Data protection policy

It’s for all employees and volunteers. It also applies to third parties processing personal data on our behalf.

This policy covers the protection of all information and data throughout its creation, use and destruction and in all forms, such as paper, electronic or other media.

In the vast majority of cases, we use the following combination of ‘legal bases’ for processing:

• Marketing emails or when processing sensitive staff information – legal basis: consent
• Direct mail to supporters – legal basis: legitimate interest
• Dealing with job applicants, employees, volunteers and trustees – legal basis: contract, legal obligations and legitimate interest
• Working with  service users in commissioned services – public task and legitimate interest

If we receive subject access requests from people whose data we hold, we must respond promptly and in line with the law.

According to the law, there are six data protection principles that you must follow when handling of personal data. These principles require that personal data must:

• be used fairly, lawfully and transparently
• be used for specified, explicit purposes
• be used in a way that is adequate, relevant and limited to only what is necessary
• be accurate and, where necessary, kept up to date
• be kept for no longer than is necessary
• be handled in a way that ensures appropriate security, including protection against unlawful or unauthorised processing, access, loss, destruction or damage.

In addition you must:

• ensure the confidentiality, integrity and availability of personal information
• undertake and pass mandatory training
• follow our approved policies and procedures around sharing information, secure destruction, data breaches, subject access requests and CCTV
• promptly and courteously respond to queries about data
• ensure that data is not sent outside of the European Economic area without special arrangements being in place