Data Protection Policy

TRUSTEE GUIDELINES FOR USE OF PERSONAL INFORMATION AND DATA PROTECTION

Background

The purpose of this policy is to ensure that the Shabbington Village Community Trust provides appropriate protection for the storage and use of personal data held in compliance with the Data Protection Act 1988 (DPA) and the General Data Protection Regulations (GDPR) 2018.

The EU General Data Protection Regulation (GDPR) 2018 will apply from 25 May 2018, when it supersedes the UK Data Protection Act 1998. The new law expands the rights of individuals to control how their personal data is collected and processed and places a range of new obligations on organisations to be more accountable for data protection. GDPR compliance demands that we are able to demonstrate compliance with its data processing principles. This involves taking a risk-based approach to data protection, ensuring appropriate policies and procedures are in place to deal with the transparency, accountability and individuals’ rights provisions, as well as building a workplace culture of data privacy and security.

Introduction

Shabbington Village Community Trust recognises the importance of protecting the personal information we collect and how this is handled within the organisation.

By adhering to the legal obligation guidelines laid down in the Data Protection Act 1998 and the EU General Data Protection Regulation (GDPR) 2018 we should meet our legal obligations.

These guidelines are intended for staff and trustees to be aware of, regarding the collection and use of personal data. Shabbington Village Community Trust encourages and promotes a culture of understanding of the importance of security of personal data within the organisation.

Important items to remember

We must have CONSENT from people in order to send them “Direct Marketing” emails – this includes our newsletters and any potential future fundraising appeal requests.
We can contact people such as funders/funding bodies using work email addresses that are publicly available on the grounds of “Legitimate interest” but we need to assess each case and have an evidence trail of how we have selected that reason.
We can contact people who have attended events, such as training on a previous occasion to invite them to attend similar events.
All current database lists must be reviewed regularly and information added about the data protection we have considered, including a date for deletion.
Any contact lists held by SHABBINGTON VILLAGE COMMUNITY TRUST staff (ie on an excel spreadsheet) must include a tab for data protection, showing the decisions made and the length of time we will keep the list.
Individuals have the right to see a copy of the information we hold and the right to request we delete it completely from our records. Requests for access to data and data deletion must be responded to within 20 days.
SHABBINGTON VILLAGE COMMUNITY TRUST will not sell or pass on any personal information records to any other organisation/partner/associate unless we have consent to do so.
SHABBINGTON VILLAGE COMMUNITY TRUST will review the data it holds according to the company Data Protection Risk Assessment – see appendix at end of this paper – and review contact lists and consents as needed.
Staff are encouraged to familiarise themselves with the GDPR legal requirements and can find various free webinar courses to do so.

All individuals being contacted by SHABBINGTON VILLAGE COMMUNITY TRUST must be given an opt-out/unsubscribe option.
Personal data also includes photographs – there is a consent form at the end of this document that should be completed whenever you acquire a photograph from an associate or member of the public, so that we may use it/them in promotional work – whether the website/newsletters/printed leaflets/posters or reports.
Permission for taking photographs of people – it should be best practice to ask consent of attendees to any SHABBINGTON VILLAGE COMMUNITY TRUST event and if these attendees are under 18 signed consent from the parent or guardian should be obtained. There are further notes on photography consent at the end of this document.
Keeping records is very important in case we are audited or investigated – we must be able to prove consent was given or why we decided not to get consent (such as legitimate interest). If you are unsure you must talk to SHABBINGTON VILLAGE COMMUNITY TRUST management before you proceed.
Security of personal data must be taken seriously by all SHABBINGTON VILLAGE COMMUNITY TRUST staff – computer passwords must be strong and should be changed regularly – ideally all files should be kept on the secure cloud storage system.
Any accidental loss of personal data must be reported to SHABBINGTON VILLAGE COMMUNITY TRUST management as soon as possible.
The SHABBINGTON VILLAGE COMMUNITY TRUST Data Protection team currently consists of Jill Hughes

Terms to recognise

Direct Marketing – any communication that tries to sell/promote the organisation.
Admin – communications business to business such as organising a meeting.
Consent – permission to contact.
Legitimate Interest – can be used as the reason to contact people such as funders.
Personal data – email addresses, phone numbers, postal addresses, photographs.

