Website Privacy Policy

This policy explains how and why The Connection at St Martin-in-the-Fields uses your personal information when you donate to us, apply to volunteer with us, take part in an event, or visit our website www.connection-at-stmartins.org.uk.

When we refer to “we” or “us” in this policy we are referring to The Connection at St Martin-in-the-Fields. We are listed on the Information Commissioner’s register of data controllers under Registration Number Z7919091.

1. Using your personal information

We only ever use your personal data if we are satisfied that it is lawful and fair to do so. When we process your personal information, it will be because:

you have consented to the processing for the specific purposes described in this notice;

it is necessary to enter into, or perform, a contract with you;

we need to use it in order to comply with a legal obligation; or

it is necessary in pursuit of a “legitimate interest”. A legitimate interest in this context means a valid interest we have or a third party has in using your personal data which is not overridden by your interests in data privacy and security.

We will only collect and use any special categories of personal information (information about your race, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation) if we have your explicit consent.

2. Information we collect and process

2.1 Donations
When you make a one-off donation to us (for example, via a form on our website), we will collect and record your name, address, email address, phone number and payment details in order to process the donation. We use a third party, Blackbaud, to process online donations. Blackbaud is a data processor for us and only processes personal information in line with our instructions.

If you donate to us via SMS text message we will collect and record your name and mobile phone number. We use a third party, RSM2000, to process SMS text donations. RSM2000 is a data processor for us and only processes personal information in line with our instructions.

If you make a one-off donation to us by post, we will record the personal information you provide to us in order to process your donation, to acknowledge receipt of the donation and to comply with our record keeping obligations.

If you set up a direct debit to donate to us regularly we will collect and record your name, address, email address, phone number and bank account details.

2.2 Friends of The Connection
Our sister charity, The Friends of The Connection (charity no. 1040560), exists to raise funds for us. The Friends is primarily a membership organisation and undertakes community fundraising. If you are a Friend, you should refer to The Friends Privacy Policy for details of how they use your personal information.

2.3 Legacies
If you indicate that you intend to leave a legacy to us, we will keep a record of your personal information (for example your name, address and contact details), as well as information about any other person or organisation that you provide to us (for example, a family member or a lawyer).

2.4 Fundraising events and appeals
We run a number of fundraising events throughout the year, including challenge events like our Pilgrimage walk to Canterbury, art exhibitions, challenge events and musical concerts. If you sign up to take part in an event, we will ask you to provide us with personal information such as your name, address and contact details, to allow us to process your application. Depending on the event, we may also collect payment details from you and we may need to ask you to provide information about any health conditions or dietary requirements you have. Sometimes, we will ask you to give us your clothes size so that we can provide you with branded T-shirts and vests.

We sometimes partner with other organisations to run events, for example, our sister charities The Friends of The Connection and St Martin-in-the Fields Charity (charity no. 1156305) and we take part in events organised by other entities, such as the Radio 4 Christmas Appeal with St Martin-in-the-Fields. We may share your personal information with these other organisations, or with third parties who organise challenge events, where you have given us consent to do so or where we have a legitimate interest but we will always let you know in advance.

2.5 Corporate support and corporate volunteers
We benefit from financial and in-kind support from companies and other commercial organisations. We keep a record of the names and contact details of key contacts at these organisations and we retain a record of relevant correspondence between us.
If you work for one of our corporate supporters and you volunteer your time with us, we will collect some personal information from you (for example, your name, telephone number, email address and next of kind details) so that we can communicate with you about volunteering opportunities and make arrangements for you to volunteer with us.

2.6 Marketing
We would like to keep in touch with you about the work that we do, events that we organise, and ways in which you can support us (for example, by volunteering your time, by giving a financial donation, or by giving us donations-in-kind).
We will only send you marketing communications by email with your consent. You can opt out of email marketing by clicking the ‘unsubscribe’ link in any of our emails or you can contact us (see the ‘Contact Us’ section below) at any time to opt out, change your contact details or to update your communication preferences.

We may also send marketing information to you by post if we are satisfied that we have a legitimate interest to do so, for example, if you have donated to one of our appeals we may contact you to report on how we used the funds and to ask if you wish to support us again. You can contact us (see the ‘Contact Us’ section below) at any time to tell us that you no longer wish to receive marketing by post or to update your contact details and preferences.

From time to time, we may make marketing telephone calls to you. We do not regularly carry out telephone marketing and we never use automated calling systems. We will only contact you in this way if we are satisfied that we have a legitimate interest to do so and we will always check the telephone preference service and our own marketing preference records before we make any telephone marketing calls to you. You can contact us (see the ‘Contact Us’ section below) at any time to tell us that you no longer wish to be contacted by telephone for marketing purposes.

2.7 Case studies and photographs
We will always ask for your consent to use your personal information such as your name, your story and/or your photograph, to help us promote our organisation, our events and our activities for example by including a case study about you in our newsletters or on our website.
If you use social media to publicly share information about fundraising activities you have done for us, we may share this information on our own social media platforms (Facebook and Twitter).

