Privacy notice

M&DCVS Privacy Notice

Version 2: 8th June 2018

Privacy Statement

Maldon and District CVS (MDCVS) is committed to conducting its business in accordance with all applicable Data Protection legislation. In our Data Protection Policy we outline this commitment including the rights of individuals under the GDPR. This policy is available on request at anytime.

In order to help people who use our services to understand how and why personal data is collected, used and stored we have prepared this Privacy notice. The notice is broken down into sections which relate to each area of our service. These sections will be made available to individuals when they sign up to use those services and the full Privacy Notice available on request and on the MDCVS website www.maldoncvs.org.uk

Who we are

Maldon and District Community Voluntary Service (MDCVS) is a registered charity (1086460) and a company limited by guarantee (4170241) working to support a thriving third sector in the governmental district of Maldon and surrounding area.

Our services include support to local charities and community groups as well as direct services to members of the public through project delivery.

Our office base is:

Unit 1a Benbridge Industrial Estate
The Square
Holloway Road
Heybridge
Essex
CM9 4ER

Contact can be made via post to the above address or

Telephone 01621 851891
Email: admin@maldoncvs.org.uk
Website: www.maldoncvs.org.uk

Get in touch

We hope that the obligations outlined in this Privacy Statement help you to understand how we process your data, however if you do have any questions about anything in this statement or about our data protection processes

Please contact the MDCVS Director, Sarah Laskar, on sarah@maldoncvs.org.uk or 01621 851891.

Data we collect

MDCVS holds different data depending on which area of our services you have accessed.

  1. MDCVS and Volunteer Centre Membership
  2. Disclosure and Barring Service
  3. Volunteer Centre Customers
  4. Maldon Active Support Team
  5. Essex Shed Network
  6. Blokes
  7. Photographs
  8. Event Attendees
  9. MDCVS Staff and Volunteers

1: MDCVS and Volunteer Centre Membership

Data about local organisations is maintained on our electronic database, VC Connect or Volunteer Essex, and includes the contact details of staff and volunteers within those organisations. This data is collected when an organisation registers with us and completes an organisation registration form.

The above is considered by MDCVS Trustees to be Business Contacts and therefore not subject to the General Data Protection Regulation (GDPR). The Trustees are however committed to good practice and will endeavour to ensure the same privacy and security settings that are followed for personal data are applied to the above.

Full details can be found in the MDCVS Data Protection Policy available on request.

Data Processing
MDCVS utilises online Customer Relationship Management (CRM) Systems for both the Volunteer Centre and CVS member database.

Volunteer Essex: Online system is provided by PipeMedia and a written data processing contract is in place confirming that as our data processor they understand their responsibilities and liabilities and are committed to their obligations under the GPDR.

MDCVS Membership: Online system is provided by VC Connect (Voluntary Action Sheffield). VC Connect is compliant with its responsibilities in relation to Data Protection Legislation enabling recording of consent. Their up to date Privacy Statement will be available in April 2018.

2: Disclosure and Barring Service (DBS)

Data about organisations using our DBS service including named people within the organisation who carry out the role of evidence checker. This data is collected when organisations sign up to use our services.

The above is considered by MDCVS Trustees to be Business Contacts and therefore not subject to the General Data Protection Regulation (GDPR). The Trustees are however committed to good practice and will endeavour to ensure the same privacy and security settings that are followed for personal data are applied to the above.

Full details can be found in the MDCVS Data Protection Policy available on request.

Data processing
Through the process of signing up to use our service organisations sign a Data Processing Contract with us outlining our commitment to our obligations as a data processor.

DBS Applicants
In our role as a DBS Umbrella body, personal data about individuals is processed on behalf of customers. Collection, retention and storage of this data are covered under the Data Processing Contract in place with each customer.

If you are a data subject who we have processed personal data on for an organisation and have a query about how this data is used please contact the organisation direct.

MDCVS will comply with any requests from your data controller in relation to your individual rights but can only act on the written request of the data controller.

3: Volunteer Centre Customers

Where will we collect your data?

Personal data for people who have expressed an interest in volunteering in the local area is collected online through the Volunteer Essex website, through the completion of a Volunteer Centre Registration form or by telephone.

What information will be collected?

This form will request

Demographic data is classed as “special categories of personal data“ and is optional.

How will we use your data?
Brokerage service
Your contact details will be used to communicate with you about volunteering opportunities, particularly those that you have expressed an interest in or chosen to pursue. Information is recorded and retained in order to fulfil the organisational objective of matching local people with volunteering roles and this has been categorised as a legitimate business aim for MDCVS.

Monitoring our service
Special Categories of personal data are collected in order for us to understand the demography of people who are interested in volunteering in the local area. This information as an anonymised report may be shared with our funders or collated with similar data from other Essex based Volunteer Centres. This data is optional and you can choose not provide this data when registering.

