This policy explains how and why The Connection at St Martin-in-the-Fields uses your personal information when you donate to us or take part in an event organised by us.

When we refer to “we” or “us” in this policy we are referring to The Connection at St Martin-in-the-Fields. We are listed on the Information Commissioner’s register of data controllers under Registration Number Z7919091.

1. Using your personal information

We only ever use your personal data if we are satisfied that it is lawful and fair to do so. When we process your personal information, it will be because:

• you have consented to the processing for the specific purposes described in this notice;
• it is necessary to enter into, or perform, a contract with you;
• we need to use it in order to comply with a legal obligation; or
• it is necessary in pursuit of a “legitimate interest”. A legitimate interest in this context means a valid interest we have or a third party has in using your personal data which is not overridden by your interests in data privacy and security.

We will only collect and use any special categories of personal information (information about your race, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation) if we have your explicit consent.

2. Information we collect and process

2.1 Donations
When you make a one-off donation to us (for example, via a form on our website), we will collect and record your name, address, email address, phone number and payment details in order to process the donation. We use a third party, Blackbaud, to process online donations. Blackbaud is a data processor for us and only processes personal information in line with our instructions.

If you donate to us via SMS text message we will collect and record your name and mobile phone number. We use a third party, RSM2000, to process SMS text donations. RSM2000 is a data processor for us and only processes personal information in line with our instructions.

If you make a one-off donation to us by post, we will record the personal information you provide to us in order to process your donation, to acknowledge receipt of the donation and to comply with our record keeping obligations.

If you set up a direct debit to donate to us regularly we will collect and record your name, address, email address, phone number and bank account details.

2.2 Friends of The Connection
Our sister charity, The Friends of The Connection (charity no. 1040560), exists to raise funds for us. The Friends is primarily a membership organisation and undertakes community fundraising. If you are a Friend, you should refer to The Friends Privacy Policy for details of how they use your personal information.

2.3 Legacies
If you indicate that you intend to leave a legacy to us, we will keep a record of your personal information (for example your name, address and contact details), as well as information about any other person or organisation that you provide to us (for example, a family member or a lawyer). This is so that we are able to communicate with you appropriately about your support.

2.4 Fundraising events
We run a number of fundraising events throughout the year, including challenge events like our Pilgrimage walk to Canterbury, art exhibitions, challenge events and musical concerts. If you sign up to take part in an event, we will ask you to provide us with personal information such as your name, address and contact details, to allow us to process your application. Depending on the event, we may also collect payment details from you and we may need to ask you to provide information about any health conditions or dietary requirements you have. Sometimes, we will ask you to give us your clothes size so that we can provide you with branded T-shirts and vests.

We sometimes partner with other organisations to run events, for example, our sister charities The Friends of The Connection and St Martin-in-the Fields Charity (charity no. 1156305) and we take part in events organised by other entities, such as the Radio 4 Christmas Appeal with St Martin-in-the-Fields. We may share your personal information with these other organisations, or with third parties who organise challenge events, where you have given us consent to do so or where we have a legitimate interest but we will always let you know in advance.

2.5 Fundraising appeals

We sometimes partner with our sister charities The Friends of The Connection (charity no. 1040560), St Martin-in-the-Fields Trust (charity no. 1110406), and St Martin-in-the Fields Charity (charity no. 1156305) in order to deliver joint fundraising appeals.

We may share your basic personal information with these other organisations, where you have given us consent to do so or where there is a legitimate interest. We will only ever share the minimum amount of data required in relation to each appeal, and this data will only ever be used directly in relation to joint appeals in which The Connection at St Martin’s is a participant. Any data shared will be stored for the shortest length of time necessary to complete the appeal, and to meet appropriate auditing and Charity Commission regulations.

2.6 Corporate support and corporate volunteers
We benefit from financial and in-kind support from companies and other commercial organisations. We keep a record of the names and contact details of key contacts at these organisations and we retain a record of relevant correspondence between us. If you work for one of our corporate supporters and you volunteer your time with us, we will collect some personal information from you (for example, your name, telephone number, email address and next of kind details) so that we can communicate with you about volunteering opportunities and make arrangements for you to volunteer with us.

2.7 Marketing
We would like to keep in touch with you about the work that we do, events that we organise, and ways in which you can support us (for example, by volunteering your time, by giving a financial donation, or by giving us donations-in-kind).
We will only send you marketing communications by email with your consent. You can opt out of email marketing by clicking the ‘unsubscribe’ link in any of our emails or you can contact us (see the ‘Contact Us’ section below) at any time to opt out, change your contact details or to update your communication preferences.

We may also send marketing information to you by post if we are satisfied that we have a legitimate interest to do so; for example, if you have donated to one of our appeals we may contact you to report on how we used the funds and to ask if you wish to support us again. You can contact us (see the ‘Contact Us’ section below) at any time to tell us that you no longer wish to receive marketing by post or to update your contact details and preferences.

