Data Protection & Privacy Policy

1) Introduction

Involve Community Services is a registered charity (1061373) and a company limited by guarantee (3332555) working to support a thriving voluntary and community sector in and around Bracknell Forest and Wokingham Borough. Our services include support to local charities and community groups as well as direct services to members of the public through wellbeing schemes and project delivery. We hope that the obligations outlined in this Data Protection and Privacy Statement help you to understand how we process your data, however if you do have any questions about anything in this statement or about our data protection processes please contact our Chief Executive Officer and Data Protection Officer, Philip Bell.
Involve is committed to protecting the rights and privacy of service users, volunteers, staff and others, in accordance with the United Kingdom General Data Protection Regulation (UK-GDPR). The regulatory environment demands higher transparency and accountability in how organisations manage and use personal data. It also accords new and stronger rights for individuals to understand and control that use. The GDPR contains provisions that an organisation will need to be aware of as data controllers, including provisions intended to enhance the protection of individual’s personal data.
In order to help people who use our services to understand how and why personal data is collected, used and stored, we have prepared this notice. This webpage is broken down into sections which relate to each area of our service and related data requirements will be made available to each individual when they sign up to the relevant service.
Involve will ensure that its Privacy Notice is written in a clear and plain way that staff and service users will understand. Involve needs to process certain information about its staff, volunteers, service users, and other individuals with whom it has a relationship, for various purposes, including, but not exclusively;

The recruitment and payment of staff
Users of Involve’s services
Complying with legal obligations to funding bodies and statutory partners

To comply with various legal obligations, including those imposed by the GDPR, Involve must ensure that all information about individuals is collected and used fairly, stored safely and securely, and not disclosed to any third party unlawfully.

2) Compliance

This policy applies to all staff and volunteers of Involve. Any breach of this policy or of the Regulation will be considered an offence. As a matter of best practice, other agencies and individuals working with Involve, and who have access to personal information, will be expected to read and comply with this policy.
This policy will be updated as necessary to reflect best practice in data management, security and control and to ensure compliance with any changes or amendments to the GDPR and other relevant legislation.

3) General Data Protection Regulations (GDPR)

The UK GDPR regulates the processing of personal data, and protects the rights and privacy of all living individuals (including children), for example by giving all individuals who are the subject of personal data a general right of access to the personal data which relates to them. Individuals can exercise the right to gain access to their information by means of a ‘subject access request’.
Personal data is information relating to an individual and may be in hard or soft copy (paper/manual files; electronic records; photographs; CCTV images) and may include facts or professional opinions about a person.
For more detailed information on these Regulations see the Data Protection Data Sharing Code of Practice (DPCoP) from the Information Commissioner’s Office (ICO).

4) Data We Collect

The collection of your Personal Information from our website and other services will vary depending on which of our services you have accessed / are accessing. Involve will make every effort to gather and collect accurate data from you and also assumes that the information you are giving is accurate and up to date. Involve requests that all service users make every effort to update Involve regarding any changes to your data. Section 8 has further details on your rights regarding your data.

A. Core Services:
i. Developmental Support
ii. Funding Advisory Services
iii. Training Courses
vi. Trustee Recruitment (inTRUSTed)
v. Volunteer Recruitment
vi. Promoting Services
B. Volunteer Centre Customers
C. Green & Active Volunteers
D. Event Attendees

E. Community Navigation Scheme
F. Social Prescribing Service
G. Cancer Support Network
H. Welcome Spaces Project
I. Thames Valley VCSE Alliance
J. Thriving Communities
K. Our Staff & Volunteers
L. Email Mailing List Subscribers
M. Photography Consent & Usage
N. Artificial Intelligence

A. Core Services

Data about local organisations is maintained on our electronic databases and includes the contact details of trustees, staff and/or volunteers within those organisations. This data is collected when an organisation requests Involve’s core services; infrastructure/developmental support, funding advice, training, governance guidance, trustee and volunteer recruitment.

