Privacy Policy

Last updated: 12/05/26

We value your privacy very highly and are committed to handling your personal information responsibly, transparently, and in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This Policy explains what information we collect about you, why we collect it, how we use it, how long we keep it, and what rights you have.

1. WHO WE ARE

Totnes Renewable Energy Society (referred to in this Policy as “the Society”, “we”, “us”, or “our”) is the data controller responsible for your personal information. We are a Community Benefit Society registered in England and Wales.

Data Controller Contact Details

Totnes Renewable Energy Society

107 High Street, Totnes, Devon, TQ9 5SN

Email: admin@tresoc.co.uk

Tel: 01803 867431

If you have any questions about how we handle your personal data, or wish to exercise any of your rights (see Section 7), please contact our Data Protection Lead using the details above.

2. OUR WEBSITE

The Totnes Renewable Energy Society website (tresoc.co.uk) is owned and maintained by the Society, which decides on its content.

3. THE INFORMATION WE COLLECT

We may collect and process the following personal information about you:

Membership and share application information: Personal details you provide when applying to become a member or purchasing shares, including your name, postal address, email address, telephone number, date of birth, nationality, financial details relevant to your share investment, and the number of shares purchased. Where you apply on behalf of an organisation, we also collect the organisation’s registered name and registered address, the type of organisation, its registration or company number, and the position or role of the individual applicant within that organisation.
Financial and investment records: Details relating to your shareholding, including the number of shares held, amounts invested, and any interest or dividend payments made to you.
Mailing list subscriptions: Contact details (name and email address) provided when you subscribe to our Members or Friends mailing lists. These lists are operated using MailChimp, a service provided by Intuit Inc., based in the USA (see Section 5 for details of the data transfer safeguards in place).
Website problem reports and correspondence: If you report a problem with our website or contact us for any reason, we may keep a record of that correspondence.
Survey responses: Information you provide if you choose to participate in surveys we conduct for research purposes. Participation is always voluntary.
Website usage data: Information about your visits to our website and the resources you access, where you have given your consent to the use of analytics cookies (see Section 8).
Event photographs: We take photographs at TRESOC events, including events run as part of our REEL (Renewable Energy Experiential Learning) educational programme with schools. These photographs may depict participants, including both adults and pupils. Photographs may be used on our website, on our social media accounts, and in our share offer brochures and supporting documentation. Photographs are always used anonymously and are never published with names or identifying captions.

4. LEGAL BASIS FOR PROCESSING YOUR PERSONAL DATA

UK GDPR requires us to have a lawful basis for processing your personal data. The table below sets out the legal basis we rely on for each type of processing activity.

Processing Activity	Legal Basis (UK GDPR Article 6)
Processing your share application (including data shared with our share register administrator, Ethex), managing your shareholding, and administering your Society membership	Article 6(1)(b) – Performance of a contract to which you are party; and Article 6(1)(c) – Legal obligation (e.g. financial record-keeping required by HMRC and applicable company law)
Sending communications to members on our Members mailing list (e.g. newsletters, AGM notices, share offer updates)	Article 6(1)(f) – Legitimate interests. Our legitimate interest is in keeping members informed about Society activities relevant to their investment and membership. We have assessed that this interest is not overridden by your rights and freedoms.
Sending communications to those on our Friends mailing list	Article 6(1)(a) – Consent. You may withdraw your consent at any time by clicking the unsubscribe link in any email or by contacting us directly.
Responding to and retaining records of enquiries and correspondence	Article 6(1)(f) – Legitimate interests. Our legitimate interest is in responding to communications and maintaining records for operational and legal purposes.
Conducting surveys and research	Article 6(1)(a) – Consent. Participation is entirely voluntary.
Website analytics (tracking visits and resource use)	Article 6(1)(a) – Consent. Analytics cookies are only set where you have actively accepted them via our cookie consent tool.
Taking and publishing photographs of identifiable individuals at TRESOC events, including REEL events	Article 6(1)(a) – Consent. For adults, we obtain written consent at the event. For pupils, we obtain consent from the school or from a parent or person holding parental responsibility, either before or after the event. You may withdraw consent (including consent given on behalf of a child) at any time – see "Right to Withdraw Consent" in Section 7.