From time to time, we may make marketing telephone calls to you. We do not regularly carry out telephone marketing and we never use automated calling systems. We will only contact you in this way if we are satisfied that we have a legitimate interest to do so and we will always check the telephone preference service and our own marketing preference records before we make any telephone marketing calls to you. You can contact us (see the ‘Contact Us’ section below) at any time to tell us that you no longer wish to be contacted by telephone for marketing purposes.

2.8 Case studies and photographs
We will always ask for your consent to use your personal information such as your name, your story and/or your photograph, to help us promote our organisation, our events and our activities for example by including a case study about you in our newsletters or on our website.

If you use social media to publicly share information about fundraising activities you have done for us, we may share this information on our own social media platforms (Facebook and Twitter).

2.9 Research
We use the personal information that you provide, sometimes together with data obtained elsewhere, to manage our fundraising efficiently and effectively so we can raise more to make a difference to the lives of homeless people in London. We use the information we collect about you to effectively target and tailor our communications, for example, so we can make appropriate requests to donors who may be able to support us at a higher level.

We also use publicly available information such as Companies House, Charity Commission and other charity registers, Who’s Who and Debrett’s guides, Electoral Roll, reputable newspaper articles, publications, company websites and biographies on professional networking sites, as well as geographic and demographic information based on your postcode, to find new potential supporters and invite them to be involved in supporting our cause through tailored communications which may be of interest to them or to gain a better understanding of our supporters.

If you would prefer us not to use your data in this way please contact the Fundraising Team on fundraising@cstm.org.uk or 020 7766 5555.

2.10 Queries and complaints
If you contact us by post, email or telephone using the contact details on our website, we will use the personal information you provide to us (for example, your name and the name(s) of any other individuals involved) in order to process your query or complaint, respond to you and take any follow up action.

3. Sharing personal information
We will never sell your personal data or share it with third parties who might use it for their own commercial purposes.

We routinely share your personal information with our sister charity The Friends of The Connection in order to avoid duplicating the contact our organisations have with you.

We will only disclose your personal information to other third parties:

• where you have given us consent to share the information with the specific third party;
• if we are under a legal duty to disclose or share your personal information, for example, if required to do so by a court order or for the purposes of prevention of fraud or other crime;
• in order to enforce any terms and conditions or agreements between us;
• where we have a legitimate interest to do so, such as
  • protecting our rights, property and safety, or the rights, property and safety of others (this includes exchanging information with other companies, organisations and regulators for the purposes of fraud protection and credit risk reduction).
  • Receiving IT support from external contractors
  • as part of a sale of some or all of our business and assets to any third party or as part of any business restructuring or reorganisation (we will always notify you in advance and we will ensure that your privacy rights will continue to be protected)

In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you. For example, we may share anonymised results of research that we carry out into the use of our services with third parties such as funders.

4. Transferring personal information outside the EEA
Your information is transferred to the USA where the servers of our database are located. The protection of your personal data is secured by the Privacy Shield. For more information please see https://www.blackbaud.co.uk/company/privacy-shield-notice

5. Data retention
We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements, and in accordance with our data retention policy.

Our default retention periods may be extended or reduced if we deem it necessary, for example, to defend legal proceedings or if there is an on-going investigation relating to the information.

We review the personal data (and the categories of personal data) we hold on a regular basis to ensure the data we are holding is still required and is accurate. If we discover that certain data we are holding is no longer necessary or accurate, we will take steps to correct or delete the data.

Please contact us if you would like more information on how long we keep your personal information.

6. Your rights
Under certain circumstances, by law you have the right to:

• Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Ask us to correct personal information that we hold about you which is incorrect, incomplete or inaccurate.
• Ask us to erase your personal information from our files and systems where there is no good reason for us continuing to hold it.
• Object to us using your personal information to further our legitimate interests (or those of a third party), e.g. for direct marketing purposes.
• Ask us to restrict or suspend the use of your personal information, for example, if you want us to establish its accuracy or our reasons for using it.
• Ask us to transfer your personal information to another person or organisation.

If you want to access, correct or request restriction or erasure of your personal information, or to object to us using your personal data, or request that we transfer a copy of your personal information to another party, please contact fundraising@cstm.org.uk in writing.

If you have given your consent to us processing your personal information, you have the right to withdraw your consent at any time. To withdraw your consent, please contact fundraising@cstm.org.uk. Once we have received notification that you have withdrawn your consent, we will no longer process your personal information and, subject to our retention policy, we will dispose of your data securely.

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.

7. Contact us
If you have any questions about this privacy notice or how we handle your personal information, please contact us by email at appeals@cstm.org.uk or by telephoning 02077665555.

Last updated 06.11.2019

This explains how and why The Connection at St Martin-in-the-Fields will collect and use your personal data from our initial assessment.

