Website Privacy Policy

This policy explains how and why The Connection at St Martin-in-the-Fields uses your personal information when you donate to us, apply to volunteer with us, take part in an event, or visit our website www.connection-at-stmartins.org.uk.

When we refer to “we” or “us” in this policy we are referring to The Connection at St Martin-in-the-Fields. We are listed on the Information Commissioner’s register of data controllers under Registration Number Z7919091.

1. Using your personal information

We only ever use your personal data if we are satisfied that it is lawful and fair to do so. When we process your personal information, it will be because:

you have consented to the processing for the specific purposes described in this notice;

it is necessary to enter into, or perform, a contract with you;

we need to use it in order to comply with a legal obligation; or

it is necessary in pursuit of a “legitimate interest”. A legitimate interest in this context means a valid interest we have or a third party has in using your personal data which is not overridden by your interests in data privacy and security.

We will only collect and use any special categories of personal information (information about your race, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation) if we have your explicit consent.

2. Information we collect and process

2.1 Donations
When you make a one-off donation to us (for example, via a form on our website), we will collect and record your name, address, email address, phone number and payment details in order to process the donation. We use a third party, Blackbaud, to process online donations. Blackbaud is a data processor for us and only processes personal information in line with our instructions.

If you donate to us via SMS text message we will collect and record your name and mobile phone number. We use a third party, RSM2000, to process SMS text donations. RSM2000 is a data processor for us and only processes personal information in line with our instructions.

If you make a one-off donation to us by post, we will record the personal information you provide to us in order to process your donation, to acknowledge receipt of the donation and to comply with our record keeping obligations.

If you set up a direct debit to donate to us regularly we will collect and record your name, address, email address, phone number and bank account details.

2.2 Friends of The Connection
Our sister charity, The Friends of The Connection (charity no. 1040560), exists to raise funds for us. The Friends is primarily a membership organisation and undertakes community fundraising. If you are a Friend, you should refer to The Friends Privacy Policy for details of how they use your personal information.

2.3

Legacies

If you indicate that you intend to leave a legacy to us, we will keep a record of your personal information (for example your name, address and contact details), as well as information about any other person or organisation that you provide to us (for example, a family member or a lawyer).

2.4

Fundraising events and appeals

We run a number of fundraising events throughout the year, including challenge events like our Pilgrimage walk to Canterbury, art exhibitions, challenge events and musical concerts. If you sign up to take part in an event, we will ask you to provide us with personal information such as your name, address and contact details, to allow us to process your application. Depending on the event, we may also collect payment details from you and we may need to ask you to provide information about any health conditions or dietary requirements you have. Sometimes, we will ask you to give us your clothes size so that we can provide you with branded T-shirts and vests.

We sometimes partner with other organisations to run events, for example, our sister charities The Friends of The Connection and St Martin-in-the Fields Charity (charity no. 1156305) and we take part in events organised by other entities, such as the Radio 4 Christmas Appeal with St Martin-in-the-Fields. We may share your personal information with these other organisations, or with third parties who organise challenge events, where you have given us consent to do so or where we have a legitimate interest but we will always let you know in advance.

2.5 Corporate support and corporate volunteers
We benefit from financial and in-kind support from companies and other commercial organisations. We keep a record of the names and contact details of key contacts at these organisations and we retain a record of relevant correspondence between us.
If you work for one of our corporate supporters and you volunteer your time with us, we will collect some personal information from you (for example, your name, telephone number, email address and next of kind details) so that we can communicate with you about volunteering opportunities and make arrangements for you to volunteer with us.

2.6 Marketing
We would like to keep in touch with you about the work that we do, events that we organise, and ways in which you can support us (for example, by volunteering your time, by giving a financial donation, or by giving us donations-in-kind).
We will only send you marketing communications by email with your consent. You can opt out of email marketing by clicking the ‘unsubscribe’ link in any of our emails or you can contact us (see the ‘Contact Us’ section below) at any time to opt out, change your contact details or to update your communication preferences.

We may also send marketing information to you by post if we are satisfied that we have a legitimate interest to do so, for example, if you have donated to one of our appeals we may contact you to report on how we used the funds and to ask if you wish to support us again. You can contact us (see the ‘Contact Us’ section below) at any time to tell us that you no longer wish to receive marketing by post or to update your contact details and preferences.