The above is considered by Involve‘s Trustees to be Business Contacts and therefore not subject to the GDPR. The Trustees are however committed to good practice and will endeavour to ensure the same privacy and security settings that are followed for personal data are applied to the above.

i. Developmental Support:

When: Your organisational data will be collected upon registering an interest in receiving developmental support from Involve.
What: We will collect information that will enable us to support and deliver our service effectively. This may include; contact name, organisation’s address, email and telephone, organisational financial, legal and governance information, if relevant; Plus we will ask for additional relevant information to risk assess and support your organisation’s needs. We will collect information from/for third party sources, which may include, but is not limited to, rooms-for-hire, partnership connections and/or additional external resources.
Use of data: Any data held for the purpose of this providing developmental support will only be used for this purpose, and for monitoring and reporting to Involve funders.
Data sharing: Data will be shared with prospective third parties to enable us to connect you with resources which could be beneficial to your organisation. Limited sets of your data may be shared with other members of the Involve team to offer further support.

ii. Funding Advisory Services:

When: Your organisational data will be collected upon registering an interest in receiving funding advice or grant writing support from Involve.
What: We will collect information that will enable us to support and deliver our service effectively. This may include; contact name, organisation’s address, email and telephone, and organisational financial, legal and governance information, if relevant. Plus we will ask for additional relevant information to risk assess and support your organisation’s needs. We may collect information from third parties, with your agreement, in support of this function.
Use of data: Any data held for the purpose of this providing funding advice or grant writing services will only be used for this purpose, and for monitoring and reporting to Involve funders.
Data sharing: Data will be shared with prospective third parties, mainly relevant trusts and foundations, to enable us to accurately write and submit bids on behalf of your organisation. We may also connect you with further funding resources which could be beneficial to your organisation and suggest more projects or fundraising opportunities. Limited sets of your data may be shared with other members of the Involve team to offer further support.

iii. Training Courses:

When: Your data will be collected upon registering an interest in attending a training course with Involve.
What: We will collect information that will enable us to support and deliver our service effectively. This may include; contact name, attendee name, organisation’s address, email and telephone. Plus we may ask for additional data in line with our funders requirements.
Use of data: We will use your data to communicate with you effectively about your learning. You can also subscribe to our weekly training alerts by emailing our Training Coordinator. Your data will only be used for this purpose and you can unsubscribe at any time. We will also collate data for monitoring and reporting purposes.
Data sharing: Data will be shared with the trainer delivering the course you are attending. For Bracknell Forest learners, your information will also be collected for the Bracknell Forest Council’s Community Learning Team. With your consent, limited sets of your data may be shared with other members of the Involve team to offer further support.

iv. Trustee Recruitment Service (inTRUSTed):

Organisations –
When: Your organisational data (Business Contact information) will be collected upon registering an interest in the inTRUSTed service.
What: We will collect information that will enable Involve to support and deliver our service effectively. This may include; name, address, email, telephone, social media, and/or organisational financial, legal and governance information; We will ask for additional relevant information to risk assess and support your organisation’s needs.
Use of data: To communicate effectively with you about recruitment issues, governance and support for your organisation. We will also collate data for our monitoring and reporting purposes.
Data sharing: Data will be shared with prospective third party candidates to enable them to understand and apply for your Trustee vacancies. We may also use third party websites and recruitment providers, as well as Involve’s own resources to support your recruitment needs.

Applicants –
When: Your personal data will be collected upon registering an interest in the inTRUSTed service.
What: We will collect information that will enable us to support and deliver our service effectively. This may include; youe name, address, email, telephone, social media, and/or employment/volunteering status and employment/volunteering history; We will ask for additional relevant information to risk assess and support you as best as possible.
Use of data: To communicate effectively with you about Trustee recruitment opportunities, particularly those in which you have expressed an interest or chosen to pursue. You will need to consent to this information being forwarded to the organisation you are applying to.
Data sharing: Your data is recorded and retained in order to fulfil the organisational objective of matching local people with Trustee roles and this has been categorised as a legitimate business aim for Involve.

v. Volunteer Recruitment:

When: Your organisational data will be collected upon requesting to advertise a volunteering role.
What: We will collect information that will enable us to support and deliver our service effectively. This may include; volunteer coordinator / main contact name, organisation and/or opportunity address, contact details (email and telephone), skills, qualities and timings required, etc.
Use of data: To communicate with you about your volunteering opportunities and to advertise and share relevant details with potentially interested volunteers. Consent will be taken at initial contact to share your details with volunteers potentially offering suitable assistance. Your listing(s) will be added to our website, Bracknell Forest Get Involved. You can opt out of receiving updates or having your opportunity being advertised at any time by contacting the Volunteer Centre Manager. Please note we use an external WordPress plugin and theme, Listify, to list and store information about your organisation and your volunteering opportunities: wpjobmanager.com
Data sharing: Involve will only share the information received upon expression of interest in advertising an opportunity. Information is recorded and retained in order to fulfil the organisational objective of matching local people with volunteering roles and this has been categorised as a legitimate business aim for Involve. We also use an external platform for our Registration Forms which stores data on its own online servers and has their own relevant Privacy Policy: jotform.com/privacy

B. Volunteer Centre Customers

Individual Volunteers –
When: Your personal data will be collected upon registering an interest in volunteering in Bracknell Forest.
What: We will collect information that will enable us to support and deliver our service effectively. This may include; name, address, contact details (email and telephone), date of birth, demographic data including gender, age, ethnicity, employment status, disability and carer status (Demographic data is classed as “special categories of personal data” and is optional) and we will ask for additional relevant information to risk assess and support the individual as best as possible.
Use of data: To communicate with you about volunteering opportunities, in particular, potentially suitable opportunities, those that you have expressed an interest in, or chosen to pursue. Upon your request, we will share your information with partner organisations offering a potentially suitable opportunity. You can opt out of receiving updates regarding volunteering at any time by contacting the Volunteer Centre Manager.
Data sharing: Involve will only share the information received about volunteering with the agreement of the individual. Information is recorded and retained in order to fulfil the organisational objective of matching local people with volunteering roles and this has been categorised as a legitimate business aim for Involve. We also use an external platform for our Registration Forms which stores data on its own online servers and has its own relevant Privacy Policy: jotform.com/privacy

Corporate Group Volunteers –
When: Your company’s data will be collected upon registering an interest in corporate volunteering.
What: We will collect information that will enable us to support and deliver our service effectively. This may include; your name, company address, contact details (email and telephone), number of volunteers, interests, available timings, and we will ask for additional relevant information to risk assess and support the group as best as possible.
Use of data: To communicate with you effectively about corporate social responsibility opportunities. Consent will be taken at initial contact to share your details with partner agencies that may be matched for this undetaking. You can opt out of receiving update at any time by contacting the Volunteer Centre Manager.
Data sharing: Involve will only share the information provided with your agreement. Information is recorded and retained in order to fulfil the organisational objective of matching local staff groups with volunteering tasks and this has been categorised as a legitimate business aim for Involve. We also use an external platform for our Registration Forms which stores data on its own online servers and has its own relevant Privacy Policy: jotform.com/privacy

C. Green & Active Volunteers

When: Your personal data will be collected upon registering an interest in volunteering with the Green & Active Project.
What: We will collect information that will enable us to support and deliver our service effectively. This may include; name, address, contact details (email and telephone), date of birth, demographic data including gender, age, ethnicity, employment status, disability and carer status (Demographic data is gathered for the purpose of reporting to funders and will always be anonymised and optional.). We may ask for additional relevant information to risk assess and support an individual as best as possible.
Use of data: To communicate with you about the scheme, particularly upcoming task dates or additional new projects. Consent will be taken at initial contact. We will share your details with relevant Parks & Countryside and external Environmental Group partners, who host most events. You can opt out of receiving updates at any time by contacting the scheme’s coordinator.
Data sharing: Involve will only share data with Bracknell Forest Council, as our main partners, and as mentioned, any relevant task leaders such as external environmental groups or rangers. We also use an external platform for our Registration Forms which stores data on its own online servers and has its own relevant Privacy Policy: jotform.com/privacy

D. Event Attendees

When: Your personal and organisational data will be collected upon registration or on the day sign in.
What: Depending on the event we will collect information that will enable us to contact you with details relating to the event and ensure that any of your needs are provided for. This may include; name, email address, telephone number, organisation, access/ mobility issues and dietary requirements. You may be asked whether you wish to join any of our relevant mailing lists; Please see Section I for more details.
Use of data: To communicate with you in relation to the event you are booking into only. This will include sending confirmations, joining instructions and post-event feedback requests.