If you have any questions about this privacy notice or how we handle your personal data, please contact a member of staff or send us an e-mail to info@cstm.org.uk.

Personal data means any information about you from which you can be identified. This might include your name, your date of birth and information about your situation. Personal data does not include data where you can’t be identified (i.e. anonymous data).

1. Where is the information coming from?

• We will make a record of what you tell us about yourself to help us give you the right advice and to create a safe environment for everyone. You don’t have to tell us about things you are not comfortable with but it may mean that we give you incorrect or unhelpful advice
• If you have been in touch with other homeless charities in Westminster, such as The Passage, Seymour Place or outreach (SOS) we will be able to see if you are still actively working with them, who your keyworker is, if you are currently excluded, where you’ve been seen sleeping rough and if you are eligible for some extra support. This is to help us understand what further support may be available to you and to make sure we are not duplicating work someone else is already doing with you. You can object to this search but it may mean we will not be able to offer you a service as we will not be able to confirm that you meet our eligibility criteria
• We may already hold some information about you, for example when someone was worried about you and they contacted us. If that’s the case, we’ll let you know
• We also have CCTV cameras, for safety and security of people in our building and our property

2. How do we use the information we collect at the initial assessment?
Most importantly, we use it to decide whether we have the right resources to help you and to provide you with confidential advice. If we think another organisation would be more suitable for your situation, we will help you to contact them instead, if you wish us to.

We also use the data we collect from you at the initial assessment for the following purposes:

• To keep you and other people in the building safe
• To keep track of our work and ensure the quality of our advice
• To research homelessness in London so that we can provide better services. If we share such reports externally we will make sure you can’t be identified (i.e. statistical information)
• To enable us to defend any legal claims arising from our work

For more information about the lawful basis for our use of your information please see the table in the bottom of this section.

3. When do we share your personal information?
We only ever share your personal data with outside organisations if we believe it is necessary and fair to do so.

Normally, we will not share your information unless you give us permission (consent). We will be specific as to what information is being shared, with whom and for what purpose so you can make an informed decision. This will usually be to help you get linked in with another organisation.

You can withdraw your consent at any time. To do this, please speak to a staff member, call us on 02077665544 or contact info@cstm.org.uk. Once we have received notification that you have withdrawn your consent we will no longer share your information. Please bear in mind that this does not mean we will delete the information from our system.

In some situations, we may share information about you outside of The Connection without your consent. These situations are quite rare:

• If we are very worried about your safety or safety of others and it’s in public interest
• If we are under a legal obligation (e.g. a court orders us to do so)
• It is necessary in connection with a legal claim, e.g. as part of an investigation
• It is necessary to protect your vital interests or the vital interests of another person and you are incapable of giving consent

We may also share your personal data with:

• The Passage, Seymour Place and outreach teams (SOS, Compass) to check if they are also working with you; it is in our legitimate interest to do so to ensure we are giving you the right advice and are not duplicating work
• The provider of In-Form, our database system (Homeless Link) and our third-party IT contractor, may sometimes access your information in order to provide us with technical support and cannot use this information for anything else

4. How long we keep your information?
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal or reporting requirements. Currently, this period is 7 years from the last time we had contact with you. We may extend or reduce our retention periods if we deem it necessary, for example, to defend legal proceedings or if there is an on-going investigation relating to the data.

5. What are your rights in relation to this information?

Under certain circumstances, by law you have the right to:

• Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it
• Ask us to correct personal data that we hold about you which is incorrect, incomplete or inaccurate
• Ask us to erase your personal data from our files and systems where there is no good reason for us continuing to hold it. This will normally apply when we no longer need to keep your information which is after 7 years from our last contact with you, or when you have successfully objected to us using your information
• Object to us using your personal data – this right also applies in very limited circumstances, for example when us using your data would cause you harm
• Ask us to restrict or suspend the use of your personal data, for example, if you want us to establish its accuracy
• Ask us to transfer your personal data to another person or organisation

If you want to access, correct or request restriction or erasure of your personal data, or to object to us using your personal data, request that we transfer a copy of your personal data to another party or to make a complaint about how we use your information, please contact info@cstm.org.uk or call us on 02077665544.

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues. You can do that online or by calling them on 0303 123 1113.

Lawful basis for The Connection collecting, accessing and internal use of information about you. For lawful basis of sharing your information, see point 3 of this notice.