If you have provided this information but would like it to be removed, please let us know.

Information relating to the work we carry out with you including content of emails, volunteering roles you enquire about and are placed with is also stored to help us to monitor our service.

Sharing data
Customer contact details may be shared with a third party namely a local volunteer involving organisation in order to facilitate the brokerage of a volunteering role. This will only happen once you have given consent for your information to be shared. The information that is shared will be no more than the information provided on your original registration. Consent is obtained when you sign up with the Volunteer Centre and we will check with you for each individual referral.

Staying in touch
From time to time we send out information on the Volunteer Centre, this includes new opportunities, events and volunteering news. To receive this information you must opt into our mailing lists when you register with us or you can let us know subsequently by email or phone.

You can opt out of receiving these up dates at anytime by contacting the Volunteer Centre.

We sometimes use Mailchimp to send out our mailing. Mailchimp is an online platform that enables organisations to manage mailing lists and send out electronic mail shots. Because Mailchimp is based in the USA it has a Privacy Shield framework which is recognised as providing adequate protection for personal data and complies with the regulations set out in General Data Protection Regulation (GDPR).

If you would like to know more about how Mailchimp complies with data protection legislation visit https://kb.mailchimp.com/binaries/content/assets/mailchimpkb/us/en/pdfs/mailchimp_gdpr_sept2017.pdf

If you don’t wish to receive emails through this route you will be able to opt out at the footer of each email or you can let us know by contacting the Volunteer Centre.

How do we store your data?
Data is stored in our online database called Volunteer Essex. This database is provided by PipeMedia and we have a data processing contract in place with them which ensures that they comply with data protection legislation.

No personal data is stored outside the Volunteer Essex database.

Registration forms are securely disposed of once data has been transferred onto the Volunteer Essex database.

How long do we keep data?
We put together reports on our services and customers on an at least annual basis. This information is required by our funders and to help us design services for the future. For this reason data is retained on the Volunteer Essex database.

When you register with the Volunteer Centre you will be an “active” volunteer.  This means we are actively working with you to identify a volunteering role and to keep you informed about volunteering.

Once you have been placed as a volunteer and we are happy that you need no further support from the Volunteer Centre you will become an “inactive” volunteer. You will also be marked as “inactive” if you advise us that you no longer wish to volunteer or if we do not hear from you after three attempts to get in touch.

Inactive volunteers do not receive any contact from us unless you first initiate it.

Data on inactive volunteers is kept for no more than twenty four months and in that time will be used to populate reports.

Reports that contain anonymised data and statistics are retained indefinitely but do not contain any information that can be linked to an identified individual and therefore are not subject to the GDPR.

Who can access my data?
The Volunteer Essex database is password protected and only staff who work on the Volunteer Centre can access the data held within it. This includes, but is not limited to, the Volunteer Centre coordinator, the MDCVS Director and admin staff.

4. Maldon Active Support Team

Where will we collect your data?
Personal data for people who access the services of our Maldon Active Support Team (MAST) is collected through an application or referral form.

What information will be collected?

Demographic data is classed as “special categories of personal data “and is optional.

How will we use your data?

Support service
Your contact details will be used to communicate with you about getting involved in community activities, particularly those that you have expressed an interest in or chosen to pursue.

Monitoring our service
Special Categories of personal data are collected in order for us to understand the demography of people we support. This information as an anonymised report may be shared with our funders. You do not have to provide this information and will be able to choose when you register with us.

If you have provided this information but would like it to be removed, please let us know.

Information relating to the work we carry out with you including content of emails, activities you enquire about and are placed with is also stored to help us to monitor our service.

Sharing data
Customer contact details may be shared with a third party such as a local community activity in order to facilitate you getting involved. This will only happen once you have given consent for your information to be shared. The information that is shared will be no more than the information provided on your original registration. Consent is obtained when you sign up with us and we will check with you for each individual referral.

Staying in touch
From time to time we send out information on MAST, this includes new opportunities, events and community news. To receive this information you must opt into our mailing lists when you register with us or you can let us know subsequently by email or phone.

You can opt out of receiving these up dates at anytime by contacting the team.

We sometimes use Mailchimp to send out our mailing. Mailchimp is an online platform that enables organisations to manage mailing lists and send out electronic mail shots. Because Mailchimp is based in the USA it has a Privacy Shield framework which is recognised as providing adequate protection for personal data and complies with the regulations set out in General Data Protection Regulation (GDPR).

If you would like to know more about how Mailchimp complies with data protection legislation visit https://kb.mailchimp.com/binaries/content/assets/mailchimpkb/us/en/pdfs/mailchimp_gdpr_sept2017.pdf

If you don’t wish to receive emails through this route you will be able to opt out at the footer of each email or you can let us know by contacting the Maldon Active Support Team.