2.8 Research
We use the personal information that you provide, sometimes together with data obtained elsewhere, to manage our fundraising efficiently and effectively so we can raise more to make a difference to the lives of homeless people in London. We use the information we collect about you to effectively target and tailor our communications, for example, so we can make appropriate requests to donors who may be able to support us at a higher level.

We also use publicly available information such as Companies House, Charity Commission and other charity registers, Who’s Who and Debrett’s guides, Electoral Roll, reputable newspaper articles, publications, company websites and biographies on professional networking sites, as well as geographic and demographic information based on your postcode, to find new potential supporters and invite them to be involved in supporting our cause through tailored communications which may be of interest to them or to gain a better understanding of our supporters.

If you would prefer us not to use your data in this way please contact the Fundraising Team on fundraising@cstm.org.uk or 020 7766 5555.

2.9 Visitors to our website
When you visit our website we use a third party service, Google Analytics, to collect information to enable us to evaluate the site and work to improve it (for example, the browser you use, what time you visit, which pages you view). The information we collect in this way does not allow us to identify you personally and we do not link this anonymous data with any personal information that you may provide to us elsewhere. Google Analytics will also collect your IP address in order to locate where our website visitors come from.

Our website uses cookies. For further information please see the ‘Use of Cookies’ section below.

Our website also contains links to third party sites which are not owned or managed by us and which are not subject to this privacy policy. We recommend that you read the privacy policy of any such sites that you visit.

2.10 Volunteering
If you fill in a form on our website to ask for more information about volunteering opportunities with us we will ask you to give us your name, email address and telephone contact details so that we can contact you. Depending on the nature of the volunteering services, we may also need to ask for further personal information from you before you start volunteering with us, such as your ID documents or information to check your criminal record, in order to comply with our legal and/or regulatory obligations.

2.11 Job applicants
If you apply for a vacancy with us via our website, we will only use the information you provide for the purpose of progressing your application or to fulfil our legal obligations. You don’t have to provide what we ask for but, if you choose not to, it might affect your application.

2.12 Queries and complaints
If you contact us by post, email or telephone using the contact details on our website, we will use the personal information you provide to us (for example, your name and the name(s) of any other individuals involved) in order to process your query or complaint and respond to you. We may also share your personal information with other personnel within our organisation if we are satisfied that we have a legitimate interest to do so, for example, in order to respond to a specific query or to pass on information.

Where we consider it necessary to comply with our legal obligations, or where we have a legitimate interest, we may also share this information with partner organisations, public services, local authorities or regulators such as the Fundraising Regulator and the Charity Commission. We will not share your personal information with any third parties without informing you and, where appropriate, obtaining your consent.
We will keep a record of our correspondence or discussions with you in order to deal with any follow-up questions you may have. We may also use this information for our own internal research and reporting purposes and, wherever possible, we will remove any information which could be used to identify you.

3. Sharing personal information
We will never sell your personal data or share it with third parties who might use it for their own commercial purposes.
We may share your personal information with our sister charities The Friends of The Connection and St Martin-in-the Fields Charity for the purposes described in this Privacy Policy, where you have given your consent to the sharing or where we are satisfied that we have a legitimate interest in doing so, for example, to check whether you are a Friend or to avoid duplicating the contact our organisations have with you.

We will only disclose your personal information to other third parties:

• where you have given us consent to share the information with the specific third party;
• if we are under a legal duty to disclose or share your personal information, for example, if required to do so by a court order or for the purposes of prevention of fraud or other crime;
• in order to enforce any terms and conditions or agreements between us;
• to allow our third party IT contractors, Silverbug IT, to provide us with technical support;
• as part of a sale of some or all of our business and assets to any third party or as part of any business restructuring or reorganisation (we will always notify you in advance and we will aim to ensure that your privacy rights will continue to be protected); or
• to protect our rights, property and safety, or the rights, property and safety of others (this includes exchanging information with other companies, organisations and regulators for the purposes of fraud protection and credit risk reduction).

In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you. For example, we may share anonymised results of research that we carry out into the use of our services with third parties such as funders.

4. Use of Cookies
Cookies are small, often encrypted text files, downloaded to a device when a user accesses certain websites. Cookies allow a website to recognise a user’s device and are used by website developers to help visitors navigate websites efficiently and perform certain functions. Most web browsers automatically accept cookies but you may disable cookies on your web browser to prevent this.

We use cookies to:
(i) Estimate our visitor size and patterns
(ii) Understand visitor preferences to update and improve our website
If you do not wish to have cookies stored on your computer you may change your web browser settings to refuse cookies or to notify you when you receive a cookie. Please note that some areas of our website may not function properly, or may function more slowly as a result of disabling cookies.
Cookies do not allow this website to access personal information that you have not already provided.

5. Transferring personal information outside the EEA
We do not transfer the personal information you give us to countries outside the European Economic Area (EEA).

6. Data retention
We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements, and in accordance with our data retention policy.

To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Our default retention periods may be extended or reduced if we deem it necessary, for example, to defend legal proceedings or if there is an on-going investigation relating to the information.

We review the personal data (and the categories of personal data) we hold on a regular basis to ensure the data we are holding is still required and is accurate. If we discover that certain data we are holding is no longer necessary or accurate, we will take steps to correct or delete the data.

Please contact us if you would like more information on how long we keep your personal information.