From time to time, we may make marketing telephone calls to you. We do not regularly carry out telephone marketing and we never use automated calling systems. We will only contact you in this way if we are satisfied that we have a legitimate interest to do so and we will always check the telephone preference service and our own marketing preference records before we make any telephone marketing calls to you. You can contact us (see the ‘Contact Us’ section below) at any time to tell us that you no longer wish to be contacted by telephone for marketing purposes.

2.7 Case studies and photographs
We will always ask for your consent to use your personal information such as your name, your story and/or your photograph, to help us promote our organisation, our events and our activities for example by including a case study about you in our newsletters or on our website.
If you use social media to publicly share information about fundraising activities you have done for us, we may share this information on our own social media platforms (Facebook and Twitter).

2.8 Research
We use the personal information that you provide, sometimes together with data obtained elsewhere, to manage our fundraising efficiently and effectively so we can raise more to make a difference to the lives of homeless people in London. We use the information we collect about you to effectively target and tailor our communications, for example, so we can make appropriate requests to donors who may be able to support us at a higher level.

We also use publicly available information such as Companies House, Charity Commission and other charity registers, Who’s Who and Debrett’s guides, Electoral Roll, reputable newspaper articles, publications, company websites and biographies on professional networking sites, as well as geographic and demographic information based on your postcode, to find new potential supporters and invite them to be involved in supporting our cause through tailored communications which may be of interest to them or to gain a better understanding of our supporters.

If you would prefer us not to use your data in this way please contact the Fundraising Team on appeals@cstm.org.uk or 020 7766 5555.

2.9 Visitors to our website
When you visit our website we use a third party service, Google Analytics, to collect information to enable us to evaluate the site and work to improve it (for example, the browser you use, what time you visit, which pages you view). The information we collect in this way does not allow us to identify you personally and we do not link this anonymous data with any personal information that you may provide to us elsewhere. Google Analytics will also collect your IP address in order to locate where our website visitors come from.

Our website uses cookies. For further information please see the ‘Use of Cookies’ section below.

Our website also contains links to third party sites which are not owned or managed by us and which are not subject to this privacy policy. We recommend that you read the privacy policy of any such sites that you visit.

2.10 Volunteering
If you fill in a form on our website to ask for more information about volunteering opportunities with us we will ask you to give us your name, email address and telephone contact details so that we can contact you. Depending on the nature of the volunteering services, we may also need to ask for further personal information from you before you start volunteering with us, such as your ID documents or information to check your criminal record, in order to comply with our legal and/or regulatory obligations.

2.11 Job applicants
If you apply for a vacancy with us via our website, we will only use the information you provide for the purpose of progressing your application or to fulfil our legal obligations. You don’t have to provide what we ask for but, if you choose not to, it might affect your application.

2.12 Queries and complaints
If you contact us by post, email or telephone using the contact details on our website, we will use the personal information you provide to us (for example, your name and the name(s) of any other individuals involved) in order to process your query or complaint and respond to you. We may also share your personal information with other personnel within our organisation if we are satisfied that we have a legitimate interest to do so, for example, in order to respond to a specific query or to pass on information.

Where we consider it necessary to comply with our legal obligations, or where we have a legitimate interest, we may also share this information with partner organisations, public services, local authorities or regulators such as the Fundraising Regulator and the Charity Commission. We will not share your personal information with any third parties without informing you and, where appropriate, obtaining your consent.
We will keep a record of our correspondence or discussions with you in order to deal with any follow-up questions you may have. We may also use this information for our own internal research and reporting purposes and, wherever possible, we will remove any information which could be used to identify you.

3. Sharing personal information
We will never sell your personal data or share it with third parties who might use it for their own commercial purposes.
We may share your personal information with our sister charities The Friends of The Connection and St Martin-in-the Fields Charity for the purposes described in this Privacy Policy, where you have given your consent to the sharing or where we are satisfied that we have a legitimate interest in doing so, for example, to check whether you are a Friend or to avoid duplicating the contact our organisations have with you.

