Privacy Policy

Last updated: April 2026 Data controller: Carnegie Herne Hill Community Trust CIO Trading name: Carnegie Library Hub Registered office/service location: 192 Herne Hill Rd, London SE24 0DG Contact: trustees@carnegielibraryhub.org.uk

Who we are

Carnegie Herne Hill Community Trust CIO (Carnegie Library Hub) is the data controller for personal data described in this notice.

What this notice covers

This notice explains how we collect, use, and protect personal data when you:

  • make an enquiry
  • make or manage a room booking
  • attend activities or events
  • make payments or donations
  • contact us by email or through our website

Personal data we collect

Depending on your interaction with us, we may collect:

  • contact details (name, email address, phone number)
  • booking and enquiry information
  • invoicing and payment-related details
  • donor details needed for financial records
  • event participation and communication records
  • correspondence and support history
  • incident or safeguarding-related information where relevant

We do not intentionally collect more data than we need.

Why we use your data and lawful bases

We use personal data for the following purposes:

  • enquiries, bookings, and service delivery: contract and legitimate interests
  • invoicing and financial records: contract and legal obligation
  • safeguarding, incident, and security management: vital interests, legal obligation (where applicable), and legitimate interests
  • governance and operational administration: legitimate interests and legal obligation

We do not generally rely on consent for core operational processing.

Where consent is used for optional activities (for example optional marketing or optional photography/case studies), you may withdraw consent at any time by contacting trustees@carnegielibraryhub.org.uk.

Who we share data with

We only share data where there is a lawful basis and a clear purpose.

Our key processors/systems include:

  • Microsoft 365 and SharePoint (document management and communication)
  • QuickBooks Online (invoicing and associated donor/client financial records)
  • Canva (digital imagery and design assets used for hub work)

These are controlled work environments and are not publicly accessible.

International transfers

We do not transfer personal data overseas.

Our core operational data is retained within the Carnegie Library Hub Microsoft 365 tenant, which is UK-hosted.

Data retention

We retain personal data only for as long as necessary for legal, operational, safeguarding, financial, and governance purposes, then securely delete or anonymize it.

Security

We use proportionate technical and organizational security controls, including:

  • role-based access controls
  • secure cloud storage
  • version/audit history in SharePoint
  • secure disposal practices

Your data protection rights

You have rights under UK GDPR, including:

  • right to be informed
  • right of access
  • right to rectification
  • right to erasure (in limited circumstances)
  • right to restriction of processing
  • right to data portability (where applicable)
  • right to object
  • rights related to automated decision-making and profiling

To exercise your rights, email trustees@carnegielibraryhub.org.uk.

Data breaches

If you think your data has been compromised, contact trustees@carnegielibraryhub.org.uk immediately.

Complaints

If you are not satisfied with how we handle your data, you can contact us first at trustees@carnegielibraryhub.org.uk.

You can also complain to the Information Commissioner’s Office (ICO):