Personal data (for example your name, contact details, record of attendance, outcome of our meetings, advice we have given you, CCTV footage)

Purpose: To provide you with confidential advice, including working out if we are the right place to support you

Lawful basis: Our legitimate interest

Purpose: To keep you, other clients and our staff safe

Lawful basis: Our legitimate interest, Our legal obligation

Purpose: To keep track of our work and ensure the quality of our advice

Lawful basis: Our legitimate interest

Purpose: To research homelessness in London so that we can provide better services

Lawful basis: Our legitimate interest

Purpose: To enable us defend any legal claims arising from our work

Lawful basis: Our legitimate interest

Special category data (information about your race, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation, criminal convictions, offences and legal claims against you, or any related security measures)

Purpose: To provide with confidential advice, including working out if we are the right place to support you

Lawful basis: It is in substantial public interest

Purpose: To keep track of our work and ensure the quality of our advice

Lawful basis: It is in substantial public interest (Safeguarding, equality of treatment)

Purpose: To keep you and others safe

Lawful basis: It is in substantial public interest (Safeguarding, prevention and detection of crime)

Purpose: To research homelessness in London so that we can provide better services.

Lawful basis: It is in substantial public interest (equality of treatment), Research and statistical purposes in public interest

Purpose: To enable us defend any legal claims arising from our work

Lawful basis: Establishment, exercise or defence of legal claims

Last updated 06.11.2019

This explains how and why The Connection at St Martin-in-the-Fields will collect and use your personal data as someone who uses our services.

When we refer to “we” or “us” in this policy we are referring to The Connection at St Martin-in-the-Fields. We are listed on the Data Commissioner’s register of data controllers under Registration Number Z7919091.

If you have any questions about this privacy notice or how we handle your personal data, please contact member of staff or send us an e-mail to info@cstm.org.uk.

Personal data means any data from which you can be identified. This might include your name, your home address, your personal email contact details, your telephone number or our notes from meetings with you.

We use the term special categories of personal data to mean data about your race, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation, or criminal convictions, offences and legal claims against you, or any related security measures. onvictions, offences and legal claims against you, or any related security measures.

1. Why do we collect personal information about you?
The main reason why we want to collect personal information from you is so that we can work out what your situation is and provide suitable advice and support. If we do not understand your situation well, it is likely that we will provide advice and support that is not suitable for you.

We also collect your personal data for other reasons, which include:

• To keep you, ourselves and others safe
• To keep track of the work we do
• To research homelessness in London so that we can provide better services
• To manage the safety of our property (for example, through CCTV)
• To keep important documents (e.g. your passport) safe on your behalf
• To provide you with useful data about activities we are running (e.g. workshops)
• To enter into contractual relationships with you (e.g. tenancy agreements)
• To balance our financial records (e.g. when handling grants on your behalf)
• To publicise our work to the general public and potential donors (with your consent)

You do not have to give us your personal data, but the information will help us to advise you better, create a safe environment for all and demonstrate the impact we are having. If you do not provide us with important information, we may give you incorrect advice and be unable to allow you access to our building or to certain services.

2. Where do we get the personal data from?
Generally, we will get personal data directly from you. This could happen in different ways, for example:

• Informal conversations with you in the building or on the streets
• Informal conversations with you in the building, for example, in the Day Centre
• Appointments, such as casework or careers coaching sessions
• Registers, rotas or other records of your participation in our activities or use of our services
• Tenancy agreements at St. Martin’s House or other accommodation we offer

Sometimes personal data about you will not come directly from you. This could be because someone contacts us to share information about you, or it could be because we contact someone to ask them for information about you. Examples of such situations might include:

• Another homeless agency contacts us to share concerns about your safety
• A family member of yours gets in touch with us because they are worried about your wellbeing
• A recruitment agency with whom we collaborate shares information about how you are doing in a job they helped to find for you
• A fellow service user passes on concerns about your behaviour
• A homeless organisation in Westminster refers you into our Emergency Accommodation
• A police officer tells us that they want to speak to you in connection with an incident
• You believe you have a court date pending and you ask us to find out for us when it is

Whenever we use personal data that comes via third parties, we ensure that is consistent with the purposes set out above and is handled in strict accordance with our policies.

3. What kind of information about you are we interested in?
When we do casework with you, the exact data that we collect and use will depend on your individual circumstances and what we can offer you. Because the services that we offer are so varied, we might need to collect and use any of the following:

• Contact details (your name, telephone number, email address, next of kin)
• Basic data (e.g. date of birth, gender, nationality, immigration status)
• ID (such as a copy of your birth certificate, driving licence or passport)
• Housing history
• Employment history
• Participation in activities or use of services
• Outcomes or achievements, for example, getting an interview or being booked into a hostel
• CCTV footage

It is also likely that we will want to collect and use the following special categories of your personal data:

• Data about your race or ethnicity, political opinions, religious or philosophical beliefs, sexuality or sex life
• Data about your health, including any medical condition
• Data about criminal convictions, offences and legal claims against you, or any related security measures

Under exceptional circumstances, for example, if it directly affects a legal claim relating to your immigration status, we may also collect and use personal data relating to your children.