We will only disclose your personal information to other third parties:

• where you have given us consent to share the information with the specific third party;
• if we are under a legal duty to disclose or share your personal information, for example, if required to do so by a court order or for the purposes of prevention of fraud or other crime;
• in order to enforce any terms and conditions or agreements between us;
• to allow our third party IT contractors, Silverbug IT, to provide us with technical support;
• as part of a sale of some or all of our business and assets to any third party or as part of any business restructuring or reorganisation (we will always notify you in advance and we will aim to ensure that your privacy rights will continue to be protected); or
• to protect our rights, property and safety, or the rights, property and safety of others (this includes exchanging information with other companies, organisations and regulators for the purposes of fraud protection and credit risk reduction).

In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you. For example, we may share anonymised results of research that we carry out into the use of our services with third parties such as funders.

4. Use of Cookies
Cookies are small, often encrypted text files, downloaded to a device when a user accesses certain websites. Cookies allow a website to recognise a user’s device and are used by website developers to help visitors navigate websites efficiently and perform certain functions. Most web browsers automatically accept cookies but you may disable cookies on your web browser to prevent this.

We use cookies to:
(i) Estimate our visitor size and patterns
(ii) Understand visitor preferences to update and improve our website
If you do not wish to have cookies stored on your computer you may change your web browser settings to refuse cookies or to notify you when you receive a cookie. Please note that some areas of our website may not function properly, or may function more slowly as a result of disabling cookies.
Cookies do not allow this website to access personal information that you have not already provided.

5. Transferring personal information outside the EEA
We do not transfer the personal information you give us to countries outside the European Economic Area (EEA).

6. Data retention
We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements, and in accordance with our data retention policy.

To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Our default retention periods may be extended or reduced if we deem it necessary, for example, to defend legal proceedings or if there is an on-going investigation relating to the information.

We review the personal data (and the categories of personal data) we hold on a regular basis to ensure the data we are holding is still required and is accurate. If we discover that certain data we are holding is no longer necessary or accurate, we will take steps to correct or delete the data.

Please contact us if you would like more information on how long we keep your personal information.

7. Your rights
Under certain circumstances, by law you have the right to:

• Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Ask us to correct personal information that we hold about you which is incorrect, incomplete or inaccurate.
• Ask us to erase your personal information from our files and systems where there is no good reason for us continuing to hold it.
• Object to us using your personal information to further our legitimate interests (or those of a third party) or where we are using your personal information for direct marketing purposes.
• Ask us to restrict or suspend the use of your personal information, for example, if you want us to establish its accuracy or our reasons for using it.
• Ask us to transfer your personal information to another person or organisation.

If you want to access, correct or request restriction or erasure of your personal information, or to object to us using your personal data, or request that we transfer a copy of your personal information to another party, please contact appeals@cstm.org.uk in writing.

If you have given your consent to us processing your personal information, you have the right to withdraw your consent at any time. To withdraw your consent, please contact appeals@cstm.org.uk. Once we have received notification that you have withdrawn your consent, we will no longer process your personal information and, subject to our retention policy, we will dispose of your data securely.

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.

8. Contact us Website Legal Statement
We cannot guarantee that information on the site is accurate, complete or up to date. Visitors who rely on any information do so at their own risk. Availability of information is subject to change without notice.

We will not accept liability for any loss, damage or inconvenience arising as a consequence of any use of or the inability to use any information on this site and we take no responsibility for the contents of linked websites and links should not be taken as an endorsement.

10. Copyright
Content on this site is protected by copyright. The copyright owner is The Connection at St Martin-in-the-Fields, unless otherwise stated.
We encourage people to download or copy the material for personal use but we ask that you give appropriate acknowledgment of the copyright owner if material is re-published in any format.

You may not make alterations or additions to the material on this site, or use it for commercial purposes.

This policy explains how and why The Connection at St Martin-in-the-Fields will collect and use your personal data during our initial assessment.
When we refer to “we” or “us” in this policy we are referring to The Connection at St Martin-in-the-Fields. We are listed on the Data Commissioner’s register of data controllers under Registration Number Z7919091.

If you have any questions about this privacy notice or how we handle your personal data, please contact us by e-mail at info@cstm.org.uk
In this policy we use the term personal data to mean any information you give us from which you can be identified. This might include your name, your home address, your personal email contact details, or your telephone number. Personal data does not include data where your identity has been removed (i.e. anonymous data).