E. Community Navigation Scheme

When: Service user’s and, if relevant, the referrer’s, data will be collected at point of referral (if from an external party consent should have been gained by the referring agency for your details to be shared with the scheme) or at the point of a face to face meeting, should one take place.
What: We will collect information that will enable us to support and deliver our service effectively. This may include; name, address, contact details (email and telephone), date of birth, registered GP surgery, reason for accessing the service, demographic data including gender, age, ethnicity, employment status, disability and carer status (Demographic data is classed as “special categories of personal data” and is optional). We may ask for additional relevant information to risk assess and support an individual as best as possible.
Use of data: To support you as per the purpose of the scheme, to communicate effectively with you regarding the service and for monitoring and reporting purposes (data will be anonymised for monitoring and reporting).
Data Sharing: Details may be shared with a third party but only with consent.

F. Social Prescribing Service

When: Service user’s and the referring GP’s data will be collected at point of referral. Additional data will then be collected directly from the service user which will inform how we can assist.
What: We will collect information that will enable us to support and deliver our service effectively. This may include; name, address, contact details (email and telephone), date of birth, registered GP surgery, reason for accessing the service, demographic data including gender, age, ethnicity, employment status, disability and carer status (Demographic data is classed as “special categories of personal data” and is optional). We may ask for additional relevant information to risk assess and support an individual as best as possible.
Use of data: To support you as per the purpose of the scheme, to communicate effectively with you regarding the service and for monitoring and reporting purposes (data will be anonymised for monitoring and reporting).
Data Sharing: Details may be shared with a third party but only with consent.

G. Cancer Support Network & Cancer Champions

Service Users –
When: Your personal data will be collected at point of referral (if from an external party, consent should have been gained by the referring agency for your details to be shared with the scheme) or at the point of a face to face meeting, should one take place.
What: We will collect information that will enable us to support and deliver our service effectively. This may include; name, address, contact details (email and telephone), date of birth, registered GP surgery, demographic data including gender, age, ethnicity, employment status, disability and carer status (Demographic data is classed as “special categories of personal data” and is optional). We may ask for additional information to risk assess and support an individual as best as possible.
Use of data: To support you as per the purpose of the scheme, to communicate effectively with you regarding the service and for monitoring and reporting purposes (data will be anonymised for monitoring and reporting).
Data Sharing: Details may be shared with a third party but only with consent.

Volunteers –
When: Your personal data will be collected upon registration with the service.
What: We will collect information that will enable us to deliver our service effectively. This may include; name, address, contact details (email and telephone), date of birth, demographic data including gender, age, ethnicity, employment status, disability and carer status (Demographic data is classed as “special categories of personal data” and is optional). We may ask for additional information to risk assess and ensure suitability and effective matching to a network service user as a volunteer within the Cancer Champions scheme. Volunteers will also be asked to undertake a DBS check which will require Involve to have access to additional documentation such as passports, driving licences or utilities information for this undertaking.
Use of data: To communicate effectively with you regarding the service and for monitoring and reporting purposes. Data will be anonymised for monitoring and reporting.
Data Sharing: Depending on your volunteer role, your details may need to be shared with the service user with whom you are matched. The details shared will be determined with you before this undertaking.

H. Welcome Spaces Project

When: Your full name, email address, and phone number will be collected, through our online sign up form, which will be securely stored by Mailchimp. If you are acting as an event partner, details such as your company or organisation’s name will also be stored.
What: We will use Mailchimp for sending occasional email campaigns which will provide details about the Welcome Spaces Project, our upcoming events, and other similar information. You can view their privacy policy by clicking here, but please note that by signing up through one of our online hosted sign-up forms, you are not only consenting to Involve’s privacy policy and storage of data, but also to Mailchimp’s policy.
Use of data: We will only use your details to send you emails relating to the Welcome Spaces Project and any updates from our partner companies / organisations.