4. When do we share your personal information with third parties?
We only ever share your personal data with third parties if it is necessary and fair to do so. We may share your personal data (including special categories of personal data) with:

• The Passage, West London Mission and the outreach team (SOS) to check if they are also working with you, so we don’t duplicate our work
• The provider of our database system (Homeless Link) and our third-party IT contractor, Silverbug, in order to receive technical support
• External interpreting services, so that we can communicate with you in a language you understand
• Organisations that share our building including Homeless Heath Service and Department of Work and Pensions
• If we give you advice about your immigration situation, our notes may be accessed by our Immigration Advice regulator (OISC) when they check the quality of our advice, or our current legal partner who supervise the work of our immigration advisers
• Other quality auditors, such as Advice Quality Standard or Matrix

We also share information about you with external third parties for the purposes of helping you to submit forms, obtain documents, attend workshops, obtain doctor’s appointments etc. Normally, we will not share your information unless you give us permission (consent). We will be specific as to what information is being shared, with whom and for what purpose so you can make an informed decision. This will usually be to help you get linked in with another organisation. You can withdraw your consent at any time and we will no longer share it.

The third parties may include:

• Employment training providers
• Employers with work placement schemes
• Providers of professional clothing and interview advice
• Providers of life skills training and advice
• Recruitment agencies
• Major employers
• Shelters and assessment centres
• Temporary hostels
• Providers of supported housing
• Housing advisers
• Estate agencies
• Property managing services
• Providers of social work and support services
• Education and training providers
• Homelessness outreach services
• Specialist immigration services and immigration advisors
• Hospital discharge services
• Consulates and embassies
• Statutory social services
• Statutory healthcare providers

In some situations, we may share information about you outside of The Connection without your consent.

Most often, we share your basic details with The Passage, Seymour Place and outreach teams (SOS, Compass) to check if they are also working with you.

Other situations where we may share information without your consent are where:

• We have serious concerns about your safety and wellbeing, or the safety and wellbeing of others
• To protect our staff and property
• We are required to do so by law, e.g. a court orders us to do so
• It’s necessary in connection with a legal claim
• We have a legitimate interest to do so, for example as part of a quality audit, or to receive support with our IT

The most common ways in which we share special categories of personal data are where:

• you have given us your consent
• we have a substantial public interest, e.g.to prevent/detect a serious crime, or because of serious worries about you or someone else in relation to you
• it is necessary in connection with a legal claim
• it is necessary to protect your vital interests or the vital interests of another person and you are incapable of giving consent.

In future, we may also need to share personal data with other legal entities, on a temporary or permanent basis, for the purposes of a collaboration, reorganisation, change of legal form, dissolution or similar event.

In some circumstances we may anonymise your personal data so that it can no longer be associated with you, in which case we may use and share such data without further notice to you.

5. Our lawful basis for using your information
We will only use your personal data when we are satisfied that it is fair and we can do so legally. Our legal bases for processing personal data may sometimes overlap and there may be several grounds which justify our use of your personal data.

When we use your personal data in the public interest or when we have a legitimate interest and we are satisfied that your interests and fundamental rights do not override that interest, we will use your personal data in the following ways:

• To assess your situation and to provide you with confidential advice
• To make applications, submit forms, obtain documents, buy tickets etc. on your behalf
• To alert others that we are seriously concerned about you or about other people in relation to you
• To monitor and evaluate our services so that we can constantly improve them
• To share safety concerns with external parties (e.g. the police, the NHS, social services) in order to protect our staff, clients, volunteers and/or third parties
• To carry out any special research projects using data about clients or ex-clients

When it is necessary to perform a contract we have entered into with you, it will typically be for a tenancy agreement for a property that we own e.g. St. Martin’s House.

We will ask for your consent to:

• Keep copies of documents on your behalf (for example, correspondence, birth certificate, medical records)
• Pass your personal data to third parties in circumstances not otherwise covered in this privacy notice
• Use your personal data for publicity or promotional purposes (for example, materials promoting the work that we do)

Less commonly, we may use your personal data where we need to protect your vital interests (or someone else’s vital interests) or where it is necessary in order to comply with a legal obligation (for example when we are required to do so by a court).

6. How we use your special categories of personal data legally
By law, we need to have an additional legal basis if we wish to process special categories of personal data. This means that we will only process such data in one of the following circumstances:

• Where there is a substantial public interest (for example: when we provide confidential advice or support to you; to monitor equality of treatment; to safeguard adults and children at risk, or where we need to share data for the purposes of detecting and preventing unlawful acts)

Less commonly, we may process this type of personal data where it is needed in relation to legal claims or where it is needed to protect your vital interests (or someone else’s vital interests) and you are not capable of giving your consent.

7. How long do we hold onto your information?
Your personal details, as well as the record of your attendance and any support you have received from us will be held securely on our case management system (In-Form) for 7 years from the last time we had contact with you. This is to enable us to be able to effectively monitor our work, comply with audits, produce statistics about homelessness, as well as to defend any legal claims.