We use the term special categories of personal data to mean data about your race, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation, criminal convictions, offences and legal claims against you, or any related security measures.

1.Is it legal for us to use your information?
Under the General Data Protection Regulation, we are allowed to use your personal data if we are satisfied that we (or a third party) have a legitimate interest in using your personal data and our interest is not overridden by your rights. In other words, before we collect any data from you, we have to weigh up your interests and our interests very carefully. We have taken the following steps to do this:

Completing a legal ‘balance test’ where we compare your interests and our interests

Involving service users in designing and providing feedback on our initial assessment

For special categories of personal data, we have a legal duty to take extra precautions to protect you. In practice, we will only use this data in the course of our legitimate activities. We will only share it with external parties where we have your consent, or where there is a substantial public interest in doing so. In the latter case, we will enforce appropriate safeguards among our staff to ensure that we always use your data fairly.

2. What personal data do we collect at the initial assessment?
At the initial assessment, we will ask you to provide the following kinds of information:

Your contact details (name, e-mail address)

Basic data e.g. age, gender, ethnicity, sexuality, nationality, and immigration status

Data about your housing situation (for example, where you are staying, how long you have been staying there, where you were before)

Data about your wellbeing (for example, if you have any disabilities, if you have any chronic health conditions, if you have any addictions)

Data about violent offences

You do not have to answer the questions, but the information will help us to advise you better and create a safe environment for all. If you do not provide us with important personal data, we may be unable to allow you access to our building or to certain services.

We have appropriate security measures in place to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed and we will not transfer the personal data you give us to countries outside the European Economic Area.

3. Who else will see your personal data and why?
We only ever share your personal data with third parties if we believe it is fair to do so. We may share your personal data (including special categories of personal data) with:

The Passage and West London Mission, who share our client database and who may need to access your information (e.g. if they are also working with you);

Other street outreach teams in London, if you are verified a rough sleeper we may share limited personal data that we have collected (e.g. name, date of birth) in order to avoid duplicating work;

The manager of our database system (currently St. Mungo’s) and our third-party IT contractor, in order to provide technical support; and

External interpreting services, so that we can communicate with you in a language you understand.

The most common ways in which we share your personal data with third parties are:

With your consent

If we are under a legal obligation (for example, as part of a criminal investigation)

To protect our rights property and safety, or the rights, property and safety of others

The most common ways in which we share special categories of personal data are where:

you have given us your explicit consent;

we have a substantial public interest, e.g. to prevent/detect a serious crime, or because of serious worries about your health;

it is necessary in connection with a legal claim, e.g. as part of a criminal investigation;

it is necessary to protect your vital interests or the vital interests of another person and you are incapable of giving consent.

4. How do we use the personal data we collect at the initial assessment?
Most importantly, we use the data to decide whether we have the right resources to help you. If we think another organisation would be more suitable for your situation, we will help you to contact them instead.

We also use the data we collect from you at the initial assessment for the following purposes:

To keep our staff and other service users safe

To keep track of our work

To research homelessness in London so that we can provide better services

5. Where do we keep your personal data and for how long?
Personal data from the initial assessment is kept on our electronic database for up to 6 years after your last contact with us.
After this time, your personal data will be deleted. Under special circumstances, we might extend or reduce the length of time we keep the data, for example, to defend legal proceedings. We also regularly review our policy on data retention in the light of feedback from service users and staff.

6. What are your legal rights?
Under certain circumstances, by law you have the right to:

Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

Ask us to correct personal data that we hold about you which is incorrect, incomplete or inaccurate.

Ask us to erase your personal data from our files and systems where there is no good reason for us continuing to hold it.

Object to us using your personal data to further our legitimate interests (or those of a third party) or where we are using your personal data for direct marketing purposes.

Ask us to restrict or suspend the use of your personal data, for example, if you want us to establish its accuracy or our reasons for using it.

Ask us to transfer your personal data to another person or organisation.

If you want to access, correct or request restriction or erasure of your personal data, or to object to us using your personal data, or request that we transfer a copy of your personal data to another party, please contact info@cstm.org.uk.