Further information

We are committed to the Eight Data Protection Principles:

Personal data will be processed fairly and lawfully.
Personal data will be obtained only for the purpose specified.
Data will be adequate, relevant and not excessive for the purposes required.
Personal data records will be accurate and kept up-to-date.
Personal data will not be kept for longer than is necessary for purpose, the charity will establish appropriate retention periods for personal data.
Data will be processed in accordance with the rights of data subjects under this act.
Security: appropriate technical and organisational measures will be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction or damage to personal data.
Personal data shall not be transferred outside the European Economic Area unless that country or territory ensures an adequate level of data protection.

What are the lawful bases for processing/using personal data?

The lawful bases for processing are set out in Article 6 of the GDPR. At least one of these must apply whenever you process personal data:

Consent: the individual has given clear consent (which you can prove) for you to process their personal data for a specific purpose.

Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract

Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations).

Vital interests: the processing is necessary to protect someone’s life.

Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.

Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.)

Email footer required for admin emails

**YOUR NAME**
Shabbington Village Community Trust **YOUR JOB TITLE**

Your phone number
Shabbington Village Community Trust, 19 Marsh Road, Shabbington HP189HF

If you would prefer not to be contacted by Shabbington Village Community Trust again in the future about events or meetings please reply to this email using the subject line of UNSUBSCRIBE and we will remove your details from our list.

Contact list data protection tab:

When compiling a list of individual contacts, such as for an event must include a tab for data protection, showing the decisions made and the length of time we will keep the list.

It is IMPORTANT that when you email contacts on your contact list you use the blind copy function bcc to ensure you are not sharing everyone’s addresses.

At least the following:

Data Protection Information
Name of list	EXAMPLE
Reason for list	EXAMPLE
Lawful basis of processing	EXAMPLE
SHABBINGTON VILLAGE COMMUNITY TRUST lead	EXAMPLE
List start date	EXAMPLE
List end date	EXAMPLE
List expiry and deletion date	EXAMPLE
Where will this data be stored	EXAMPLE SHABBINGTON VILLAGE COMMUNITY TRUST password secured laptop
Copy of email/contact sent
Personal data needed for task	EXAMPLE Email address, Job title, company and phone number

Shabbington Village Community Trust – Photo consent form

(Data Protection Act 1998)

We (Shabbington Village Community Trust – SHABBINGTON VILLAGE COMMUNITY TRUST) would like to keep your photograph(s)/film on file to use in our communications work as it is fantastic and we would like your consent to do so.

The photograph(s)/film may be used on our website www.rivertahme.org or our social media sites (Facebook and Twitter), within our eNewsletters, adverts, funding applications or within printed leaflets, posters and reports.

SHABBINGTON VILLAGE COMMUNITY TRUST are happy to copyright the photo(s)/film to you whenever used if requested.

Your personal information will not be used for any other reason other than contact over your photograph(s).

Conditions of use

This consent is valid for 5 years (60 months).
SHABBINGTON VILLAGE COMMUNITY TRUST will not use the photograph(s) or film for any other purposes than those mentioned above.
SHABBINGTON VILLAGE COMMUNITY TRUST will not include personal details (such as postal/email address or phone number) on our website, printed materials or other marketing/promotional materials.

DATE
NAME
CONTACT EMAIL
CONTACT TELEPHONE
CONTACT ADDRESS (optional)
PHOTOGRAPH(S) COPYRIGHT
DO YOU GIVE SHABBINGTON VILLAGE COMMUNITY TRUST CONSENT?	YES	NO
ARE YOU OVER 18 YEARS OLD?	YES	NO
SIGNATURE

Shabbington Village Community Trust – Photo consent explained

Obtaining consent

In order to ensure compliance with Data Protection, when photographing an individual or a group of individuals, SHABBINGTON VILLAGE COMMUNITY TRUST should obtain the written consent of the person(s) being photographed. In the case of children or minors (under 18 years) the permission of the parent, guardian or carer will need to be obtained. The photographed person should be made aware of why we are using that photo, what the photo will be used for and who could potentially look at their image. Once a photograph has been taken it’s important that the photo is only used for the purposes described.

When written consent is not needed

If it is reasonable to assume that the person is aware that their photograph may be published and that neither the photograph itself nor the context in which it is used could cause any potential harm or distress to that person.
Where the individual photographed is unrecognisable e.g. if they have their back to the camera, or they appear out of focus in the foreground of a photograph while the camera zooms in on object in the background.