I. Thames Valley VCSE Alliance

When: Your full name, organisation, role, email address, and phone number will be collected, (details such as your organisation’s focus, target demographic, areas of work, location, etc, are optional, but, if provided, will help us to better deliver the Alliance as we can use this data to see which kinds of organisations we are reaching and which areas are most in need of additional attention) through our online sign up form, which will be securely stored by Mailchimp.
What: We will use Mailchimp for sending occasional email campaigns which will provide details about the Alliance, upcoming meetings, updates to the local Integrated Care System, member spotlight, local healthcare news, existing collaborative projects, and other similar information. You can view their privacy policy by clicking here, but please note that by signing up through one of our online hosted sign-up forms, you are not only consenting to Involve’s privacy policy and storage of data, but also to Mailchimp’s policy.
Use of data: We will only use your details to send you emails relating to the Thames Valley VCSE Alliance and potentially some updates about or from the Thames Valley NHS ICS. You may also be invited to share your opinions on our sub-committees, action groups, upcoming events, general meetings, etc. This project is a collaborative piece of work and we want to hear from and work with as many local VCSE organisations and healthcare providers as possible in order to best contribute towards healthier communities. Full details about those working within the Alliance and further Privacy Information relating to this project can be found on the Thames Valley VCSE Alliance’s official website.

J. Thriving Communities Project

When: The Thriving Communities Team may collect details (such as name, contact information, social media handles and/or feedback and opinion) from members of the public who engage with them while they are out in the Bracknell Forest community, whether this at scheduled events or during general community outreach.
What: Information, feedback and quotes supplied by those who engage with the Thriving Communities Team can be anonymised at request and will be used to further engage with the public and encourage future participation in relevant upcoming community initiatives and events organised, supported or endorsed by the Thriving Communities Team. Personal contact information and social media handles of individuals will always remain anonymous. Consent will be taken by individuals and/or parents/guardians of children for the usage of images on any of our Thriving Communities promotional materials or online content. If an event is occurring in a public location, explicit consent from each individual who may feature in photographs is not required, but posters explaining this will be displayed. If you have any queries or concerns in relation to your data in relation to this project, please contact Sree.Laxman@involve.community.

K. Our Staff & Volunteers

What: Involve holds personal data on its employees in order to process payroll, its obligation in relation to paying National Insurance, PAYE and Pensions, to keep employment (HR) records and provide references as required. Employee records are stored electronically in a limited access drive which only the Chief Executive Officer and Finance Manager have access to. Involve trustees can, as the director of the organisation, request access to this drive.
Use of Data: Information to process Payroll is shared with our Payroll provider, RICE Associates. Information that enables us to provide the Workplace pension is shared with our Pension Provider, True Potential Investments. Details of their commitment to data protection legislation and privacy can be accessed directly with the organisation.

L. Email Mailing List Subscribers

When: Your email address and full name will be collected, (details such as your organisation or phone number are optional fields and are not automatically collected or recorded in our mailing lists) either through written or email consent, which will be securely stored by us, or via one of our online sign up forms.
What: We use Mailchimp for most of our email campaigns, including our weekly Newsletters, Funding Alerts, Volunteer Pool opportunities, Cancer Support Network updates and Green & Active information. You can view their privacy policy by clicking here, but please note that by signing up through one of our online hosted sign-up forms, you are not only consenting to Involve’s privacy policy and storage of data, but also to Mailchimp’s policy. Any emails which are sent by Involve as part of a mailing list which is not integrated into Mailchimp, will not have the Mailchimp logo at the bottom and are controlled and managed by the individual staff member who owns the list. Contacts should communicate any issues within these types of lists directly to the staff member who manages the list.
Use of data: We will only use your details to send you emails relating to the topic you subscribed to. If an error is made and you are sent an email you are not subscribed to, you must let us know as soon as possible so we can rectify the mistake within our system. We will periodically update our mailing lists and will request that you update your preferences to ensure that clear consent to receive our communications has been given. If no response to these subscription confirmation requests is made by inactive subscribers within one months of the initial email being sent, the contact will be removed from our lists.

M. Photography Consent & Usage

When: Photographs and videos of an individual or group may be collected with consent. This will be gathered either in person or via one of our sign up forms, and these will be stored by Involve.
What: We sometimes take photos or videos when undertaking our work. These images and videos may be used in a variety of content, whether this is on physical marketing materials, on any of our websites, and/or in social media posts, etc. We will only use images or videos of you with your consent, and if the individual in question is under the age of 18, with a parent or guardian’s consent too. However, if an event we are running is occurring in a public location, we do not require explicit consent from each individual to share photographs and videos where they may be unknowingly be featured in the background.
Use of data: If you agree to have photographs of you used by Involve, you are also consenting to them being shared by third parties, such as newspaper outlets, the local authority and/or other charities. If you find any images of videos we have used within our marketing which contain you, and you would no longer like to be included, please contact our Administration and Marketing Officer to have them removed. However, please note this may not be possible in some circumstances if the images have also been shared by an external third party, and/or if the original poster cannot be sourced if too much time has passed.