5. HOW WE USE YOUR INFORMATION

We will use personal information that you give us lawfully, fairly, and in a transparent manner, and only for proper, necessary, and legitimate purposes in connection with the Society.

We do not share your personal information with any other organisations for their own marketing purposes.

We may use your personal information to provide you with information about services you have requested, and information we reasonably believe will be of interest to you about the Society, its events, and its share offers – where we have a lawful basis to do so, as set out in Section 4 above.

We will not use your personal data for any purpose that is incompatible with the purpose for which it was originally collected, unless we have your consent or are required to do so by law.

Sharing with our Share Register Administrator (Ethex)

We have appointed Ethex Investment Club Limited (“Ethex”) as our share register administrator. Ethex acts as a data processor on our behalf under a written data processing agreement, and processes your personal data only on our instructions and in accordance with UK data protection law.

When you apply for shares in TRESOC, you will be required to open an account with Ethex in order to manage your shareholding. We share the following information with Ethex: your name, postal address, email address, telephone number, date of birth, nationality, and the number of shares you have purchased. Where you apply on behalf of an organisation, we also share the organisation’s registered name and registered address, the type of organisation, its registration or company number, and the position or role of the individual applicant.

Any additional information you provide directly to Ethex through your Ethex account is governed by Ethex’s own privacy policy, which is available at www.ethex.org.uk.

Ethex is based in the United Kingdom and we do not transfer your share register data outside the UK.

International Data Transfers

Our Members and Friends mailing lists are operated using MailChimp, a service provided by Intuit Inc., which is based in the USA. The transfer of your personal data to MailChimp is covered by the UK–US Data Bridge (the UK Extension to the EU–US Data Privacy Framework), which the UK Government has assessed as providing an adequate level of protection for personal data transferred to participating US organisations. We have also accepted MailChimp’s Data Processing Addendum, which sets out their obligations as our data processor.

We do not transfer your personal data to any other countries outside the UK, except where required to do so by law.

6. HOW LONG WE KEEP YOUR INFORMATION

We retain personal information only for as long as is necessary for the purpose for which it was collected, or as required by law. The following periods apply:

Members mailing list: Until you unsubscribe, ask us to delete your data, or your email address ceases to work. This allows us to maintain contact with you about Society matters relevant to your membership.
Friends mailing list: Until you unsubscribe, ask us to delete your data, or your email address ceases to work.
Share register and investment records: We are required by law (including HMRC requirements and applicable company law) to retain financial and membership records for a minimum of six years following the end of your membership or the withdrawal of your shares. After this period, records will be securely deleted or anonymised. Records relating to your shareholding that are held on our behalf by Ethex are retained for the same minimum period.
Correspondence and enquiry records: Up to three years from the date of the correspondence, after which records will be securely deleted, unless a longer retention period is required to resolve a dispute or comply with a legal obligation.
Survey responses: Up to 12 months from collection, after which responses will be either deleted or anonymised for ongoing research purposes.
Website analytics data: Where you have consented to analytics cookies, data about your website visits is held by our analytics provider(s) in accordance with their own retention policies. We configure our analytics tools to minimise data retention periods where possible.
Event photographs (including REEL): We retain photographs for as long as they remain relevant to our communications, educational outreach, and share offer activities. You may ask us to remove a photograph at any time (see Section 7). For pupils, a request for removal may be made by the pupil themselves, by the school, or by a parent or person holding parental responsibility. Where a photograph has already been published on third-party platforms (for example, social media) or in printed materials (for example, share offer brochures already distributed), we will take all reasonable steps to remove or withdraw it, but we may not be able to retrieve printed copies that have already been circulated.

7. YOUR RIGHTS UNDER UK GDPR

Under UK GDPR, you have the following rights in relation to the personal data we hold about you. To exercise any of these rights, please contact us using the details in Section 1. We will respond within one month of receiving your request, unless it is manifestly unfounded or excessive – in which case we may charge a reasonable fee or, in exceptional circumstances, decline to respond. We will always explain why if this is the case.

Right to be Informed

You have the right to be informed about how we collect and use your personal data. This Privacy Policy fulfils that obligation. If we make significant changes to how we use your data, we will notify you.