7. Your rights
Under certain circumstances, by law you have the right to:

• Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Ask us to correct personal information that we hold about you which is incorrect, incomplete or inaccurate.
• Ask us to erase your personal information from our files and systems where there is no good reason for us continuing to hold it.
• Object to us using your personal information to further our legitimate interests (or those of a third party) or where we are using your personal information for direct marketing purposes.
• Ask us to restrict or suspend the use of your personal information, for example, if you want us to establish its accuracy or our reasons for using it.
• Ask us to transfer your personal information to another person or organisation.

If you want to access, correct or request restriction or erasure of your personal information, or to object to us using your personal data, or request that we transfer a copy of your personal information to another party, please contact fundraising@cstm.org.uk in writing.

If you have given your consent to us processing your personal information, you have the right to withdraw your consent at any time. To withdraw your consent, please contact fundraising@cstm.org.uk. Once we have received notification that you have withdrawn your consent, we will no longer process your personal information and, subject to our retention policy, we will dispose of your data securely.

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.

8. Contact us
If you have any questions about this privacy notice or how we handle your personal information, please contact us by email at appeals@cstm.org.uk or by telephoning 02077665555.

9. Website Legal Statement
We cannot guarantee that information on the site is accurate, complete or up to date. Visitors who rely on any information do so at their own risk. Availability of information is subject to change without notice.

We will not accept liability for any loss, damage or inconvenience arising as a consequence of any use of or the inability to use any information on this site and we take no responsibility for the contents of linked websites and links should not be taken as an endorsement.

10. Copyright
Content on this site is protected by copyright. The copyright owner is The Connection at St Martin-in-the-Fields, unless otherwise stated.
We encourage people to download or copy the material for personal use but we ask that you give appropriate acknowledgment of the copyright owner if material is re-published in any format.

You may not make alterations or additions to the material on this site, or use it for commercial purposes.

This policy explains how and why The Connection at St Martin-in-the-Fields will collect and use your personal data during our initial assessment.
When we refer to “we” or “us” in this policy we are referring to The Connection at St Martin-in-the-Fields. We are listed on the Data Commissioner’s register of data controllers under Registration Number Z7919091.

If you have any questions about this privacy notice or how we handle your personal data, please contact us by e-mail at info@cstm.org.uk
In this policy we use the term personal data to mean any information you give us from which you can be identified. This might include your name, your home address, your personal email contact details, or your telephone number. Personal data does not include data where your identity has been removed (i.e. anonymous data).

We use the term special categories of personal data to mean data about your race, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation, criminal convictions, offences and legal claims against you, or any related security measures.

1.Is it legal for us to use your information?
Under the General Data Protection Regulation, we are allowed to use your personal data if we are satisfied that we (or a third party) have a legitimate interest in using your personal data and our interest is not overridden by your rights. In other words, before we collect any data from you, we have to weigh up your interests and our interests very carefully. We have taken the following steps to do this:

Completing a legal ‘balance test’ where we compare your interests and our interests

Involving service users in designing and providing feedback on our initial assessment

For special categories of personal data, we have a legal duty to take extra precautions to protect you. In practice, we will only use this data in the course of our legitimate activities. We will only share it with external parties where we have your consent, or where there is a substantial public interest in doing so. In the latter case, we will enforce appropriate safeguards among our staff to ensure that we always use your data fairly.

2. What personal data do we collect at the initial assessment?
At the initial assessment, we will ask you to provide the following kinds of information:

Your contact details (name, e-mail address)

Basic data e.g. age, gender, ethnicity, sexuality, nationality, and immigration status

Data about your housing situation (for example, where you are staying, how long you have been staying there, where you were before)

Data about your wellbeing (for example, if you have any disabilities, if you have any chronic health conditions, if you have any addictions)

Data about violent offences

You do not have to answer the questions, but the information will help us to advise you better and create a safe environment for all. If you do not provide us with important personal data, we may be unable to allow you access to our building or to certain services.

We have appropriate security measures in place to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed and we will not transfer the personal data you give us to countries outside the European Economic Area.

3. Who else will see your personal data and why?
We only ever share your personal data with third parties if we believe it is fair to do so. We may share your personal data (including special categories of personal data) with:

The Passage and West London Mission, who share our client database and who may need to access your information (e.g. if they are also working with you);

Other street outreach teams in London, if you are verified a rough sleeper we may share limited personal data that we have collected (e.g. name, date of birth) in order to avoid duplicating work;

The manager of our database system (currently St. Mungo’s) and our third-party IT contractor, in order to provide technical support; and

External interpreting services, so that we can communicate with you in a language you understand.

The most common ways in which we share your personal data with third parties are:

With your consent

If we are under a legal obligation (for example, as part of a criminal investigation)

To protect our rights property and safety, or the rights, property and safety of others

The most common ways in which we share special categories of personal data are where:

you have given us your explicit consent;

we have a substantial public interest, e.g. to prevent/detect a serious crime, or because of serious worries about your health;

it is necessary in connection with a legal claim, e.g. as part of a criminal investigation;

it is necessary to protect your vital interests or the vital interests of another person and you are incapable of giving consent.