N. Artificial Intelligence Usage

At Involve we have an Artificial Intelligence Policy, composed and approved by our Trustees, which our staff must adhere to. The use of AI is only permitted in circumstances where it can act as an additional tool to aid staff and free up much needed time and resources. Permitted usage of AI at Involve includes:

Drafting and editing documents and content wording
Brainstorming ideas
Assisting with research
Analysing, collating and displaying (anonymised) data for ease of use and understanding when creating reports
Automating repetitive or basic administrative tasks

AI is often a tool which is already included in programme packages Involve already use regularly, such as Mailchimp or Canva, and in these cases, AI is utilised as minimally as possible, only to optimise and make corrections to existing work.

It is our staff’s responsibility to fact-check and ensure accuracy when using AI within their work. We understand that over-reliance on AI tools can lead to impersonal or insensitive communications, and so we aim to limit its use as much as possible, especially within emails and communications, in order to avoid damaging relationships with recipients.

Please be aware that, while we do not endorse or encourage the use of AI to generate images or videos, we may occasionally receive requests from external organisations to promote news or updates about their work, services and events, in which case we cannot ensure that generative AI has not been used by them within the content we are being asked to share.

If you have any thoughts or concerns, please contact us so the matter can be discussed with the team: reception@involve.community

5) Responsibilities

Involve will be the ‘data controller’ under the terms of the legislation – this means it is ultimately responsible for controlling the use and processing of the personal data. Involve appoints a Data Protection Officer (DPO), currently the Chief Executive Officer, who is available to address any concerns regarding data and how it is processed, held and used.
Involve’s trustee board are responsible for overseeing this policy. Line managers will oversee all day-to-day data protection matters and will be responsible for ensuring that all members of staff and relevant individuals abide by this policy.
Compliance with the legislation is the personal responsibility of all staff and volunteers within the organisation who process personal information. Individuals who provide personal data to Involve are responsible for ensuring that the information is accurate and up to date.

6) Disclosing Your Information & External Partnerships

We won’t share your information with any other organisations for marketing, market research or commercial purposes, and will not pass on your details to other websites. Sometimes, we must process / disclose your information in order to comply with a statutory obligation or contract. This includes exchanging information with government departments for legal reasons.
Involve does work in partnership with other organisations and companies as well as signposting service users to external websites and organisations. Involve is not responsible for the privacy policies or practices of any third party. Key organisations Involve works with or uses, such as Mailchimp, Survey Monkey, Eventbrite, Jotform and our own IT provider have shared their privacy policies with us or have them readily available on their own websites.

7) Breaches of Procedure or Loss of Data

Any breach of confidentiality should be reported to the Data Protection Officer (DPO), who will then appoint an appropriate independent person (eg. a member of the board of trustees or a senior member of staff) to investigate the matter. If, following a written summary of findings, the DPO finds that a breach has occurred, they have the discretion to take appropriate action within 28 days. This may include consideration of disciplinary action or, in the case of a volunteer, withdrawing the person from Involve’s service.
Involve takes all reasonable technical and organisational precautions to prevent the loss, misuse or alteration of personal information. We will take reasonable technical and organisational precautions to store, process and transport all personal information provided in a secure manner. Information may be stored in a number of different places. These include locked cabinets, filing systems and secure password protected databases. Involve’s IT system has permissions set up throughout ensuring only relevant, qualified staff have access to the information required for them to deliver their services / do their job. No personal data is stored outside the secure, locked or restricted areas of Involve’s IT system or office space. Any forms, information or documents are securely disposed of once data has been inputted and/ or the information is no longer required by Involve.

8) Data Protection Principles

8.1 The legislation places a responsibility on every data controller to process any personal data in accordance with the eight principles. Please visit the ICO’s website for more detail on the eight principles. Involve undertakes to adhere to the eight principles outlined below:

1 – Involve must process personal data fairly and lawfully.