How do we store your data?
Data is stored in our online database. This database is provided by PipeMedia and we have a data processing contract in place with them which ensures that they comply with data protection legislation.

No personal data is stored outside the MAST database.

Registration forms are securely disposed of once data has been transferred onto the database.

How long do we keep data?
We put together reports on our services and customers on an at least annual basis. This information is required by our funders and to help us design services for the future. For this reason data is retained on the database.

When you register with MAST you will be “active”.  This means we are actively working with you to identify a community activity and to keep you informed about groups and activities.

If you tell us you are no longer interested or we don’t hear from you after three attempts to contact you we will mark you as “inactive”.

Inactive clients do not receive any contact from us unless you first initiate it.

Data on inactive clients will be kept for the duration of the MAST project which is due to run until 31st December 2018. In that time will be used to populate reports.

Reports that contain anonymised data and statistics are retained indefinitely but do not contain any information that can be linked to an identified individual and therefore are not subject to the GDPR.

Who can access my data?
The Maldon Active Support Team database is password protected and only staff who work for the team can access the data held within it.

5. Essex Shed Network

Shed Lead contacts
The Essex Shed Network holds information on key volunteers and shedders within each Essex based shed project. Although this data is held as business data the MDCVS board recognise that as Shed projects are small, largely volunteer led data the contact details for Shed lead hands would, under other circumstances, be considered to be personal data and it is therefore treated as such.

Data is held in the VC Connect database system an online system provided by VC Connect (Voluntary Action Sheffield). VC Connect is compliant with its responsibilities in relation to Data Protection Legislation enabling recording of consent. Their up to date Privacy Statement will be available in April 2018.

Essex Shed Network Mailing List

Where do I sign up?
Signing up to receive our Newsletter can be done via the Essex Shed Network website, you can complete a mailing list consent form in person at an event or you can ask us to add you to the mailing list over the telephone or by email.

What information will be collected?

How will we use your data?
You information will be used to send out Newsletters electronically on an at least quarterly basis.

Sharing data
We will not share your data with a third party without your prior written consent.

How do we store your data?
Our mailing list is stored on Mailchimp. Mailchimp is an online platform that enables organisations to manage mailing lists and send out electronic mail shots. Because Mailchimp is based in the USA it has a Privacy Shield framework which is recognised as providing adequate protection for personal data and complies with the regulations set out in General Data Protection Regulation (GDPR).

If you would like to know more about how Mailchimp complies with data protection legislation visit https://kb.mailchimp.com/binaries/content/assets/mailchimpkb/us/en/pdfs/mailchimp_gdpr_sept2017.pdf

If you don’t wish to receive our Newsletter through this route you will be able to opt out at the footer of each email.

You can view our Newsletters on the Essex Shed Network website instead.

If you have signed up using a consent form, it will be securely disposed of once data has been transferred onto the Mailchimp list.

How long do we keep data?
We will retain your details on the Mailing list until you tell us you know longer wish to receive updates from us.

Who can access my data?
Our Mailchimp account is password protected and only MDCVS staff have access to the account.

6. BLOKES

Where will we collect your data?
Personal data for people who express an interest in the BLOKES! project via a registration form.

What information will be collected?

Demographic data is classed as “special categories of personal data “and is optional.

How will we use your data?

Support service
Your contact details will be used to communicate with you about the BLOKES! project particularly opportunities to get involved with local events.

Please let us know at any time if you no longer wish to receive information from us about BLOKES! activities.

Monitoring our service
Special Categories of personal data are collected in order for us to understand the demography of people we support. This information as an anonymised report may be shared with our funders. You do not have to provide this information and will be able to choose when you register with us.

If you have provided this information but would like it to be removed, please let us know.

Sharing data
Customer contact details may be shared with a third party such as a local community activity in order to facilitate you getting involved. This will only happen once you have given consent for your information to be shared. The information that is shared will be no more than the information provided on your original registration. Consent is obtained when you sign up with us and we will check with you for each individual referral.

How do we store your data?
Data is stored in our online database. This database is provided by PipeMedia and we have a data processing contract in place with them which ensures that they comply with data protection legislation.

No personal data is stored outside this database.

Registration forms are securely disposed of once data has been transferred onto the database.

How long do we keep data?
The BLOKES! project is funded for one year from April 2018 and we will retain information on  individuals for the duration of the project in order to monitor it’s success and keep people informed. This information is required by our funders and to help us design services for the future. For this reason data is retained on the database.

When you register with BLOKES! you will be an active”contact.  This means we are actively working with you to keep you informed about our activities.