If we requested your consent to use your data in a particular way and you gave your consent, you still you have the right to withdraw your consent at any time. To withdraw your consent, please speak to a staff member or contact info@cstm.org.uk. Once we have received notification that you have withdrawn your consent, we will no longer process your personal data and, subject to our retention policy, we will dispose of your data securely.

You have the right to make a complaint at any time to the Data Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.

This policy explains how and why The Connection at St Martin-in-the-Fields will collect and use your personal data during our initial assessment.
When we refer to “we” or “us” in this policy we are referring to The Connection at St Martin-in-the-Fields. We are listed on the Data Commissioner’s register of data controllers under Registration Number Z7919091.

If you have any questions about this privacy notice or how we handle your personal data, please contact us by e-mail at info@cstm.org.uk
In this policy we use the term personal data to mean any information you give us from which you can be identified. This might include your name, your home address, your personal email contact details, or your telephone number. Personal data does not include data where your identity has been removed (i.e. anonymous data).

We use the term special categories of personal data to mean data about your race, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation, criminal convictions, offences and legal claims against you, or any related security measures.

1. Is it legal for us to use your information?
Under the General Data Protection Regulation, we are allowed to use your personal data if we are satisfied that we (or a third party) have a legitimate interest in using your personal data and our interest is not overridden by your rights. In other words, before we collect any data from you, we have to weigh up your interests and our interests very carefully. We have taken the following steps to do this:

• Completing a legal ‘balance test’ where we compare your interests and our interests
• Involving service users in designing and providing feedback on our initial assessment

For special categories of personal data, we have a legal duty to take extra precautions to protect you. In practice, we will only use this data in the course of our legitimate activities. We will only share it with external parties where we have your consent, or where there is a substantial public interest in doing so. In the latter case, we will enforce appropriate safeguards among our staff to ensure that we always use your data fairly.

2. What personal data do we collect at the initial assessment?
At the initial assessment, we will ask you to provide the following kinds of information:

• Your contact details (name, e-mail address)
• Basic data e.g. age, gender, ethnicity, sexuality, nationality, and immigration status
• Data about your housing situation (for example, where you are staying, how long you have been staying there, where you were before)
• Data about your wellbeing (for example, if you have any disabilities, if you have any chronic health conditions, if you have any addictions)
• Data about violent offences

You do not have to answer the questions, but the information will help us to advise you better and create a safe environment for all. If you do not provide us with important personal data, we may be unable to allow you access to our building or to certain services.

We have appropriate security measures in place to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed and we will not transfer the personal data you give us to countries outside the European Economic Area.

3. Who else will see your personal data and why?
We only ever share your personal data with third parties if we believe it is fair to do so. We may share your personal data (including special categories of personal data) with:

• The Passage and West London Mission, who share our client database and who may need to access your information (e.g. if they are also working with you);
• Other street outreach teams in London, if you are verified a rough sleeper we may share limited personal data that we have collected (e.g. name, date of birth) in order to avoid duplicating work;
• The manager of our database system (currently St. Mungo’s) and our third-party IT contractor, in order to provide technical support; and
• External interpreting services, so that we can communicate with you in a language you understand.

The most common ways in which we share your personal data with third parties are:

• With your consent
• If we are under a legal obligation (for example, as part of a criminal investigation)
• To protect our rights property and safety, or the rights, property and safety of others

The most common ways in which we share special categories of personal data are where:

• you have given us your explicit consent;
• we have a substantial public interest, e.g. to prevent/detect a serious crime, or because of serious worries about your health;
• it is necessary in connection with a legal claim, e.g. as part of a criminal investigation;
• it is necessary to protect your vital interests or the vital interests of another person and you are incapable of giving consent.

4. How do we use the personal data we collect at the initial assessment?
Most importantly, we use the data to decide whether we have the right resources to help you. If we think another organisation would be more suitable for your situation, we will help you to contact them instead.

We also use the data we collect from you at the initial assessment for the following purposes:

• To keep our staff and other service users safe
• To keep track of our work
• To research homelessness in London so that we can provide better services

5. Where do we keep your personal data and for how long?

Personal data from the initial assessment is kept on our electronic database for up to 6 years after your last contact with us.
After this time, your personal data will be deleted. Under special circumstances, we might extend or reduce the length of time we keep the data, for example, to defend legal proceedings. We also regularly review our policy on data retention in the light of feedback from service users and staff.