4. How do we use the personal data we collect at the initial assessment?
Most importantly, we use the data to decide whether we have the right resources to help you. If we think another organisation would be more suitable for your situation, we will help you to contact them instead.

We also use the data we collect from you at the initial assessment for the following purposes:

To keep our staff and other service users safe

To keep track of our work

To research homelessness in London so that we can provide better services

5. Where do we keep your personal data and for how long?
Personal data from the initial assessment is kept on our electronic database for at least 6 years after your last contact with us.
After this time, your personal data will be deleted. Under special circumstances, we might extend or reduce the length of time we keep the data, for example, to defend legal proceedings. We also regularly review our policy on data retention in the light of feedback from service users and staff.

6. What are your legal rights?
Under certain circumstances, by law you have the right to:

Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

Ask us to correct personal data that we hold about you which is incorrect, incomplete or inaccurate.

Ask us to erase your personal data from our files and systems where there is no good reason for us continuing to hold it.

Object to us using your personal data to further our legitimate interests (or those of a third party) or where we are using your personal data for direct marketing purposes.

Ask us to restrict or suspend the use of your personal data, for example, if you want us to establish its accuracy or our reasons for using it.

Ask us to transfer your personal data to another person or organisation.

If you want to access, correct or request restriction or erasure of your personal data, or to object to us using your personal data, or request that we transfer a copy of your personal data to another party, please contact info@cstm.org.uk.

If we requested your consent to use your data in a particular way and you gave your consent, you still you have the right to withdraw your consent at any time. To withdraw your consent, please speak to a staff member or contact info@cstm.org.uk. Once we have received notification that you have withdrawn your consent, we will no longer process your personal data and, subject to our retention policy, we will dispose of your data securely.

You have the right to make a complaint at any time to the Data Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.

This explains how and why The Connection at St Martin-in-the-Fields will collect and use your personal data as someone who uses our services.
When we refer to “we” or “us” in this policy we are referring to The Connection at St Martin-in-the-Fields. We are listed on the Data Commissioner’s register of data controllers under Registration Number Z7919091.

If you have any questions about this privacy notice or how we handle your personal data, please contact member of staff or send us an e-mail to info@cstm.org.uk.

Personal data means any data you give us from which you can be identified. This might include your name, your home address, your personal email contact details, or your telephone number. Personal data does not include data where your identity has been removed (i.e. anonymous data).
We use the term special categories of personal data to mean data about your race, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation, or criminal convictions, offences and legal claims against you, or any related security measures.

1. Why do we want to collect personal data from you?
Most importantly, we want to collect personal data from you so that we can provide suitable advice and support to you. If we do not understand your situation well, we might provide advice and support that is not suitable for you.

We also collect your personal data for other reasons, which include:

To keep you, ourselves and others safe

To keep track of the work we do

To research homelessness in London so that we can provide better services

To keep important documents (e.g. your passport) safe on your behalf

To provide you with useful data about activities we are running (e.g. workshops)

To enter into contractual relationships with you (e.g. tenancy agreements)

To balance our financial records (e.g. when handling grants on your behalf)

To manage the safety of our property (for example, through CCTV)

To publicise our work to the general public and potential donors

You do not have to give us your personal data, but the information will help us to advise you better, create a safe environment for all and demonstrate the impact we are having. If you do not provide us with important information, we may be unable to allow you access to our building or to certain services.

2. Where do we get the personal data from?
Generally, we will get personal data directly from you. This could come from lots of different sources, for example:

Informal conversations with you on the streets via our Daytime Outreach team

Informal conversations with you in the building, for example, in the Day Centre

Formal assessments, such as the Employability registration

Appointments, such as careers coaching sessions or duty sessions

Registers, rotas or other records of your participation in our activities or use of our services

Special research projects that we decide to undertake

Documents that you complete asking us to keep your documents safe for you

Tenancy agreements at St. Martin’s House or other accommodation we offer

Sometimes personal data about you will not come directly from you. This could be because a third party contacts us to share personal data about you, or it could be because we contact a third party to ask them for personal data about you. Examples of such situations might include:

A family member of yours gets in touch with us because they are worried about your wellbeing

A recruitment agency with whom we collaborate shares information about how you are doing in a job they helped to find for you

A fellow service user passes on concerns about your behaviour

A homeless organisation in Westminster contacts us to ask if we can book you into our Night Centre for one night

A police officer tells us that they want to speak to you in connection with an incident

You come to us after having a case-worker at the Passage for many years. We will look at your CHAIN profile to understand a little about your situation and your time at the Passage.

You believe you have a court date pending, so we contact the justice system with your consent to check when it is

Whenever we use personal data that comes via third parties, we ensure that is consistent with the purposes set out above and is handled in strict accordance with our policies.