If we hold information about you based on your consent, the time we hold on to it is different:

• If you give us documents for safekeeping we will hold on to them for 1 year from last contact with you, unless you tell us to destroy them earlier
• If you use our address as your postal address, any letters you don’t pick up will be returned to sender after 1 month, unless you tell us to destroy them before then

We may extend or reduce our retention periods if we deem it necessary, for example, to defend legal proceedings or if there is an on-going investigation relating to the data.

8. Your rights
Under certain circumstances, by law you have the right to:

• Request access to your personal data (also known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Ask us to correct personal data that we hold about you which is incorrect, incomplete or inaccurate.
• Ask us to erase your personal data from our files and systems where there is no good reason for us continuing to hold it. Please be mindful that we do need to hold on to our full record of our work with you for a period of time so it is unlikely we will delete it unless your circumstances are unique.
• Object to us using your personal data to further our legitimate interests (or those of a third party), or when we do this in public interest. When requesting this, please provide us with as much detail as you can about your reason for the request as we will need to balance your request against our organisational needs. Where we are using your personal information for fundraising or marketing purposes, we will always comply with your request.
• Ask us to restrict or suspend the use of your personal data, for example, if you want us to establish its accuracy or our reasons for using it.
• Ask us to transfer your personal data to another person or organisation.

If you want to access, correct or request restriction or erasure of your personal data, or to object to us using your personal data, or request that we transfer a copy of your personal data to another party, please speak to your key worker. If they are absent, you can speak to any member of staff or contact info@cstm.org.uk in writing.

If we have requested your consent to process your data in a certain way, and you have given it to us, you still have the right to withdraw your consent at any time. To withdraw your consent, please speak to a member of staff or e-mail info@cstm.org.uk. Once we have received notification that you have withdrawn your consent, we will no longer process your personal data and, subject to our retention policy, we will dispose of your data securely.

You have the right to make a complaint at any time to the Data Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.

Last updated 06.11.2019.

Recruitment of Employees Privacy Policy

This policy explains how and why The Connection at St Martin-in-the-Fields uses your personal information during the recruitment process.
This policy applies to all potential employees, who are going through the recruitment process. Please read it carefully to understand our practices regarding your personal information and how we will treat it.

This policy does not form part of any contract of employment or other contract to provide services. We may update this notice from time to time. When we refer to “we” or “us” in this policy we are referring to The Connection at St Martin-in-the-Fields. We are listed on the Information Commissioner’s register of data controllers under Registration Number Z7919091.

For the purposes of the Data Protection Act 1998, the General Data Protection Regulation (GDPR) and any applicable replacement legislation, we are the data controller.

Types of Information

When we use the term personal information we mean any personal data you give us from which you can be identified. This might include your name, your home address, your personal email contact details, or your telephone number. Personal information does not include information where your identity has been removed (i.e. anonymous data).

We use the term special categories of personal information to mean information about your race, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation.

We only ever use your personal data if we are satisfied that it is lawful and fair to do so. When we process your personal information, it will be because:

• You have consented to the processing for the specific purposes described in this notice;
• The processing is necessary to enter into, or perform, a contract with you;
• In order to comply with a legal obligation; or
• The processing is necessary in pursuit of a “legitimate interest”, a legitimate interest in this context means a valid interest we have or a third party has in using your personal data which is not overridden by your interests in data privacy and security.

We will only collect and use any special categories of personal information (information about your race, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation) where we have your explicit consent.

Information we collect about you

The organisation collects a range of information about you. This may include:

Data we collect and whether this is personal or sensitive data: Names, addresses, telephone numbers, email addresses (Personal Data)
What we use it for:
To contact you regarding a job application that you have made to us

Data we collect and whether this is personal or sensitive data: Application form (Personal Data)
What we use it for: To build a picture of your skills, experience and interests in order to assess your suitability for employment.

Data we collect and whether this is personal or sensitive data: References (Personal Data)
What we use it for:To assess your suitability for employment purposes

Data we collect and whether this is personal or sensitive data: Current salary details (Personal Data)
What we use it for: To help us assess your suitability for a paid employment role

Data we collect and whether this is personal or sensitive data: Your right to work in the UK (Personal Data)
What we use it for: To ensure that you are legally entitled to work in the United Kingdom

Data we collect and whether this is personal or sensitive data: Criminal Records Check (Personal Data)
What we use it for: For some roles, the organisation is obliged to seek information about criminal convictions and offences. Where the organisation seeks this information, it does so because it is necessary for it to carry out its obligations and exercise specific rights in relation to employment. This check will only be completed for the following reasons, and will not be completed without your explicit consent:
If the role is a regulated activity within the meaning of the Safeguarding Vulnerable Groups Act 2006. If we are legally required by the Charity Commission to carry out criminal records checks for those carrying out the role.
If the role requires a high degree of trust and integrity and we would like to ask you to seek an Enhanced disclosure of your criminal records history.