6. What are your legal rights?
Under certain circumstances, by law you have the right to:

• Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
• Ask us to correct personal data that we hold about you which is incorrect, incomplete or inaccurate.
• Ask us to erase your personal data from our files and systems where there is no good reason for us continuing to hold it.
• Object to us using your personal data to further our legitimate interests (or those of a third party) or where we are using your personal data for direct marketing purposes.
• Ask us to restrict or suspend the use of your personal data, for example, if you want us to establish its accuracy or our reasons for using it.
• Ask us to transfer your personal data to another person or organisation.

If you want to access, correct or request restriction or erasure of your personal data, or to object to us using your personal data, or request that we transfer a copy of your personal data to another party, please contact info@cstm.org.uk.

If we requested your consent to use your data in a particular way and you gave your consent, you still you have the right to withdraw your consent at any time. To withdraw your consent, please speak to a staff member or contact info@cstm.org.uk. Once we have received notification that you have withdrawn your consent, we will no longer process your personal data and, subject to our retention policy, we will dispose of your data securely.
You have the right to make a complaint at any time to the Data Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.

Recruitment of Employees and Volunteers Privacy Policy

This policy explains how and why The Connection at St Martin-in-the-Fields uses your personal information during the recruitment process
This policy applies to all potential employee’s, and volunteers, who are going through the recruitment process. Please read it carefully to understand our practices regarding your personal information and how we will treat it.

This policy does not form part of any contract of employment or other contract to provide services. We may update this notice from time to time.
When we refer to “we” or “us” in this policy we are referring to The Connection at St Martin-in-the-Fields. We are listed on the Information Commissioner’s register of data controllers under Registration Number Z7919091.

For the purposes of the Data Protection Act 1998, the General Data Protection Regulation (GDPR) and any applicable replacement legislation, we are the data controller.

Types of Information
When we use the term personal information we mean any personal data you give us from which you can be identified. This might include your name, your home address, your personal email contact details, or your telephone number. Personal information does not include information where your identity has been removed (i.e. anonymous data).

We use the term special categories of personal information to mean information about your race, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation.
We only ever use your personal data if we are satisfied that it is lawful and fair to do so. When we process your personal information, it will be because:

• you have consented to the processing for the specific purposes described in this notice;
• the processing is necessary to enter into, or perform, a contract with you;
• in order to comply with a legal obligation; or
• the processing is necessary in pursuit of a “legitimate interest”, a legitimate interest in this context means a valid interest we have or a third party has in using your personal data which is not overridden by your interests in data privacy and security.

We will only collect and use any special categories of personal information (information about your race, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation) where we have your explicit consent.

Information we collect about you
The organisation collects a range of information about you. This may include:

Data we collect and whether this is personal or sensitive data: Names, addresses, telephone numbers, email addresses (Personal Data)

What we use it for: To contact you to discuss regarding a job application or for volunteering opportunities. Volunteers may also be keep updated on our services or activities and events.

Data we collect and whether this is personal or sensitive data: Application form (Personal Data)

What we use it for: To build a picture of your skills, experience and interests in order to assess your suitability for employment or volunteering opportunities.

Data we collect and whether this is personal or sensitive data:References (Personal Data)

What we use it for:To assess your suitability for either employment purposes or volunteering with us.

Data we collect and whether this is personal or sensitive data:Current salary details (Personal Data)

What we use it for:To help us assess your suitability for a paid employment role

Data we collect and whether this is personal or sensitive data:Your right to work in the UK (Personal Data)

What we use it for:To ensure that you are legally entitled to work in the United Kingdom

Data we collect and whether this is personal or sensitive data:Criminal Records Check (Personal Data)

What we use it for:For some roles, the organisation is obliged to seek information about criminal convictions and offences. Where the organisation seeks this information, it does so because it is necessary for it to carry out its obligations and exercise specific rights in relation to employment. This check will only be completed for the following reasons, and will not be completed without your explicit consent:
If the role is a regulated activity within the meaning of the Safeguarding Vulnerable Groups Act 2006
If we are legally required by the Charity Commission to carry out criminal records checks for those carrying out the role
If the role requires a high degree of trust and integrity and we would like to ask you to seek a basic disclosure of your criminal records history

Data we collect and whether this is personal or sensitive data:Equal opportunities information (Sensitive Data)

What we use it for:This is for equal opportunities monitoring purposes to ensure meaningful equal opportunity monitoring and reporting where it may be needed in the public interest.