3. What kind of personal data are we interested in?
When we do casework with you, the exact data that we collect and use will depend on your individual circumstances and what we can offer you. For example, in order to make a benefits application for you, we would need your personal ID. In such a case, we might therefore ask you for a copy of your birth certificate or photo ID.
Because the services that we offer are so varied, we might want to collect and use any of the following:

Contact details (your name, telephone number, email address, next of kin)

Basic data (e.g. date of birth, gender, nationality, immigration status, national insurance number)

ID (such as a copy of your birth certificate, driving licence or passport)

Bank details

Housing history

Employment history

Participation in activities or use of services

Outcomes or achievements, for example, getting an interview or being booked into a hostel

CCTV footage

It is also likely that we will want to collect and use the following special categories of your personal data:

Data about your race or ethnicity, political opinions, religious or philosophical beliefs, sexuality or sex life

Data about your health, including any medical condition

Data about criminal convictions, offences and legal claims against you, or any related security measures

Under exceptional circumstances, for example, if it directly affects a legal claim relating to your immigration status, we may also collect and use personal data relating to your children.

4. Under what circumstances do we share your personal data with third parties?
We only ever share your personal data with third parties if we believe it is fair to do so. We may share your personal data (including special categories of personal data) with:

The Passage and West London Mission, who share our client database and who may need to access your information (e.g. if they are also working with you);

Other street outreach teams in London, if you are verified a rough sleeper we may share limited personal data that we have collected (e.g. name, date of birth) in order to avoid duplicating work;

The manager of our database system (currently St. Mungo’s) and our third-party IT contractor, in order to provide technical support;

External interpreting services, so that we can communicate with you in a language you understand; and

Organisations that share our building including Homeless Health Service and Department of Work and Pensions.

We also regularly share your personal data (e.g. name, address, date of birth, CV) with external third parties for the purposes of helping you to submit forms, obtain documents, attend workshops, obtain doctor’s appointments etc. The third parties may include:

Employment training providers

Employers with work placement schemes

Providers of professional clothing and interview advice

Providers of life skills training and advice

Recruitment agencies

Major employers

Shelters and assessment centres

Temporary hostels

Providers of supported housing

Housing advisers

Estate agencies

Property managing services

Providers of social work and support services

Education and training providers

Homelessness outreach services

Specialist immigration services and immigration advisors

Hospital discharge services

Consulates and embassies

Statutory social services

Statutory healthcare providers

The most common ways in which we share your personal data with third parties are where:

You have given us your consent

We are under a legal duty to disclose or share your personal data (e.g. as part of a criminal investigation)

We are protecting the interests, rights and property of ourselves or others (e.g. when we make a mental health referral to the Joint Homelessness Team (JNT) – https://www.cnwl.nhs.uk/service/joint-homelessness-team or when we share data at multi-agency risk assessment conferences (MARACs) or multi-agency public protection arrangements (MAPPA) meetings)

The most common ways in which we share special categories of personal data are where:

you have given us your consent;

we have a substantial public interest, e.g.to prevent/detect a serious crime, or because of serious worries about your health;

it is necessary in connection with a legal claim, e.g. as part of a criminal investigation;

it is necessary to protect your vital interests or the vital interests of another person and you are incapable of giving consent.

In future, we may also need to share personal data with other legal entities, on a temporary or permanent basis, for the purposes of a collaboration, reorganisation, change of legal form, dissolution or similar event.

Exceptionally, we may wish to transfer your personal data outside the European Economic Area (EEA), for example, if you decided to return to a country outside the EEA and we wanted to make arrangements with local services. All of our third party suppliers store data on servers located within the EEA.

In some circumstances we may anonymise your personal data so that it can no longer be associated with you, in which case we may use and share such data without further notice to you.

5. How we use your personal data legally
We will only use your personal data when we are satisfied that it is fair and we can do so legally. Our legal bases for processing personal data may sometimes overlap and there may be several grounds which justify our use of your personal data.

When we use your personal data in the public interest or when we have a legitimate interest and we are satisfied that your interests and fundamental rights do not override that interest, we will use your personal data in the following ways:

to enable our staff (both on site and on the streets) to assess your situation and to suggest ways in which we may be able to assist you
to enable our staff to make applications, submit forms, obtain documents, buy tickets etc. on your behalf

to share your personal data with other members of our staff or volunteers, or with other organisations with whom we work closely (for example, the Passage, West London Mission)

to monitor and evaluate our services so that we can constantly improve them

to share safety concerns with external parties (e.g. the police, the NHS, social services) in order to protect our staff, clients, volunteers and/or third parties

to carry out any special research projects using data about clients or ex-clients

When it is necessary to perform a contract we have entered into with you, it will typically be for a tenancy agreement for a property that we own e.g. St. Martin’s House.

We will ask for your consent to:

keep copies of documents on your behalf (for example, correspondence, birth certificate, medical records)

pass your personal data to third parties in circumstances not otherwise covered in this privacy notice

use your personal data for publicity or promotional purposes (for example, materials promoting the work that we do)

Less commonly, we may use your personal data where we need to protect your vital interests (or someone else’s vital interests) or where it is necessary in order to comply with a legal obligation.

6. How we use your special categories of personal data legally

By law, we need to have an additional legal basis if we wish to process special categories of personal data. This means that we will only process such data in one of the following circumstances:

where there is a substantial public interest (for example: when we provide confidential counselling, advice or support to you; to monitor equality of treatment; or where we need to share data for the purposes of detecting and preventing unlawful acts)

in the course of our legitimate activities with service users who have regular contact with us and with appropriate safeguards in place (for example, to share data about your health with other members of our staff)

to provide health or social care or treatment to you with your explicit consent (for example, to share special categories of your personal data with third parties in circumstances not otherwise covered in this privacy notice)

Less commonly, we may process this type of personal data where it is needed in relation to legal claims or where it is needed to protect your vital interests (or someone else’s vital interests) and you are not capable of giving your consent.