2 – Involve must process the data for the specific and lawful purpose for which it collected that data and not further process the data in a manner incompatible with this purpose.

3 – Involve must ensure that the data is adequate, relevant and not excessive in relation to the purpose for which it is processed. Involve will not seek to collect any personal data which is not strictly necessary for the purpose for which it was obtained.

4 – Involve must keep personal data accurate and, where necessary, up to date. Involve will review and update all data on a regular basis. It is the responsibility of the individuals giving their personal data to ensure that this is accurate, and each individual should notify involve if, for example, a change in circumstances mean that the data needs to be updated. It is the responsibility of Involve to ensure that any notification regarding the change is noted and acted on. Under the right of rectification, Involve will correct any inaccurate or incomplete data within 28 days of notification. Involve will also inform any third parties, if applicable, of these rectifications.

5 – Involve must only keep personal data for as long as is necessary. Involve undertakes not to retain personal data for longer than is necessary to ensure compliance with the legislation, and any other statutory requirements. The categories of data listed below have to be retained under the following specific criteria:

Personal data of donors associated with finance data must be retained for at least six years.
Personal data associated with records of transactions/purchases needs to be kept for at least six years.
Personal data of employees needs to be retained for six years with reference to payroll and ten years with reference to pension information.
Personal data of volunteers and trustees needs to be retained for at least six years if it is associated with financial transactions. General personal data and records of volunteer’s information will be retained for one year after a volunteer has either been placed at an external organisation or started a voluntary role or task.
Personal data of clients under any of our wellbeing schemes will be retained eight years after discharge.
Any personal data will be retained for seven years if it relates to a formal complaint.

6 – Involve must process personal data in accordance with the rights of the data subject under the legislation. Individuals have various rights under the legislation including a right to:

be told the nature of the information Involve holds and any parties to whom this may be disclosed.
prevent processing likely to cause damage or distress.
prevent processing for purposes of direct marketing.
be informed about the mechanics of any automated decision taking process that will significantly affect them.
not have significant decisions that will affect them taken solely by automated process.
sue for compensation if they suffer damage by any contravention of the legislation.
take action to rectify, block, erase or destroy inaccurate data.
request that the Office of the Information Commissioner assess whether any provision of the Act has been contravened.

Involve will only collect data relevant to the role of the individual, and process personal data in accordance with individuals’ rights. In compliance with the right to erasure, Involve will delete data under the following specific circumstances:

Personal data is no longer necessary in relation to the purpose for which it was originally collected/processed.
An individual withdraws their consent.
The individual objects to the processing and there is no overriding legitimate interest for continuing processing.
The personal data was unlawfully processed.
The personal data has to be erased to comply with a legal obligation.
The personal data is processed in relation to online services to children.

If you feel that Involve are not complying with Data Protection Legislation you have the right to lodge a complaint to the Information Commissioners Office (ICO). For full details of how to do this visit the ICO website ico.org.uk or call their helpline on 0303 123 1113.

7 – Involve must put appropriate technical and organisational measures in place against unauthorised or unlawful processing of personal data, and against accidental loss or destruction of data. All members of staff are responsible for ensuring that any personal data which they hold is kept securely and not disclosed to any unauthorised third parties. Involve will put in place appropriate measures for the deletion of personal data – manual records will be shredded or disposed of as ‘confidential waste’ and appropriate contract terms will be put in place with any third parties undertaking this work. Hard drives of redundant PCs will be wiped clean before disposal or if that is not possible, destroyed physically.

8 – Involve must work to ensure that no personal data is transferred to a country or a territory outside the European Economic Area (EEA) unless that country or territory ensures adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.

10) Subject Access Rights

Individuals have a right to access any personal data relating to them which are held by Involve. Any individual wishing to exercise this right should apply in writing to the Chief Executive Officer. Any member of staff receiving a Subject Access Request should forward this to the Chief Executive Officer. Under the terms of the legislation, any such requests must be complied with within 40 days.

11) Disclosure of Data

11.1 Only disclosures which have been notified under Involve’s Data Protection notification should be made and therefore staff and volunteers should exercise caution when undertaking this exercise. Involve undertakes not to disclose personal data to unauthorised third parties, including family members, friends, government bodies and in some circumstances, the police.

