1. Aims of the policy
The primary aims of this policy are:
- To explain what personal data are collected by AHAG and how these data are used
- To specify how AHAG respects privacy when dealing with personal data collected by the organisation
Employees, Trustees and volunteers must ensure that they respect privacy when dealing with personal data.
2. Reasons for collecting personal data
AHAG collects personal data for many reasons, including to provide clients with advice or support, to communicate with clients, to send clients information they have requested and to administer fundraising campaigns and donations. Depending on how individuals interact with AHAG, personal data may be processed for the following reasons:
- To provide advice or support that has been referred to or requested
- To record personal details shared during telephone conversations with staff or volunteers
- To administer housing support services provided to clients
- To communicate AHAG’s work and fundraising activities
- To process donations and administer Gift Aid information
- To manage an individual’s communication preferences
- To process job applications/volunteer applications
- To comply with applicable laws and regulations, and requests from statutory agencies.
3. Personal data collected and collection routes
3.1 Personal data collected
AHAG collects the following personal data:
- Full name
- Contact details – including postal address, telephone numbers and email address
- Date of birth
- Case details when providing housing advice or services
- Payment details
- Records of correspondence and engagement with AHAG
- Donation history and Gift Aid details
- Occupation
- Biographical information
- Photos, videos and audio recordings
- Other information shared with AHAG.
AHAG sometimes also collects sensitive, personal data about individuals. This includes information about health, religion, sexuality, ethnicity and criminal records. Such information will normally only be recorded where an individual has given explicit consent, unless AHAG is permitted to do so in other circumstances under data protection law.
3.2 Personal data collection
Personal data may be collected via:
- Paper forms completed by clients or AHAG staff or volunteers
- Telephone conversations or face to face conversations with AHAG staff or volunteers
- Email communication with AHAG staff
- Third-party companies and websites such as Just Giving or CAF Donate
- Communication via social media
- On-line chat
4. Using personal data
4.1 AHAG support and advice services
If a client is receiving advice, guidance or support from AHAG, their personal data will have to be processed because of their specific relationship with AHAG.
All case information – including notes, letters and information given to AHAG about a client – will be kept in a confidential record that is specific to the client. AHAG uses a spreadsheet system to support its advice and support. This means that AHAG can keep the information a client provides so the case history and relevant details can be seen. This ensures that AHAG can provide appropriate and accurate advice or support.
AHAG takes data security very seriously. No one is allowed access to AHAG systems or files unless they need this to provide the service to a client or one of the other purposes discussed in this policy. AHAG may use client data for statistical reports. These statistics will not include any information that could be used to identify any individual.
4.2 Fundraising and marketing
AHAG would like to keep people up to date with fundraising and marketing activities. A variety of channels are used to contact supporters, including the AHAG website, face to face fundraising, social media and email. Consent is obtained before individuals are contacted by email for marketing purposes.
The following marketing materials may be sent out:
- Updates and newsletters about AHAG’s work
- Appeals and fundraising activities – including requests for monetary donations or donations of goods
- Events
- Volunteering opportunities.
Personal data will never be shared or sold to a third-party organisation. Consent can be withdrawn or communication preferences updated at any point by contacting AHAG at info@ahag.org.uk or by calling AHAG on 01296 435026.
4.3 Administrative communications
In addition to fundraising and marketing communications, AHAG may also communicate by post, telephone, and email in relation to administrative and transactional matters. For example, there may be occasions where AHAG needs to contact an individual about their donation e.g. if there is a problem with a payment or in relation to a Gift Aid declaration.
4.4 Applying for a job/volunteering opportunity with AHAG
When applying for a job with AHAG, personal data will be collated to monitor the progression of the application, and the effectiveness of the recruitment process through the statistics collected. Where the data need to be shared – such as for gathering references or obtaining a Disclosure and Barring Services check (depending on the role) – the applicant will be informed beforehand, unless the disclosure is required by law. These checks/reference requests are only done after a position has been offered to the successful candidate.
Personal data about unsuccessful applicants are held for 12 months after the recruitment exercise is complete for that vacancy. An applicant, can ask AHAG to remove their data before this time if they do not want them to be held.
Once a successful applicant has taken up employment, a file relating to their employment is compiled. The information contained in this file is kept secure and is only used for purposes directly relevant to employment. Once employment with AHAG has ended the file is retained in accordance with the requirements of AHAG’s Data Retention Policy and then deleted.
5. Website and social media – Cookies and links to other sites
Our website and social media may include links to other websites. We are not responsible for the privacy policy and practices of these sites.
A ‘cookie’ consists of a small piece of information downloaded onto a computer and stored in the user’s web browser. These data are sent back to the website every time the user accesses the website. Users may disable cookies or delete any individual cookie through controls in their web browser. In these circumstances the site may not work as intended.
AHAG’S website uses cookies in order to provide a good experience for users of the site.
6. Legal basis for processing personal data
AHAG is required to have a lawful basis to collect and use personal data under data protection law. The law allows for 6 ways to process personal data (and additional ways for sensitive personal data). Four of these are relevant to the types of processing that AHAG carries out. This includes data that are processed on the basis of:
- A person’s consent (for example, to send direct marketing by email)
- Processing that is necessary for compliance with a legal obligation (for example to process a Gift Aid declaration)
- Legitimate interests (please see below for more information).
