Privacy Policy

1. Who I am

Horizon Community Funding is a sole trader business operated by Liam McFarlane, based in England, United Kingdom. Horizon Community Funding provides grant writing, bid strengthening, grant research, and funding monitoring services to town and parish councils, VCSE organisations, charities, and community groups.

For the purposes of UK data protection law, Horizon Community Funding is the data controller for the personal data described in this policy. That means I am responsible for deciding how and why your data is used.

2. What personal data I collect

I only collect data you actively give me, or that is generated as a normal part of you visiting a website. I do not buy contact lists, and I do not use tracking tools that build profiles of visitors.

I do not intentionally collect special category data (such as health, religion, or ethnicity). Occasionally, evidence of need supplied for a grant application may include such information about your beneficiaries. Where that happens, I will only use it for the specific application, will ask you to anonymise or aggregate it wherever possible, and will delete it once the application process is complete.

3. Why I collect it, and my lawful basis

UK GDPR requires me to have a valid lawful basis for each use of your data. The bases I rely on are set out below.

Where I rely on legitimate interests, I have considered whether the use is fair to you and whether you would reasonably expect it. You can object to any processing based on legitimate interests — see Your rights.

4. Third parties and service providers

I use a small number of established providers to run this business. They act as processors on my behalf, or as independent controllers for their own platform. I do not sell your personal data, and I do not share it with anyone for their own marketing purposes.

I will also disclose personal data where I am legally required to — for example to HM Revenue & Customs, a regulator, or a court. Where you engage me to submit an application, the information in that application is shared with the relevant funding body, and their own privacy notice will apply to it.

5. International data transfers

Some of the providers above are based outside the United Kingdom, or use infrastructure outside it. Where personal data is transferred overseas, that transfer is covered by one of the safeguards recognised under UK data protection law — usually UK adequacy regulations or the International Data Transfer Addendum to the standard contractual clauses. You can ask me for details of the safeguard applying to a specific provider.

6. How long I keep your data

I do not keep personal data longer than I need it. My standard periods are set out below.

7. How your data is kept secure

I take proportionate measures to protect the information you give me:

• This website is served over HTTPS, so data in transit is encrypted.
• Devices used for client work are password protected and encrypted, with automatic screen locking.
• Accounts holding personal data use strong, unique passwords and two-factor authentication where the provider supports it.
• Access is limited to me. I do not currently have employees or subcontractors with access to client data. If that changes, anyone with access will be bound by written confidentiality and data protection terms.
• Client documents are stored in reputable cloud services rather than emailed around unnecessarily.

No system can be guaranteed completely secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, I will report it to the Information Commissioner's Office within 72 hours and tell you without undue delay where the risk to you is high.

8. Cookies and similar technologies

This site is deliberately light on tracking. There is no Google Analytics, no advertising pixel, and no cross-site tracking of any kind.

• Strictly necessary only. The MailerLite sign-up form may set cookies needed to make the form work and to prevent duplicate or spam submissions. These are required for the feature you are choosing to use.
• No analytics or advertising cookies are set by this site.
• Google Fonts does not set cookies for font requests, but Google does receive your IP address when the fonts are downloaded.
• Calendly sets its own cookies once you click through to book a call. That happens on Calendly's site, under their policy.

You can block or delete cookies in your browser settings. Blocking them may stop the checklist sign-up form from working. If I later add analytics or any non-essential cookies, I will add a consent banner and update this policy before doing so.

9. Your rights

Under UK GDPR you have the following rights over your personal data. They are free to exercise, and I will respond within one month.

• Access — ask for a copy of the personal data I hold about you.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure — ask me to delete your data, where I have no overriding legal reason to keep it.
• Restriction — ask me to pause using your data while a concern is resolved.
• Objection — object to processing based on legitimate interests, and object to direct marketing at any time. For direct marketing, I must stop immediately.
• Portability — receive data you gave me in a common, machine-readable format.
• Withdraw consent — where I rely on consent, withdraw it at any time. This does not affect anything done before you withdrew it.
• Human review — I do not use automated decision-making or profiling to make decisions about you.

To exercise any of these, email hello@horizoncommunityfunding.co.uk. I may ask you to confirm your identity before releasing data, to make sure I am not disclosing it to the wrong person.

10. Marketing emails

If you download the free checklist, you are consenting to receive it along with occasional emails containing funding tips, deadline reminders, and news about my services. I send these because they are useful, not to fill your inbox.

• Every email contains a one-click unsubscribe link.
• Unsubscribing is immediate and permanent, and requires no explanation.
• I will not pass your email address to anyone else for their marketing.
• Existing clients may receive service emails about work in progress. These are not marketing and are necessary to deliver what you have engaged me for.

11. Children's data

My services are aimed at organisations, not individuals under 18, and I do not knowingly collect data from children through this website. Community projects sometimes involve young beneficiaries. Where you supply information about them as evidence of need, I ask that it is anonymised or aggregated, and I will not request identifying details about individual children.

12. Complaints

If you are unhappy with how I have handled your personal data, please tell me first at hello@horizoncommunityfunding.co.uk. I would rather put something right than have you go elsewhere frustrated.

You also have the right to complain directly to the UK's data protection regulator at any time, and you do not need to contact me first:

13. Changes to this policy

I will update this policy when my services, providers, or legal obligations change. The version number and date at the top of the page always show the current version. If a change materially affects how your data is used, I will tell subscribers by email rather than relying on you noticing it here.