11.2 Legitimate disclosures may occur in the following instances:

the individual has given their consent to the disclosure.
the disclosure has been notified to the Information Commissioners Officer and is in the legitimate interests of the organisation.
the disclosure is required for the performance of a contract.
a safeguarding concern has been identified for the individual or another person associated to that individual.

11.3 There are other instances when the legislation permits disclosure without the consent of the individual. For detailed guidance on disclosures a complete guide is available on the ICO’s website.

11.4 In no circumstances will Involve sell any of its data to a third party.

12) Publication of Information

12.1 Involve publishes various items which will include some personal data, e.g.

internal telephone directory.
event information.
photos and information in marketing materials.

12.2 It may be that in some circumstances an individual wishes their data processed for such reasons to be kept confidential or restricted to Involve access only. Therefore, it is Involve’s policy to offer an opportunity to opt-out of any publication of such when collecting the information.

12.3 If consent is withdrawn after publication, we will stop using the data or image for any future publication.

13) Email

It is the policy of Involve to ensure that senders and recipients of emails are made aware that under the Data Protection Impact Assessment (DPIA), and Freedom of Information Legislation (FIL), the contents of any email may have to be disclosed in response to a request for information. Our email signatures all have a disclaimer which explains this further. Under the Regulation of Investigatory Powers Act 2000 and the Lawful Business Practice Regulations, any email sent to or from Involve may be accessed by someone other than the recipient for system management and security purposes.

14) Recruitment & Selection

Information collected for recruitment or selection for an interview will only be used for that purpose and will be kept secure. Where sensitive personal data is collected, explicit written consent will be obtained from applicants at the point of data collection.
When verifying the information a person provides, Involve will ensure the person knows how this will be done and what information will be checked.
If Involve needs to verify criminal conviction information, it will do this by getting a Disclosure and Barring Service (DBS) check. Involve will ensure it is entitled to receive this information and must follow the DBS’s procedures strictly. Involve may only keep a record that a satisfactory/unsatisfactory check was made, but may not store any detailed information.

15) Employment Records

Involve is permitted to collect, maintain and use employment records. However, staff should know what information about them is kept and what it will be used for. Involve will not keep information for which it has no genuine business need or legal duty to keep.
Employment records are stored in a secure electronic drive. Only authorised staff have access to employment records, including the Finance Manager and the Chief Executive Officer.

16) Guidance to Staff

16.1 Involve employees should bear in mind the following considerations:

1. 1. Sensitive and confidential information must be treated with particular care.
  2. Personal data must not be emailed to staff members’ personal email accounts, as there is no guarantee of security of these accounts.
  3. Any personal data stored in paper format must be held securely locked in filing cupboards in Involve’s offices. If it has to leave the office, consider pseudonymisation.
  4. All Involve’s personal computers and laptops must be password protected. All personal data should be kept in the appropriate IT system (i.e. patient details in Joy and staff details in Sharepoint). If electronic equipment is lost or stolen, access to the server and database from that piece of equipment will be severed.
  5. The database holding service users’ personal data must be accessed only via sanctioned electronic equipment. All employees and volunteers will be trained on how to use the database relying on the written procedures for entering, amending and maintaining data. These procedures will be reviewed annually.
  6. Any changes to personal data (e.g. a change in home address) must be updated on the relevant database within 28 days of receipt.
  7. Personal data must not be given out to any third party unless the individual has agreed to release this information.
  8. Any personal data kept in paper format that is no longer required must be appropriately destroyed.
  9. Any personal data kept electronically that is no longer required must be deleted. Involve will carry out data minimisation as part of the annual data audit.
  10. If data needs to be processed for profiling or for other statistical information, pseudonymise it.

17) Procedure For Review

This policy will be updated as necessary to reflect best practice or future amendments made to the General Data Protection Regulation (GDPR) May 2018 and Data Protection Act 1998. Please visit the ICO’s website which provides further detailed guidance on a range of topics including individuals’ rights, exemptions from the Act, dealing with subject access requests, how to handle requests from third parties for personal data to be disclosed etc.
In particular, you may find it helpful to read the Guide to Data Protection. For help or advice on any data protection or freedom of information issues, please do not hesitate to contact our Data Protection Officer (DPO) and Chief Executive Officer, Philip Bell: philip.bell@involve.community