Data we collect and whether this is personal or sensitive data:Information on special requirements, health or medical conditions.(Sensitive Data)

What we use it for:To allow us to make any reasonable adjustments to allow you to effectively carry out the duties of your role. This is not mandatory and will not affect any offer of employment

Data we collect and whether this is personal or sensitive data:IP Addresses (Personal Data)

What we use it for:As an extra cyber security measure, we may log the IP address of the computer used to email us an application form as part of our registration process. This type of data does not normally identify an individual in the UK.

We collect the majority of this information directly from you during the application and recruitment process. We also sometimes collect additional information from third parties including former employers and other background check agencies including:

• the Disclosure and Barring Service;
• publicly accessible data from the Insolvency Service, Companies House and/or the Charity Commission.

We only ever use your personal information if we are satisfied that it is lawful and fair to do so. We will never sell your personal information or share it with third parties who might use it for their own commercial purposes.

We will only disclose your personal information to third parties:

• where you have given us consent to share the information with the specific third party When we transfer personal information to Maitland Medical our occupational health provider
• or to ONE Westminster our DBS provider

Data Storage

• Data will be stored in a range of different places, including on your application record, manual files and on other IT systems (including email).
• If your application is unsuccessful, the organisation will keep your personal data on file for a period of 6 months to 1 year, and then this will be securely destroyed. You are free to withdraw your consent to this data being held at any time.

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal information without your knowledge or consent where this is required or permitted by law.
We will not transfer your personal information outside the European Economic Area (EEA) and all of our third party suppliers store information on servers located within the EEA.

In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use and share such information without further notice to you.

We only keep your personal information in a secure environment. Personal Data will only be used as set out in this Privacy Policy.

• We hold data electronically in our secure document management system and on our on-site file servers, which are protected by both hardware and software firewalls.
• We have off-site back-up servers in secure locations.
• We encrypt all data stored on our servers with an industry standard encryption method that encrypts the data between your computer and our server so that in the event of your network being insecure no data is passed in a format that could easily be deciphered.
• We regularly back up and encrypt all of the data we hold.
• We store papers in lockable cabinets in our offices when not being actively used and we have a secure off-site document storage facility for archived papers.
• Our offices are secure and only personnel holding appropriate security passes can access areas where personal data are stored.
• When necessary, we dispose of or delete your data securely.
• We ensure that our employees, agents and contractors are aware of their privacy and data security obligations and we take reasonable steps to ensure that employees of third parties working on our behalf are aware of their privacy and data security obligations.
• We limit access to your personal information to those employees, agents, contractors and other third parties who have a need to know.

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Details of retention periods for different aspects of your personal information are contained in our retention policy which is available Caroline Summerfield, Human Resources Manager.

These retention periods may be extended or reduced if required by applicable law or we deem it necessary, for example, to defend legal proceedings or if there is an on-going investigation relating to the information.

We review the personal data (and the categories of personal data) we hold on a regular basis to ensure the data we are holding is still required and is accurate. If we discover that certain data we are holding is no longer necessary or accurate, we will take steps to correct or delete the data.

Under certain circumstances, by law you have the right to:

• Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Ask us to correct personal information that we hold about you which is incorrect, incomplete or inaccurate.
• Ask us to erase your personal information from our files and systems where there is no good reason for us continuing to hold it.
• Object to us using your personal information to further our legitimate interests (or those of a third party) or where we are using your personal information for direct marketing purposes.
• Ask us to restrict or suspend the use of your personal information, for example, if you want us to establish its accuracy or our reasons for using it.
• Ask us to transfer your personal information to another person or organisation.

You also have rights in relation to automated decision making which has a legal effect or otherwise significantly affects you. You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces significant legal effects concerning you.

If you have any questions about this privacy policy or how we handle your personal information, please contact Caroline Summerfield, Human Resources Manager, 12 Adelaide Street, London, WC2N 4HW, or telephone 020 7925 7891.

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.