Data we collect and whether this is personal or sensitive data: Equal opportunities information (Sensitive Data)
What we use it for: This is for equal opportunities monitoring purposes to ensure meaningful equal opportunity monitoring and reporting where it may be needed in the public interest.

Data we collect and whether this is personal or sensitive data: Information on special requirements, health or medical conditions. (Sensitive Data)
What we use it for: To allow us to make any reasonable adjustments to allow you to effectively carry out the duties of your role, and to ensure we are meeting any health and safety obligations. This is not mandatory and will not affect any offer of employment.

Data we collect and whether this is personal or sensitive data: IP Addresses (Personal Data)
What we use it for: As an extra cyber security measure, we may log the IP address of the computer used to email us an application form as part of our registration process. This type of data does not normally identify an individual in the UK.

We collect the majority of this information directly from you during the application and recruitment process. We also sometimes collect additional information from third parties including former employers and other background check agencies including:
The Disclosure and Barring Service;
Publicly accessible data from the Insolvency Service, Companies House and/or the Charity Commission.

We only ever use your personal information if we are satisfied that it is lawful and fair to do so. We will never sell your personal information or share it with third parties who might use it for their own commercial purposes.

We will only disclose your personal information to third parties:

• Where you have given us consent to share the information with the specific third party;
• When we transfer personal information to Maitland Medical our occupational health provider;
• Or to ONE Westminster, our DBS provider

Data Storage

Data will be stored in a range of different places, including on your application record, manual files and on other IT systems (including email).
If your application is unsuccessful, the organisation will keep your personal data on file for a period of 6 months to 1 year, and then this will be securely destroyed. You are free to withdraw your consent to this data being held at any time.
We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal information without your knowledge or consent where this is required or permitted by law. We will not transfer your personal information outside the European Economic Area (EEA) and all of our third party suppliers store information on servers located within the EEA.
In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use and share such information without further notice to you.

We only keep your personal information in a secure environment. Personal Data will only be used as set out in this Privacy Policy.

• We hold data electronically in our secure document management system and on our on-site file servers, which are protected by both hardware and software firewalls.
• We have off-site back-up servers in secure locations.
• We encrypt all data stored on our servers with an industry standard encryption method that encrypts the data between your computer and our server so that in the event of your network being insecure no data is passed in a format that could easily be deciphered.
• We regularly back up and encrypt all of the data we hold.
• We store papers in lockable cabinets in our offices when not being actively used and we have a secure off-site document storage facility for archived papers.
• Our offices are secure and only personnel holding appropriate security passes can access areas where personal data are stored.
  When necessary, we dispose of or delete your data securely.
• We ensure that our employees, agents and contractors are aware of their privacy and data security obligations and we take reasonable steps to ensure that employees of third parties working on our behalf are aware of their privacy and data security obligations.
• We limit access to your personal information to those employees, agents, contractors and other third parties who have a need to know.

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Details of retention periods for different aspects of your personal information are contained in our retention policy which is available from Caroline Summerfield, Human Resources Manager.

These retention periods may be extended or reduced if required by applicable law or we deem it necessary, for example, to defend legal proceedings or if there is an on-going investigation relating to the information.
We review the personal data (and the categories of personal data) we hold on a regular basis to ensure the data we are holding is still required and is accurate. If we discover that certain data we are holding is no longer necessary or accurate, we will take steps to correct or delete the data.

Under certain circumstances, by law you have the right to:

• Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it;
• Ask us to correct personal information that we hold about you which is incorrect, incomplete or inaccurate;
• Ask us to erase your personal information from our files and systems where there is no good reason for us continuing to hold it;
• Object to us using your personal information to further our legitimate interests (or those of a third party) or where we are using your personal information for direct marketing purposes;
• Ask us to restrict or suspend the use of your personal information, for example, if you want us to establish its accuracy or our reasons for using it;
• Ask us to transfer your personal information to another person or organisation.

You also have rights in relation to automated decision making which has a legal effect or otherwise significantly affects you. You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces significant legal effects concerning you.

If you have any questions about this privacy policy or how we handle your personal information, please contact Caroline Summerfield, Human Resources Manager, 12 Adelaide Street, London, WC2N 4HW, or telephone 020 7925 7891.

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.

Privacy Notice for Volunteering Candidates
This notice explains how and why The Connection at St Martin-in-the-Fields uses your personal information during the recruitment process.

This policy applies to all potential volunteers, who are going through the recruitment process. Please read it carefully to understand our practices regarding your personal information and how we will treat it.

Further Volunteers Privacy Notice will be provided to successful applicants This policy does not form part of any contract of employment or other contract to provide services. We may update this notice from time to time.

When we refer to “we” or “us” in this policy we are referring to The Connection at St Martin-in-the-Fields. We are listed on the Information Commissioner’s register of data controllers under Registration Number Z7919091.