7. Data Security
We have appropriate security measures in place to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

8. Data retention
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal or reporting requirements. We may extend or reduce our retention periods if we deem it necessary, for example, to defend legal proceedings or if there is an on-going investigation relating to the data.

9. Your rights
Under certain circumstances, by law you have the right to:

Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

Ask us to correct personal data that we hold about you which is incorrect, incomplete or inaccurate.

Ask us to erase your personal data from our files and systems where there is no good reason for us continuing to hold it.

Object to us using your personal data to further our legitimate interests (or those of a third party) or where we are using your personal data for direct marketing purposes.

Ask us to restrict or suspend the use of your personal data, for example, if you want us to establish its accuracy or our reasons for using it.

Ask us to transfer your personal data to another person or organisation.

If you want to access, correct or request restriction or erasure of your personal data, or to object to us using your personal data, or request that we transfer a copy of your personal data to another party, please contact info@cstm.org.uk in writing.

If we have requested your consent to process your data in a certain way, and you have given it to us, you still have the right to withdraw your consent at any time. To withdraw your consent, please speak to a member of staff or e-mail info@cstm.org.uk. Once we have received notification that you have withdrawn your consent, we will no longer process your personal data and, subject to our retention policy, we will dispose of your data securely.

You have the right to make a complaint at any time to the Data Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.

Recruitment of Employees Privacy Policy

This policy explains how and why The Connection at St Martin-in-the-Fields uses your personal information during the recruitment process.
This policy applies to all potential employees, who are going through the recruitment process. Please read it carefully to understand our practices regarding your personal information and how we will treat it.

This policy does not form part of any contract of employment or other contract to provide services. We may update this notice from time to time. When we refer to “we” or “us” in this policy we are referring to The Connection at St Martin-in-the-Fields. We are listed on the Information Commissioner’s register of data controllers under Registration Number Z7919091.

For the purposes of the Data Protection Act 1998, the General Data Protection Regulation (GDPR) and any applicable replacement legislation, we are the data controller.

Types of Information

When we use the term personal information we mean any personal data you give us from which you can be identified. This might include your name, your home address, your personal email contact details, or your telephone number. Personal information does not include information where your identity has been removed (i.e. anonymous data).

We use the term special categories of personal information to mean information about your race, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation.

We only ever use your personal data if we are satisfied that it is lawful and fair to do so. When we process your personal information, it will be because:

You have consented to the processing for the specific purposes described in this notice;

The processing is necessary to enter into, or perform, a contract with you;

In order to comply with a legal obligation; or

The processing is necessary in pursuit of a “legitimate interest”, a legitimate interest in this context means a valid interest we have or a third party has in using your personal data which is not overridden by your interests in data privacy and security.

We will only collect and use any special categories of personal information (information about your race, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation) where we have your explicit consent.

Information we collect about you

The organisation collects a range of information about you. This may include:

Data we collect and whether this is personal or sensitive data: Names, addresses, telephone numbers, email addresses (Personal Data)
What we use it for:
To contact you regarding a job application that you have made to us

Data we collect and whether this is personal or sensitive data: Application form (Personal Data)
What we use it for: To build a picture of your skills, experience and interests in order to assess your suitability for employment.

Data we collect and whether this is personal or sensitive data: References (Personal Data)
What we use it for:To assess your suitability for employment purposes

Data we collect and whether this is personal or sensitive data: Current salary details (Personal Data)
What we use it for: To help us assess your suitability for a paid employment role

Data we collect and whether this is personal or sensitive data: Your right to work in the UK (Personal Data)
What we use it for: To ensure that you are legally entitled to work in the United Kingdom

Data we collect and whether this is personal or sensitive data: Criminal Records Check (Personal Data)
What we use it for: For some roles, the organisation is obliged to seek information about criminal convictions and offences. Where the organisation seeks this information, it does so because it is necessary for it to carry out its obligations and exercise specific rights in relation to employment. This check will only be completed for the following reasons, and will not be completed without your explicit consent:
If the role is a regulated activity within the meaning of the Safeguarding Vulnerable Groups Act 2006. If we are legally required by the Charity Commission to carry out criminal records checks for those carrying out the role.
If the role requires a high degree of trust and integrity and we would like to ask you to seek an Enhanced disclosure of your criminal records history.

Data we collect and whether this is personal or sensitive data: Equal opportunities information (Sensitive Data)
What we use it for: This is for equal opportunities monitoring purposes to ensure meaningful equal opportunity monitoring and reporting where it may be needed in the public interest.

Data we collect and whether this is personal or sensitive data: Information on special requirements, health or medical conditions. (Sensitive Data)
What we use it for: To allow us to make any reasonable adjustments to allow you to effectively carry out the duties of your role, and to ensure we are meeting any health and safety obligations. This is not mandatory and will not affect any offer of employment.