Right of Access

You have the right to request a copy of the personal data we hold about you (a Subject Access Request). Please contact us with sufficient information for us to identify you and locate your records.

Right to Rectification

You have the right to ask us to correct any inaccurate personal data we hold about you, or to complete incomplete data. We will act on your request without unreasonable delay.

Right to Erasure

You have the right to request that we delete your personal data where there is no compelling reason for us to continue holding it. Please note that we may be required to retain certain data to comply with a legal obligation – for example, share and financial records must be retained for the minimum period set out in Section 6 above. We will explain clearly if this applies to you.

Right to Restrict Processing

You have the right to ask us to restrict the processing of your personal data in certain circumstances – for example, if you contest the accuracy of the data we hold, or if you have objected to our processing it and a decision is pending.

Right to Data Portability

Where we process your personal data by automated means on the basis of your consent or a contract, you have the right to receive that data in a structured, commonly used, and machine-readable format, and to request that we transmit it directly to another organisation where technically feasible.

Right to Object

You have the right to object at any time to our processing of your personal data where we rely on legitimate interests as our legal basis (see Section 4). We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or unless we need to process the data for the establishment, exercise, or defence of legal claims. Where we process your data for direct marketing purposes, you have an absolute right to object.

Right to Withdraw Consent

Where we rely on your consent as our legal basis for processing (for example, for the Friends mailing list, surveys, analytics cookies, or photographs taken at our events), you have the right to withdraw your consent at any time. Withdrawing consent does not affect the lawfulness of any processing we carried out before withdrawal.

To request the removal of a photograph in which you appear – or in which a child for whom you hold parental responsibility appears – please contact us at admin@tresoc.co.uk or by any of the other means listed in Section 1.

Right to Unsubscribe

Every email we send to the Members mailing list and the Friends mailing list contains a link that enables you to unsubscribe or update your details at any time.

Rights in Relation to Automated Decision-Making

We do not make any decisions about you solely by automated means that produce legal or similarly significant effects on you.

8. COOKIES AND THIRD-PARTY SERVICES

Our website uses cookies – small text files placed on your device when you visit – to provide functionality and, where you consent, to help us understand how the site is used. We use the following categories of cookie:

Strictly Necessary Cookies (always active)

These cookies are essential for the website to function correctly – for example, remembering your cookie preferences. They cannot be switched off and do not require your consent.

Analytics Cookies (consent required)

We use services including Google Analytics to understand how visitors use our website. The data collected is used in anonymised form to improve our site and communications. These cookies are only set if you give your consent.

Social Media & Functionality Cookies (consent required)

Our website includes content from third-party platforms including YouTube and Vimeo. These services may set their own cookies and track your activity across other websites. These cookies are only activated if you consent to this category.

9. SECURITY OF YOUR PERSONAL INFORMATION

We implement appropriate technical and organisational security measures to protect your personal data from unauthorised or unlawful access, accidental loss, destruction, or damage.

In the event that we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of the breach. Where the breach is likely to result in a high risk to you, we will also notify you directly without undue delay.

While we take all reasonable steps to protect your data, no method of electronic transmission or storage is completely secure. If you have reason to believe that your interaction with us is no longer secure, please contact us immediately.

10. COMPLAINTS

If you are unhappy with how we have handled your personal data, we encourage you to contact us in the first instance so that we can try to resolve the matter promptly. Please use the contact details in Section 1.

You also have the right at any time to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s independent supervisory authority for data protection:

Information Commissioner’s Office (ICO)

Website: ico.org.uk

Helpline: 0303 123 1113 (Monday–Friday, 9am–4pm)

Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

11. CHANGES TO THIS PRIVACY POLICY

We reserve the right to amend this Privacy Policy at any time. Any changes will be posted on this page of our website. The version number and date at the top of this Policy indicate when it was last updated. Where changes are material, we will notify members and Friends list subscribers by email.

We review this Policy at least annually to ensure it remains accurate and up to date.

12. QUESTIONS AND CONTACT

We review this Policy at least annually to ensure it remains accurate and up to date.

Data Protection Lead – Totnes Renewable Energy Society

Email: admin@tresoc.co.uk

Post: 107 High Street, Totnes, Devon, TQ9 5SN

Tel: 01803 867431