The Kingswood Trust Data Protection Policy

The EU General Data Protection Regulation (GDPR), in force from 25 May 2018, requires much greater transparency in relation to the data that we (and other organisations) hold – transparency about the type of information that is held, about the way in which it is held, processed and used, and about a person’s rights in respect of that data. GDPR also requires that we obtain an individual’s specific permission to use their data for any stated purposes.

The GDPR provides the following rights for individuals
The right to be informed
The right of access
The right to rectification
The right to erasure
The right to restrict processing
The right to data portability
The right to object
Rights in relation to automated decision making and profiling.

Registration with the ICO
The Information Commissioners Office (ICO) is the UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals. The Kingswood Trust has registered with the ICO and this is a reference point for what the law requires of us in terms of compliance and other rules about the information we control and process.

Responsibilities
Through registration with the ICO, the Charity Manager has become responsible for ensuring that The Kingswood Trust, and more specifically those staff responsible for processing personal information comply, with the Data Protection Act (Data Protection Act 1998 and The General Data Protection Regulation 2018). The Charity Manager is directly accountable for this to The Kingswood Trust Board.

Training
The Chair of The Kingswood Trust and the Charity Manager have both received relevant training in order to cascade this to appropriate staff to fulfil the requirements of the GDPR. Where appropriate Trustees and Volunteers will also be offered data protection training and this will also become part of Kingwood’s induction programme for all newly appointed staff. Update and refresher training will be given to existing staff at appropriate intervals.

The Kingswood Trust:

• will inform people about the collection and use of personal data as this is a key transparency requirement under the GDPR
• will provide individuals with information including: our purposes for processing personal data, our retention periods for that personal data, and with whom it will be shared (this is called ‘privacy information’ and will be described in a “Privacy Statement”)
• will provide privacy information to individuals at the time we collect their personal data from them
• should personal data be obtained from other sources, we will provide individuals with privacy information within a reasonable period of obtaining the data and no later than one month
• will provide information to people that is concise, transparent, intelligible, easily accessible, and uses clear and plain language
• will provide information on privacy in different ways such as on our email signature’s, through our website and at events using proformas
• will review, and where necessary, update your privacy information, on demand or at least annually and will bring any new uses of an individual’s personal data to their attention before we start the processing
• believes that keeping people informed will build trust with our customers, clients staff and volunteers and others that we hold information for

Description of Information Processing
The following is a broad description of the way that The Kingswood Trust’s data controllers process personal information.

Reasons/purposes for processing information
The Kingswood Trust processes personal information to enable us: to provide a quality service for the benefit of the public in a geographical area as specified in our Articles and Charitable Objects; to administer membership records; to fundraise; to keep staff and supporters up to date and promote the interests of the charity; to manage our employees and volunteers and to maintain our own accounts and records.

Type/classes of information processed
We process information relevant to the above reasons/purposes. This may include:

• personal details
• family details
• lifestyle and social circumstances
• membership details
• financial details
• education and employment details

In some circumstances we also process sensitive classes of information that may include:

• physical or mental health details
• racial or ethnic origin
• religious or other beliefs of a similar nature
• trade union membership
• information from the disclosure and barring service

Who the information is processed about
We hold information and contacts about people who work or volunteer for The Kingswood Trust, use our service, are interested in the work of our charity or provide services for us.

We process personal information in varying detail about:

• members of the “friends group”
• customers and clients, including children and adults
• suppliers
• employees and volunteers
• trustees
• complainants and supporters
• enquirers
• event participants
• advisers and representatives of other organisations
• partner organisations
• funders and potential funders

Data stored in relation to visitors who are children
Consent Forms
Parents of children making a visit to Kingswood Trust, for example residential and day visits and holiday clubs are asked to complete a consent form. This provides information for planning purposes, ensures a contact in an emergency and gives consent (or not) for photographs and media to be used as well as consent to emergency medical treatment if needed.

These forms are handed to the house manager on arrival, checked for signed consent and scanned. Scanned copies are stored confidentially and directly on Wolverhampton City Council’s secure L Drive.

No paper copies are held on site as these are returned to the class teacher for use in case of an emergency during the visit and so becomes the responsibility of the school.

Accident Records and Incident Forms

Accident records and incident forms are stored in a filing cabinet in the administrative office. This cabinet is locked at the end of each day.

Who personal information may be shared with:
In general Kingswood Trust will never sell, rent or disclose the personal information held to any third party. However, in order to operate effectively some data, particularly about employees, trustees and volunteers will need to be shared with other organisations. Information about customers and clients may need to be shared in exceptional circumstances and in all circumstances the Kingswood Trust will comply with all aspects of the Data Protection Act (DPA) and GDPA 2018.

What follows is a description of the types of organisations/individuals we might need to share some of the personal information we process for one or more reasons.

• family, associates or representatives of the person whose personal data we are processing
• employees
• The Kingswood trust board or individual trustees
• current, past and prospective employers
• healthcare, social and welfare organisations
• educators
• financial organisations
• employment and recruitment agencies
• survey or research organisations
• business associates and professional advisers
• providers of goods and services
• local and central government
• police forces
• other voluntary and charitable organisations

Managing our contact lists and keeping contacts informed
The Kingswood Trust uses Mailchimp to manage lists of individual contacts. This enables The Kingswood Trust to ask individuals to opt in and specify preferred contact arrangements. Schools and customer organisations, including public limited companies may also be contacted through this mechanism, but we will continue to use emails direct from our admin office for our existing client groups and customers. We will communicate our Privacy Statement and Data Protection Policy using a layered approach, via email footers, through our Kingswood App and on our website. Contacts can unsubscribe and change preferences at any time.

Data/Information storage
Data/Information is stored at The Kingswood Trust on:

• Wolverhampton City Council L Drive – Safe Server
• Encrypted Laptops
• Email accounts
• Desktops- Locked in offices overnight and in alarmed building when not in use
• Backup storage devices – locked in filing cabinet/safe
• Paper files – locked in filing cabinet/safe
• General retention periods

The Kingswood Trust retains data for as long as necessary. The retention periods differ based on the type of data processed, the purpose of processing or other factors. Issues we consider include:

Whether any legal requirements apply for the retention of any data. For example:

• Trade law;
• Tax law;
• Employment law;
• Administrative law;

In the absence of any legal requirements, personal data is only retained if necessary for processing. This means data is deleted e.g. when:

• the data subject has withdrawn consent to processing;
• a contract has been performed or cannot be performed anymore; or
• the data is no longer up to date.

Data Disposal
Paper data, information and records will be shredded or incinerated. Electronic Data and Equipment storing Electronic data will be disposed of using WCC ICT technical support team services (Service Level agreement)

The Kingswood Trust will review data held at least annually or earlier should this be appropriate. Please contact The Kingswood Trust with any questions regarding this policy which will be reviewed at least annually.