks your permission to share your device’s location, and that location is used only within your browser to order services by distance — it is not sent to us and we do not store it. Searching by place or venue name uses only information already published on this site.
  • Email enquiries. When you write to us at foodpower@rcvda.org.uk or dpo@rcvda.org.uk, we hold the message — your name, email address, and the content — for as long as we need to respond and to keep a record of the matter.
  • Contact form submissions. When you use the contact form on the site, we receive the information you type into it — typically your name, email address, and message. These submissions are stored in our website database, and we use them to respond to your enquiry.
  • Server logs. Our web host keeps short-term server logs of requests to the site. These include IP addresses, timestamps, the page requested, and the browser string. We use them to investigate technical errors and to protect the site against abuse.
  • Cookies. Our cookie policy lists every cookie set on the site and how to control them. This privacy policy covers what we do with data; the cookie policy covers how cookies set that data.

What we don’t collect

We don’t accept public comments. This site does not collect payment information. The food-support map does not track you: it sets no cookies, and “use my location” happens only in your browser — we never receive or store your location. We don’t profile visitors for advertising, and no visitor data is ever sold to third parties.

Our lawful bases under UK GDPR

We process personal data on two lawful bases:

  • Consent for non-essential cookies and analytics, and for using your device’s location when you choose “Use my location” (your browser asks your permission first). You can withdraw consent at any time.
  • Legitimate interest for responding to enquiries you send us, for looking up a postcode you search so we can show nearby services, for showing the map, for keeping security logs, and for protecting the site against abuse. We have weighed our interest against your rights and consider this proportionate. You can object to processing on this basis at any time — see “Your rights” below.

Who we share data with

We use a small number of trusted third parties to keep the site running, and share only what each of them needs to do its job.

  • Google LLC — Google Analytics processes combined site-usage data on the lawful basis of your consent.
  • OpenFreeMap (map tiles, OpenStreetMap data) — serves the map’s background imagery. When the map loads, your browser requests map tiles directly from OpenFreeMap, which receives your IP address and browser headers for that request. It sets no cookies and does not track you across sites. Lawful basis: legitimate interest.
  • postcodes.io — the UK postcode lookup service. When you search by postcode, the postcode is sent to postcodes.io to find its location; it is a UK-based open-data service, sets no cookies, and we do not store what you search. Lawful basis: legitimate interest.
  • Our web host — receives server requests and stores short-term technical logs.
  • Microsoft 365 — processes email correspondence sent to and from @rcvda.org.uk addresses.
  • Tees Valley Rural Action (TVRA) — as a co-convening organisation, TVRA may receive enquiries forwarded from the site where the enquiry is within its remit. It acts on a forwarded enquiry as an independent recipient.
  • Cloudflare, Inc. (Turnstile) — when you load a form, your browser exchanges a short verification token with Cloudflare to confirm you are a real visitor rather than a bot. Cloudflare receives connection metadata (your IP address and browser headers) for the duration of the check, sets no cookies, and does not see the contents of the form. Lawful basis: legitimate interest.
  • Brevo (Sendinblue SAS) — [include only if form notifications are sent via Brevo / WP Mail SMTP — see open point 1 above.] Our email delivery service. We share your email address with Brevo to deliver form notifications; it acts as our data processor. Brevo is EU-based and benefits from the UK’s adequacy decision for the EEA.

We do not transfer personal data to any third party for marketing or advertising purposes.

International transfers

Some of our suppliers operate outside the United Kingdom — Google in particular, and the map-tile service may serve imagery from servers outside the UK. Beyond the IP address that any web request necessarily exposes, we do not send personal data abroad for the map. Where we transfer personal data to a country without a UK adequacy decision, our suppliers apply UK-approved safeguards (standard contractual clauses and additional measures). You can ask us for a copy of the safeguards by writing to dpo@rcvda.org.uk.

How long we keep data

  • Analytics data: retained at the default Google Analytics 4 data-retention period.
  • Email correspondence and contact form submissions: kept for as long as we need to respond and provide a record of the matter, then deleted on a rolling basis. Where a query develops into a longer-running engagement — a partnership, a referral, a complaint — we keep records for the life of that engagement plus seven years.
  • Server logs: held for up to 30 days, then rotated out.
  • Map and search: we keep nothing. Postcodes you look up and any location you share are not stored by us.

Your rights under UK GDPR

You have the right to:

  • Access the personal data we hold about you.
  • Rectify inaccurate personal data we hold about you.
  • Erase your personal data where we no longer have a lawful basis to hold it.
  • Restrict how we process your data in certain circumstances.
  • Receive your data in a structured, machine-readable format (data portability).
  • Object to processing based on our legitimate interest.
  • Withdraw consent at any time, where consent is the lawful basis.

To exercise any of these rights, please write to dpo@rcvda.org.uk. We will respond within one calendar month, and there is no charge for a reasonable request.

How to make a complaint

If you are not happy with how we have handled your personal data, you can complain to the Information Commissioner’s Office (ICO), the UK’s independent regulator for data protection. Their address is Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, and their helpline is 0303 123 1113.

We would prefer to put the matter right first — please contact us at dpo@rcvda.org.uk before going to the ICO, so we have the chance to fix it.

Children

This site provides public information about food support in Redcar and Cleveland. We do not knowingly collect personal data from children under 13. If you believe a child has provided personal data to us, please contact dpo@rcvda.org.uk and we will delete it.

Changes to this privacy policy

We may change this privacy policy as the site develops. Where the changes are material, we will say so in the “last updated” line at the foot of this page. The current version always lives at this URL.

Contact

For any question about how we use your personal data, please write to dpo@rcvda.org.uk. For general enquiries about Food Power Together, foodpower@rcvda.org.uk is the right address.

Last updated: 15 July 2026