Personal data relates to a living individual who can be identified from that data. Identification can be by the information alone or in conjunction with any other information in the data controller’s possession or likely to come into such possession. The processing of personal data is governed by the General Data Protection Regulation (the “GDPR”).
Who are we?
The St Philip’s Centre is the data controller (contact details below). This means St Philip’s Centre decides how your personal data is processed and for what purposes.
How do we process your personal data?
The St Philip’s Centre complies with its obligations under the “GDPR” by:-
Keeping personal data up to date;
Storing and destroying it securely;
Not collecting or retaining excessive amounts of data;
Protecting personal data from loss, misuse, unauthorized access and disclosure;
Ensuring that appropriate technical measures are in place to protect personal data.
We use personal data for the following purposes:-
To enable us to carry out our work as a registered charity and registered company;
To enable us to administer the Near Neighbours and Prevent programmes;
To administer records of: ➢ staff, ➢ volunteers (including volunteer faith practitioners) and ➢ consultants;
To manage our employees and volunteers;
For purposes of safeguarding children and vulnerable adults;
To fundraise and promote the interests of St Philip’s Centre;
To maintain our own accounts and records (including the processing of gift aidapplications);
To inform you of news, events, activities either organised by St Philip’s Centre or byother carefully selected partners through: ➢ Mailings (by email and/or hard copy) ➢ Website ➢ Text message ➢ Telephone
What is the legal basis for processing your personal data?
Explicit consent so that we can keep you informed about news, events and activities and process your gift aid donations;
Legal Obligation – that is, processing is necessary for carrying out obligations under employment, social security or social protection law, or by a collective agreement;
Necessary for contract – that is, data that is necessary to make a contract work;
Processing is carried out by a not-for-profit body with a political, philosophical, religiousor trade union aim provided:
➢ The processing relates only to those who have regular contact with theorganisation in connection with those purposes and
➢ There is no disclosure to a third party without consent except as set out in 5below.
Sharing your personal data
Your personal data will be treated as strictly confidential and will only be shared within St Philip’s Centre for purposes connected with the St Philip’s Centre and certain third parties outside of St Philip’s Centre as set out in Appendix 1.
Unless subject to an exemption under the GDPR, you have the following rights with respect to your personal data:-
➢ The right to request a copy of your personal data which the St Philip’s Centre holdsabout you (see Appendix 3);
➢ The right to request that the St Philip’s Centre corrects any personal data if it is found to be inaccurate or out of date;
➢ The right to request that your personal data is erased where it is no longer necessaryfor the St Philip’s Centre to retain such data;
➢ The right to withdraw your consent to the processing of your personal data at any time;
➢ The right to request that the data controller provide the data subject with his/herpersonal data and where possible, to transmit that data directly to another datacontroller, (known as the right to data portability);
➢ The right, where there is a dispute in relation to the accuracy or processing of yourpersonal data, to request a restriction is placed on further processing;
➢ The right to object to the processing of personal data (where applicable);
➢ The right to lodge a complaint with the Information Commissioner’s Office (ICO).
Further processing
If we wish to use your personal data for a new purpose, not covered by this Data Protection Notice, we will provide you with a new notice explaining this new use prior to commencing and setting out the relevant purposes and processing conditions. Where and whenever necessary, we will seek your prior consent to the new processing.
Contact details
To exercise all relevant rights, queries of complaints, please in the first instance contact theCentre Support Services Manager at St Philip’s Centre, 2A Stoughton Drive North, Leicester LE5 5UB – telephone number 0116 2733459 or e-mail admin@stphilipscentre.co.uk
Alternatively you can contact the Information Commissioner’s Office on 0303 123 1113 or via e-mail: https://ico.org.uk/global/contact-us/email/ or by post at the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
APPENDIX 1
Sharing your personal data
Your personal data will be treated as strictly confidential and will only be shared within St Philip’s Centre and certain third parties as listed below:
➢ Data supplied in relation to Near Neighbours Grant Applications may be shared with the Church Urban Fund as necessary to administer the grant and for statistical purposes;
➢ We may disclose your personal data to our insurers and/or professional advisers insofar as reasonably necessary for the purposes of obtaining and maintaining insurance coverage, managing risks, obtaining professional advice and managing legal disputes;
➢ Financial transactions relating to our website and services may be handed by our payment service providers – Stripe, Go Cardless, Paypal. We will share transaction data with our payment service providers only to the extent necessary for the purposes of processing your payments, refunding such payments and dealing with complaints and queries relating to such payments and refunds. Further information about how data related to the website is processed can be found in our Terms and Conditions & Website Privacy Policy at https://www.stphilipscentre.co.uk/
➢ Data supplied in connection with the carrying out of DBS checks will be shared on a secure system with The Diocese of Leicester and Thirtyone:eight who process DBS checks on our behalf. The Diocese of Leicester may retain your name, e-mail address and date of DBS check for the purpose of sending a reminder when the next DBS check is due.