If you tell us you are no longer interested or we don’t hear from you after three attempts to contact you we will mark you as “inactive”.

Inactive clients do not receive any contact from us unless you first initiate it.

Data on inactive clients will be kept for the duration of the BLOKES which is due to run until 31st March 2019. In that time will be used to populate reports.

Reports that contain anonymised data and statistics are retained indefinitely but do not contain any information that can be linked to an identified individual and therefore are not subject to the GDPR.

Who can access my data?
The database is password protected and only staff who work on the project can access the data held within it.

6. Photographs

MDCVS recognises that a photograph is categorized as a “special category of personal data” under the General Data Protection Regulation. When your image is taken for use by MDCVS for promotional purposes you will sign an image release form which gives consent for your image to be used as detailed below:

If you wish to withdraw your consent you may do so at anytime by contacting MDCVS. MDCVS will comply with any request to withdraw consent within the parameters of its Data Protection Policy.

When you sign an image release form you provide us with personal data in order to contact you about the use of your image. This information includes:

How do we store your data?
Photographs are stored on the MDCVS server which is password protected and accessible only to MDCVS staff.

Data provided on the image release forms is transferred to a spreadsheet which links your image to your contact details so that we can identify your image easily if you wish to withdraw consent.

Hard copies of the image release form are stored in a locked filing cabinet.

How long do we keep data?
We will retain your image and associated form whilst your consent to use your image is in place or while the image is in use on our promotional material whichever is the longer.

Who can access my data?
All MDCVS staff will have access to your data.

Sharing data
We will not share your data with a third party without your prior written consent.

7. Event Attendees

Where will you collect my data?
When you register to attend an event we will collect contact information this may be on a booking form or online form.

What information will be collected?
Depending on the event we will collect information that will enable us to contact you with information relating to the event and ensure that any special needs are provided for. This may include:

How will we use your data?
Data will be used to communicate with you in relation to the event you are booking into only. This will include sending confirmations, joining instructions and post event feedback requests.

Sharing data
We will not share your data with a third party without your prior written consent.

How do we store your data?

Eventbrite
We may choose to use Eventbrite in order to manage bookings for an event. Eventbrite is an online booking platform which collects personal data for events and processes it for a third party – the event holder.

More details on their compliance with UK data protection legislation can be found online here https://www.eventbrite.co.uk/support/articles/en_GB/Troubleshooting/eventbrite-eu-data-protection?lg=en_GB

Other booking processes
Where we opt not to use Eventbrite to manage event bookings data is stored on a password protected document,

Any hard copy booking forms are securely disposed of once data has been transferred onto the database.

How long do we keep data?
Data is kept until the event it relates to is fully administered. This will usually be a few months after the event or the final event if it is one of a series to enable all invoicing and payments to be completed.

Data submitted through Eventbrite is subject to their data protection processes.

Who can access my data
Our Eventbrite account is password protected and only MDCVS staff have access to the account.

Data held on an internal document will only be accessible to staff who are administering the related event.

8. MDCVS Staff and Volunteers

MDCVS Staff
MDCVS holds personal data on it’s employees in order to process payroll, it’s obligation in relation to paying National Insurance, PAYE and Pension and keeps employment records.

Employee records are stored both electronically in password protected documents and in hard copy. In both cases this data is accessible to the MDCVS Director and can be made available to the MDCVS trustee board as appropriate.

In addition we have an online HR system that contains staff records and facilitates record keeping in relation to staff leave. The privacy statement of the HR company can be viewed online here https://www.breathehr.com/privacy-policy/

Information to process Payroll is shared with our Payroll provider Community 360 with whom we have a intend to have a data processing contract in place in time for the GDPR enforcement date of 24th May 2018

Information that enables us to provide the Workplace pension is shared with our Pension Provider NEST. Details of their commitment to data protection legislation and privacy can be found online at https://www.nestpensions.org.uk/schemeweb/nest/nestcorporation/privacy-policy.html?logged=yes

MDCVS Volunteers including trustees
Personal data for MDCVS volunteers is subject to the same processing as Volunteer Centre Customers however in addition paper records will be retained whilst a volunteer is active with us.

Your rights

You full rights under Data Protection are outlined in our Data Protection Policy. If you would like to see a copy or would like to discuss any of the below rights please contact MDCVS Director Sarah Laskar on 01621 851891 or sarah@maldoncvs.org.uk

Your right to complain
If you feel that M&DCVS are not complying with Data Protection Legislation you have the right to lodge a complaint to the Information Commissioners Office (ICO).

For full details of how to do this visit the ICO website https://ico.org.uk/ or call their helpline on 0303 123 1113.

Changes to policy
MDCVS Trustee board will review this Privacy Statement alongside the Data Protection Policy on an annual basis and the updated document will be made available on the MDCVS website.