Data we collect and whether this is personal or sensitive data: IP Addresses (Personal Data)
What we use it for: As an extra cyber security measure, we may log the IP address of the computer used to email us an application form as part of our registration process. This type of data does not normally identify an individual in the UK.

We collect the majority of this information directly from you during the application and recruitment process. We also sometimes collect additional information from third parties including former employers and other background check agencies including:
The Disclosure and Barring Service;
Publicly accessible data from the Insolvency Service, Companies House and/or the Charity Commission.

We only ever use your personal information if we are satisfied that it is lawful and fair to do so. We will never sell your personal information or share it with third parties who might use it for their own commercial purposes.

We will only disclose your personal information to third parties:

Where you have given us consent to share the information with the specific third party;

When we transfer personal information to Maitland Medical our occupational health provider;

Or to ONE Westminster, our DBS provider

Data Storage

Data will be stored in a range of different places, including on your application record, manual files and on other IT systems (including email).
If your application is unsuccessful, the organisation will keep your personal data on file for a period of 6 months to 1 year, and then this will be securely destroyed. You are free to withdraw your consent to this data being held at any time.
We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal information without your knowledge or consent where this is required or permitted by law. We will not transfer your personal information outside the European Economic Area (EEA) and all of our third party suppliers store information on servers located within the EEA.
In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use and share such information without further notice to you.

We only keep your personal information in a secure environment. Personal Data will only be used as set out in this Privacy Policy.

We hold data electronically in our secure document management system and on our on-site file servers, which are protected by both hardware and software firewalls.

We have off-site back-up servers in secure locations.

We encrypt all data stored on our servers with an industry standard encryption method that encrypts the data between your computer and our server so that in the event of your network being insecure no data is passed in a format that could easily be deciphered.

We regularly back up and encrypt all of the data we hold.

We store papers in lockable cabinets in our offices when not being actively used and we have a secure off-site document storage facility for archived papers.

Our offices are secure and only personnel holding appropriate security passes can access areas where personal data are stored.
When necessary, we dispose of or delete your data securely.

We ensure that our employees, agents and contractors are aware of their privacy and data security obligations and we take reasonable steps to ensure that employees of third parties working on our behalf are aware of their privacy and data security obligations.

We limit access to your personal information to those employees, agents, contractors and other third parties who have a need to know.

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Details of retention periods for different aspects of your personal information are contained in our retention policy which is available from Caroline Summerfield, Human Resources Manager.

These retention periods may be extended or reduced if required by applicable law or we deem it necessary, for example, to defend legal proceedings or if there is an on-going investigation relating to the information.
We review the personal data (and the categories of personal data) we hold on a regular basis to ensure the data we are holding is still required and is accurate. If we discover that certain data we are holding is no longer necessary or accurate, we will take steps to correct or delete the data.

Under certain circumstances, by law you have the right to:

Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it;

Ask us to correct personal information that we hold about you which is incorrect, incomplete or inaccurate;

Ask us to erase your personal information from our files and systems where there is no good reason for us continuing to hold it;

Object to us using your personal information to further our legitimate interests (or those of a third party) or where we are using your personal information for direct marketing purposes;

Ask us to restrict or suspend the use of your personal information, for example, if you want us to establish its accuracy or our reasons for using it;

Ask us to transfer your personal information to another person or organisation.

You also have rights in relation to automated decision making which has a legal effect or otherwise significantly affects you. You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces significant legal effects concerning you.

If you have any questions about this privacy policy or how we handle your personal information, please contact Caroline Summerfield, Human Resources Manager, 12 Adelaide Street, London, WC2N 4HW, or telephone 020 7925 7891.

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.

Recruitment of Volunteers Privacy Policy

This policy explains how and why The Connection at St Martin-in-the-Fields uses your personal information during the recruitment process.
This policy applies to all potential volunteers, who are going through the recruitment process. Please read it carefully to understand our practices regarding your personal information and how we will treat it.

This policy does not form part of any contract of employment or other contract to provide services. We may update this notice from time to time. When we refer to “we” or “us” in this policy we are referring to The Connection at St Martin-in-the-Fields. We are listed on the Information Commissioner’s register of data controllers under Registration Number Z7919091.

For the purposes of the Data Protection Act 1998, the General Data Protection Regulation (GDPR) and any applicable replacement legislation, we are the data controller.

Types of Information

When we use the term personal information we mean any personal data you give us from which you can be identified. This might include your name, your home address, your personal email contact details, or your telephone number. Personal information does not include information where your identity has been removed (i.e. anonymous data).

We use the term special categories of personal information to mean information about your race, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation.

We only ever use your personal data if we are satisfied that it is lawful and fair to do so. When we process your personal information, it will be because:

You have consented to the processing for the specific purposes described in this notice;

In order to comply with a legal obligation; or

The processing is necessary in pursuit of a “legitimate interest”, a legitimate interest in this context means a valid interest we have or a third party has in using your personal data which is not overridden by your interests in data privacy and security.

We will only collect and use any special categories of personal information (information about your race, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation) where we have your explicit consent.