APPENDIX 2 RETENTION OF DATA
You can check how long we will retain your data in this table.
APPENDIX 3
RESPONDING TO A SUBJECT ACCESS REQUEST
You have the right to find out if St Philip’s Centre is using or storing your personal data and
to ensure that the data that is stored is accurate. This is called the right of access. You
exercise this right by asking for a copy of the data, which is commonly known as making a
‘subject access request’.
A subject access request may be made verbally or in writing. If you make your request verbally, we recommend you follow it up in writing to provide a clear trail of
correspondence and clear evidence of your actions.Procedure for exercising your right of access
Contact The Centre Manager at St Philip’s Centre, 2A Stoughton Drive North, Leicester LE55UB – admin@stphilipscentre.co.uk 0116 2733459. In the absence of the Centre Manager, please contact director@stphilipscentre.co.uk
State clearly what data you want. You might not want all the personal data that we hold about you so identify the specific data you want.
Include the following information:
Your name and contact details.
Any details or relevant dates that will help us identify what you want e.g date of course/event attended.
For example, you may want to ask for:
your personnel file
emails between ‘person A’ and ‘person B’ (e.g. from 1 June 2018 to 1 Sept 2018)
CCTV camera data on, for example, 23 May 2017 from 11am to 5pm
Records detailing the transfer of your data to a third party.
Keep a copy of your request and any proof of postage or delivery.
How St Philip’s Centre will respond to your request
We will acknowledge your request immediately and will respond within one month with a copy of your data. We may need to ask you for more information to help us find the data you have requested and will wait until we have all the necessary data before responding to your request.
We may respond with a copy of your data electronically. If you need your data in another format, you must ask if this is possible.
We will also tell you:
What we are using your data for.
Who we are sharing your data with.
How long we will store your data, and how we made this decision.
Information on your rights to challenge the accuracy of your data, to have it deleted, or toobject to its use.
Your right to complain to the ICO.
Information on where your data came from.
Whether your data is used for profiling or automated decision making and how it is doing this.
If we have transferred your data to a third country or an international organisation, what security measures we took.
Refusing a subject access request
We may refuse your subject access request if your data includes information about another individual, except where:
the other individual has agreed to the disclosure, or
it is reasonable to provide you with this information without the other individual’s consent.
In deciding this, we will balance your right to access your data against the other individual’s rights regarding their own information.
We can also refuse your request if it is ‘manifestly unfounded or excessive’. In any case we will tell you and will justify our decision.
What to do if you disagree with the outcome or are still unhappy
If you have a concern about the way we are handling your information, that is:
we are not keeping your information secure;
we hold inaccurate information about you;
we have disclosed information about you;
we are keeping information about you for longer than is necessary; or
we have collected information for one reason and are using it for something else,
we will take your concern seriously and work with you to try to resolve it.
Having done so, if you remain dissatisfied you can make a complaint to the ICO. Their website can be found at https://ico.org.uk and their helpline number is 0303 123 1113.
You can also seek to enforce your rights through the courts. If you decide to do this, we strongly advise that you seek independent legal advice first.
Fees for providing a copy of your data
A copy of your personal data will be provided free but we may charge for additional copies. We can only charge a fee if we think the request is ‘manifestly unfounded or excessive’. If so, we may ask for a reasonable fee for administrative costs associated with the request.