Events

Where photographs are being taken at an event attended by large crowds within a public area, such as a sports event or a festival, the consent of all the attendees is not necessary.

If photographs are being captured at an event attended by large crowds within a private area, such as a private party, conference or project event – it is advisable that the attendees are informed of the presence of photographers. This could be made apparent on the event invitation, or by displaying appropriate notice signs at the event. The notice should identify the photographer(s) (i.e SHABBINGTON VILLAGE COMMUNITY TRUST staff), list how the photographs will be used and that people should make themselves known if they do not want to appear in publicity materials.

Withdrawal of consent

Consent must be freely given and as such people have the right to change their mind. If somebody asks for their photograph not to be used, SHABBINGTON VILLAGE COMMUNITY TRUST must stop using the image in all new publicity.

Children or minors

Extra care should be taken when photographing children and minors. Where the child is identifiable, specific parental consent is needed. This applies even where photos are being taken at an event as it not appropriate to rely on notices which children may not fully understand the implication of. If it is not possible to obtain parental consent, for instance at an open event where pre-registration is not required, then the ability to take and use any photographs will be restricted where a child is identifiable. Furthermore, even though it may appear that the child will not be identifiable, a school uniform, for example, might make them identifiable. A parental consent form follows these notes.

Shabbington Village Community Trust – Parental consent form

(Data Protection Act 1998)

We (Shabbington Village Community Trust – SHABBINGTON VILLAGE COMMUNITY TRUST) would like to take photographs/video of your child/children during this event/workshop/training day to use in our communications work.

The photograph(s)/film may be used on our website www.riverthame.org or our social media sites (Facebook and Twitter), within our eNewsletters, adverts, funding applications or within printed leaflets, posters and reports.

Your personal information will not be used for any other reason other than contact over the photograph(s).

Conditions of use

This consent is valid for 5 years (60 months).
SHABBINGTON VILLAGE COMMUNITY TRUST will not use the photograph(s) or film for any other purposes than those mentioned above.
SHABBINGTON VILLAGE COMMUNITY TRUST will not include personal details (such as postal/email address or phone number) on our website, printed materials or other marketing/promotional materials.
You have the right to contact SHABBINGTON VILLAGE COMMUNITY TRUST at any point to request we stop using images of your child/children.

DATE
NAME
CHILD/CHILDREN NAME(S)
CONTACT EMAIL
CONTACT TELEPHONE
CONTACT ADDRESS (optional)
SIGNATURE

Shabbington Village Community Trust staff personnel information

SHABBINGTON VILLAGE COMMUNITY TRUST collect a variety of personal data on staff members and trustees

This data includes:

Home address
Phone number
Personal email address
Bank account details
National Insurance Number
Date of Birth
Gender
Payroll details (digitally)
Signed contract and review forms
Application form
Emergency contact information
Sickness records
H&S forms including car details & licence if applicable

This information is kept digitally on password protected systems – Microsoft Office.365 and Xero SHABBINGTON VILLAGE COMMUNITY TRUST laptops/hard drives.

Upon completion of staff contracts or their resignation – staff personnel files will be kept for 7 years (84 months) due to legal requirements. All information will then be destroyed.

Appendix – SHABBINGTON VILLAGE COMMUNITY TRUST Data Protection Risk Register

SHABBINGTON VILLAGE COMMUNITY TRUST Data Protection Risk Assessment – April 2018

Activity	Direct Marketing or Admin	Channel	Consent?	Get out/Unsubscribe option	Proof	Expiry
Catchment Hosting
Newsletters	Direct Marketing	Mailchimp	Consent	Yes – throughMailchimp	Opt In	48 months
Training event/project contact list	Admin	Email	Legitimate Interest	Yes – through email footer	Email trail	48 months
Donation processing	Admin	Donor Strategy/ Email	Legitimate Interest	Yes – through email footer	Sign up	36 months
Professional meetings	Admin	Email	Legitimate Interest	Yes – through email footer	Business email	36 months
Trustee/AGM meetings and company info	Admin	Email	Legitimate Interest	Yes – through resignation	CEO of SHABBINGTON VILLAGE COMMUNITY TRUST	48 months
Photographs for publications	Admin	Email	Consent	Yes – through email footer	Email trail	36 months
Major donors or funders	Direct Marketing	Email	Legitimate Interest	Yes – through email footer	Email trail	60 months