Information we collect about you

The organisation collects a range of information about you. This may include:

Data we collect and whether this is personal or sensitive data: Names, addresses, telephone numbers, email addresses (Personal Data)
What we use it for: To contact you to discuss volunteering opportunities, or to keep you updated on our services or activities and events.

Data we collect and whether this is personal or sensitive data: Application form (Personal Data)
What we use it for: To build a picture of your skills, experience and interests in order to assess your suitability for volunteering opportunities.

Data we collect and whether this is personal or sensitive data: References (Personal Data)
What we use it for: To assess your suitability for to volunteer with us.

Data we collect and whether this is personal or sensitive data: Passport Information (Personal Data)
What we use it for: To identify you as a volunteer

Data we collect and whether this is personal or sensitive data: Criminal Records Check (Personal Data)
What we use it for: For some roles, the organisation is obliged to seek information about criminal convictions and offences. Where the organisation seeks this information, it does so because it is necessary for it to carry out its obligations and exercise specific rights in relation to safeguarding. This check will only be completed for the following reasons, and will not be completed without your explicit consent.
If the role is a regulated activity within the meaning of the Safeguarding Vulnerable Groups Act 2006. If we are legally required by the Charity Commission to carry out criminal records checks for those carrying out the role.
If the volunteering role requires a high degree of trust and integrity and we would like to ask you to seek an enhanced disclosure of your criminal records history.

Data we collect and whether this is personal or sensitive data: Information on special requirements, health or medical conditions. (Sensitive Data)
What we use it for: To assess your suitability for volunteering, ensuring that we carry out our legal obligations e.g. ensuring your health and safety.

Data we collect and whether this is personal or sensitive data: IP Addresses (Personal Data)
What we use it for: As an extra cyber security measure, we may log the IP address of the computer used to email us an application form as part of our registration process. This type of data does not normally identify an individual in the UK.

We collect the majority of this information directly from you during the application and recruitment process. We also sometimes collect additional information from third parties including former employers and other background check agencies including the Disclosure and Barring Service.

We only ever use your personal information if we are satisfied that it is lawful and fair to do so. We will never sell your personal information or share it with third parties who might use it for their own commercial purposes.

We will only disclose your personal information to third parties:

Where you have given us consent to share the information with the specific third party;

Or to ONE Westminster our DBS provider

Data Storage

Data will be stored in a range of different places, including on your application record, manual files and on other IT systems (including email, and a password protected database).

If your application is unsuccessful, the organisation will keep your personal data on file for a period of 6 months to 1 year, and then this will be securely destroyed. You are free to withdraw your consent to this data being held at any time.

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
Occasionally full names of volunteers and their contact details will be passed to our reception team if volunteers are going to be engaged in an activity outside the building of The Connection at St Martin in-the-Fields.

Please note that we may process your personal information without your knowledge or consent where this is required or permitted by law. We will not transfer your personal information outside the European Economic Area (EEA) and all of our third party suppliers store information on servers located within the EEA.
In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use and share such information without further notice to you.

We only keep your personal information in a secure environment. Personal Data will only be used as set out in this Privacy Policy.

We hold data electronically in our secure document management system and on our on-site file servers, which are protected by both hardware and software firewalls.

We have off-site back-up servers in secure locations.

We encrypt all data stored on our servers with an industry standard encryption method that encrypts the data between your computer and our server so that in the event of your network being insecure no data is passed in a format that could easily be deciphered.

We regularly back up and encrypt all of the data we hold.

We store papers in lockable cabinets in our offices when not being actively used and we have a secure off-site document storage facility for archived papers.

Our offices are secure and only personnel holding appropriate security passes can access areas where personal data are stored.

When necessary, we dispose of or delete your data securely.

We ensure that our employees, agents, contractors and volunteers are aware of their privacy and data security obligations and we take reasonable steps to ensure that employees of third parties working on our behalf are aware of their privacy and data security obligations.

We limit access to your personal information to those employees, agents, contractors and other third parties who have a need to know.

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Details of retention periods for different aspects of your personal information are contained in our retention policy which is available from Caroline Summerfield, Human Resources Manager.

These retention periods may be extended or reduced if required by applicable law or we deem it necessary, for example, to defend legal proceedings or if there is an on-going investigation relating to the information.
We review the personal data (and the categories of personal data) we hold on a regular basis to ensure the data we are holding is still required and is accurate. If we discover that certain data we are holding is no longer necessary or accurate, we will take steps to correct or delete the data.

Under certain circumstances, by law you have the right to:

Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.

Ask us to correct personal information that we hold about you which is incorrect, incomplete or inaccurate.

Ask us to erase your personal information from our files and systems where there is no good reason for us continuing to hold it.

Object to us using your personal information to further our legitimate interests (or those of a third party) or where we are using your personal information for direct marketing purposes.

Ask us to restrict or suspend the use of your personal information, for example, if you want us to establish its accuracy or our reasons for using it.

Ask us to transfer your personal information to another person or organisation.

You also have rights in relation to automated decision making which has a legal effect or otherwise significantly affects you. You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces significant legal effects concerning you.
If you have any questions about this privacy policy or how we handle your personal information, please contact Caroline Summerfield, Human Resources Manager, 12 Adelaide Street, London, WC2N 4HW, or telephone 020 7925 7891.

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.