For the purposes of the Data Protection Act 2018, the General Data Protection Regulation (GDPR) 2017 and any applicable replacement legislation, we are the data controller.

What is personal information and our legal basis for using it

When we use the term personal information we mean any information that relates to you from which you can be identified. This might include your name and your contact details as well as our correspondence with you. Personal information does not include information where your identity has been removed (i.e. anonymous data).

We use the term special categories of personal information to mean information about your race, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation.

We only ever use your personal data if we are satisfied that it is lawful and fair to do so. When we process your personal information, it will be because:

• You have consented to the processing for the specific purposes described in this notice;

• In order to comply with a legal obligation; or

• The processing is necessary in pursuit of a “legitimate interest”, a legitimate interest in this context means a valid interest we have or a third party has in using your personal data which is not overridden by your interests in data privacy and security.

We will only collect and use any special categories of personal information where we have your explicit consent.

Why we process information about you
The organisation collects a range of information about you in connection with your application. This may include:

Data we collect: Names, addresses, telephone numbers, email addresses
What we use it for: To contact you to discuss volunteering opportunities, or to keep you updated on our services or activities and events.

Data we collect: Application form (The information you’ve given us about your interests, availability, skills and your reasons for applying
What we use it for: To build a picture of your skills, experience and interests in order to assess your suitability for volunteering opportunities.

Data we collect: Contact details of reference providers
What we use it for: To contact your reference providers in order to confirm your ID and assess your suitability for to volunteer with us.

Data we collect: Criminal convictions
What we use it for: For some roles, we are obliged to seek information about criminal convictions and offences. Where we do it, it is because it is necessary for us to carry out our obligations and exercise specific rights in relation to safeguarding. This check will only be completed in the following circumstances:

• If the role is a regulated activity within the meaning of the Safeguarding Vulnerable Groups Act 2006.

• If we are legally required by the Charity Commission to carry out criminal records checks for those carrying out the role.

• If the volunteering role requires a high degree of trust and integrity and we would like to ask you to seek an enhanced disclosure of your criminal records history.

Data we collect: Information on special requirements, including disabilities, health or medical conditions.
What we use it for: To assess whether we need to make any adjustments to allow you to volunteer with us. This is not mandatory to provide and it will only be processed with your consent.

Data we collect: IP Addresses
What we use it for: As an extra cyber security measure, we log the IP address of the computer used to email us an application form as part of our registration process.

We collect the majority of this information directly from you during the application and recruitment process. For successful applicants we also collect additional information from third parties including former employers and other background check agencies including the Disclosure and Barring Service.

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Confidentiality

We only ever use your personal information if we are satisfied that it is lawful and fair to do so. We will never sell your personal information or share it with third parties who might use it for their own commercial purposes.
We will only disclose your personal information to third parties:
• Where you have given us consent to share the information with the specific third party;
• Where we have a legal obligation to do so, e.g. a court order or an audit

Please bear in mind that your information may be shared internally in the course of our legitimate activities, e.g. to arrange your interview. It may also be accessed by our external IT services provider if necessary to provide us with IT support.

Data Storage

If your application is unsuccessful, the organisation will keep your personal data on file for a minimum period of 1 year and then this will be securely destroyed. Where we hold your data based on consent, you are free to withdraw your consent to this data being held at any time (e.g. the information about your health conditions).

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Details of retention periods for different aspects of your personal information are contained in our retention policy which is available upon request.

These retention periods may be extended or reduced if required by applicable law or we deem it necessary, for example, to defend legal proceedings or if there is an on-going investigation relating to the information. We review the personal data (and the categories of personal data) we hold on a regular basis to ensure the data we are holding is still required and is accurate. If we discover that certain data we are holding is no longer necessary or accurate, we will take steps to correct or delete the data.

We will not transfer your personal information outside the European Economic Area (EEA) and all of our third party suppliers store information on servers located within the EEA.

In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use and share such information without further notice to you.

We only keep your personal information in a secure environment. Personal Data will only be used as set out in this Privacy Policy.

Under certain circumstances, by law you have the right to:

• Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.

• Ask us to correct personal information that we hold about you which is incorrect, incomplete or inaccurate.

• Ask us to erase your personal information from our files and systems where there is no good reason for us continuing to hold it.

• Object to us using your personal information to further our legitimate interests (or those of a third party) or where we are using your personal information for direct marketing purposes.

• Ask us to restrict or suspend the use of your personal information, for example, if you want us to establish its accuracy or our reasons for using it.

• Ask us to transfer your personal information to another person or organisation.

• You can withdraw consent to processing at any time by contacting us on info@cstm.org.uk or by phone on 02077665544

If you have any questions about this notice or how we handle your personal information, or to make use of any of the rights described above, please contact us on info@cstm.org.uk, 12 Adelaide Street, London, WC2N 4HW, or telephone 020 77665544.

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.

Last updated 20.11.2019