Personal data may be legally collected and used if it is necessary for a legitimate interest of the organisation using the data, if their use is fair and does not adversely impact the rights of the individual concerned.
When using personal data, AHAG will always consider if it is fair and balanced to do so and if it is within reasonable expectations. Individual rights will be balanced against AHAG’s legitimate interests to ensure that personal data are used in ways that are not unduly intrusive or unfair. AHAG’s legitimate interests include:
- Charity Governance: including delivery of charitable purposes, statutory and financial reporting and other regulatory compliance purposes
- Administration and operational management: including responding to solicited enquires, providing information, the administration of volunteers and employment, and recruitment requirements
- Fundraising and marketing: including administering fundraising campaigns and donations, sending thank you letters and maintaining communication suppressions and preferences.
7. Disclosure of personal data
Personal data are only passed to third parties in the following circumstances:
- Explicit consent has been given to pass data to a named third-party
- It is necessary to protect the vital interests of an individual
- A third-party is being used for the purposes of processing data on AHAG’s behalf and a data processing agreement is in place with that third-party that fulfils AHAG’s legal obligations in relation to the use of third-party data processors
- AHAG is required by law to share the personal data.
In addition, AHAG will only pass personal data to third-parties outside of the EU where appropriate safeguards are in place as defined by Article 46 of the General Data Protection Regulation. AHAG will never share or sell personal data to a third-party organisation for marketing, fundraising, or campaigning purposes.
8. Security of personal data
AHAG uses appropriate technical and organisational measures and precautions to protect personal data and to prevent the loss, misuse or alteration of personal data. Unfortunately, the transmission of information via the internet is not completely secure. Although AHAG will do its best to protect personal data, it cannot guarantee the security of data transmitted to the AHAG website. Once personal data has been received, AHAG will use strict procedures and security features to try to prevent unauthorised access.
9. Retention of personal data
Whatever an individual’s relationship with AHAG, their personal data will only be stored for a specified amount of time, as set out in the Data Retention Policy. The length of time that data are kept may depend on the reasons for which they are being processed and on the law, or regulations that the data fall under, such as financial regulations or any contractual obligations AHAG might have e.g. with grant funders.
Subject to the above, AHAG will typically store personal data relating to donors for 7 years after their last donation or interaction, and data relating to people to whom the charity provides advice and support services for 7 years after completion of those services. Personal data about unsuccessful applicants are held for 12 months after the recruitment exercise is complete for that vacancy.
Once the retention period has expired, the data are disposed of confidentially or permanently deleted. If an individual requests no further contact, AHAG will keep some basic data on a suppression list to avoid sending unwanted materials in the future.
10. Rights an individual has over their data
A full summary of an individual’s legal rights over their personal data can be found on the Information Commissioner’s website: https://ico.org.uk/. These rights include the following:
-
Right of access
An individual has the right know what data are held about them and to ask, in writing, to see their records. AHAG will supply any data requested as soon as possible, but this may take up to 30 days. There will be no charge for this other than in exceptional circumstances. Proof of identity will be required, as the person dealing with the request may not be a staff member met before. AHAG needs to be sure that personal data are only released to the correct individual. This is called a data subject access, and can be done by:
- Emailing info@ahag.org.uk
- Writing to the Data Protection Manager, c/o Aylesbury Homeless Action Group, 2, Rickfords Hill, Aylesbury, HP20 2RX
-
Right to be informed
An individual has the right to be informed how their personal data are used. This policy, as well as any additional information or notice that is provided either at the time the personal details were provided, or otherwise, is intended to provide this information.
-
Right to withdraw consent
Where personal data based on consent are processed (for example, to send marketing texts or emails), consent can be withdrawn at any time. To do this, or to discuss this right further, AHAG should be contacted using the details in the ‘Contact us’ section below.
-
Right to object
An individual has a right to object to AHAG processing data where it is relying on the data being within AHAG’s legitimate interests to do so. To do this, or to discuss this right further, AHAG should be contacted using the details in the ‘Contact us’ section below.
-
Right to restrict processing
In certain situations, an individual has the right to ask for processing of their personal data to be restricted because there is some disagreement about their accuracy or legitimate usage.
-
Right of erasure
In some cases, an individual has the right to be forgotten (i.e. to have their personal data deleted from the AHAG database). Where a request is made to stop sending marketing materials, some limited data has to be kept by AHAG to ensure that there is no future contact.
-
Right of rectification
If an individual believes their AHAG records are inaccurate, they have the right to ask for those records to be updated. To update records, AHAG should be contacted using the details in the ‘Contact us’ section below.
-
Right to data portability
Where AHAG is processing personal data because consent to do so has been given, an individual has the right to request that the data are transferred from one service provider to another.
11. Contact Us
To access the rights listed above, or any other legal rights an individual has over their data under current legislation, they should contact AHAG. However, it is important note that relying on some of these rights, such as the right to delete personal data, will make it impossible for AHAG to continue to deliver some services. However, where possible AHAG will always try to allow the maximum access to an individual’s rights while continuing to deliver as many services to them as possible.
If an individual has any questions about this policy or want to exercise any of the rights set out in section 10 above, they can contact AHAG in the following ways:
- info@ahag.org.uk
- 01296 435026