Shropshire RCC is the operating name of the Community Council of Shropshire. We are a registered charity (1096779) and a company limited by guarantee incorporated in England and Wales under company number 4652487. Our registered office is 4 The Creative Quarter, Shrewsbury Business Park, Shrewsbury, Shropshire. SY2 6LG.
We are a ‘data controller’ for the purposes of the EU General Data Protection Regulation 2016/679 (‘Data Protection Law’). This means that we are responsible for, and control the processing of your personal information.
We want everyone who supports us, or who comes to us for support, to feel confident and comfortable with how any personal information you share with us will be used and looked after. We are committed to providing transparent information on the types of personal data we may collect about you, what we do with that data, how we will store and handle that data, and keep it safe.
2. WHY DO WE USE YOUR PERSONAL DATA?more
We collect and use personal data for a number of purposes:
- To process and record your membership if you are a member of our charity.
- To enable us to provide a safe and professional service if you are a service user.
- To provide the services or goods that you have requested from us.
- To process your donations or other payments, to claim Gift Aid on your donations and verify any financial transactions.
- To update you with important administrative messages about your grant application, job application, volunteer application, membership, an event, or services or goods you have requested.
- To keep a record of your relationship with us.
We may also use your personal information to:
- Contact you about our work and how you can support Shropshire RCC (see section 6 on ‘Direct Marketing’ below for further information).
- To invite you to participate in surveys or research.
- To respond to your queries and complaints.
Shropshire RCC will not share your information with third parties for marketing purposes.
3. EXPLAINING THE LEGAL BASES WE RELY ONmore
The law on data protection sets out a number of different reasons for which an organisation may collect and process your personal data. When collecting your personal data, we will always make clear to you which data is necessary and what legal basis we are using it in connection with a particular service.
In specific situations we can collect and process your data with your consent. For example, when you sign up to our website to receive email newsletters from us.
In certain circumstances, we need your personal data to comply with our contractual obligations. For example, if you have placed an order on our website, we will collect your address details to deliver your purchase.
If the law requires us to, we may need to collect and process your data. For example, in order to claim gift aid on a donation, HMRC requires us to retain your gift aid declaration which includes personal details such as your name, home address, and UK tax-payer status.
In specific situations, we require your data to pursue our legitimate interests in a way which might reasonably be expected as part of running our charity and which does not materially impact your rights, freedom or interests. For example, to inform you about services you have told us you are interested, such as our training programmes.
In very limited cases we may need to use your data to protect your vital interests, or those of another person. For example, we may share personal information with agencies, including local authority services and the police, where it is necessary to safeguard the welfare of an adult at risk.
4. WHAT SORT OF PERSONAL DATA DO WE COLLECT?more
Personal data is any information that can be used to identify you.
We only collect personal data relevant to the type of service or interaction you have with Shropshire RCC. So for example, if you are a service user, volunteer, donate money, register for our training or an event, sign up to any of activities or online content (such as newsletters), or contact us by telephone, email, social media, post or text message, we may need to collect and process the personal information that you’ve provided.
This personal information may include:
- Personal details (name, date of birth).
- Contact details (email, address, telephone etc.)
- Financial details to process your donations or other payments.
- Volunteer CRB checks for safeguarding purposes.
- UK tax payer information (for Gift Aid).
- Details of your interactions with us.
- Details of your visits to our websites, and which website you came from to ours.
When collecting your personal data we will always make clear to you which data is necessary in connection to a particular service and why we need it.
For some of our services users, for example hearing support service users, we may also record information about your mental or physical health which is classified as “sensitive personal information”.
We will only use this information for the purposes of dealing with your enquiry or providing the individual service that you require.
We will not pass on your details to anyone else without your express permission.
5. HOW AND WHEN DO WE COLLECT YOUR PERSONAL DATA?more
We may collect information from you face to face, via phone, via email, via our website, via post, via fax or via application forms or via a referral from one of our partners. We collect information from you in the following ways:
When you interact with us directly
This could be:
- When you access any of our services.
- When you ask a member of our staff to send you information about a service or product.
- When you register with us for training or an event,
- When you make a donation to us.
- When you contact us by any means with queries, complaints etc.
- When you purchase something from our website or in person.
- When you fill out any forms. For example, if an accident happens on our premises, a member of our staff may collect your personal information as part of the investigation.
- When you choose to respond to one of our surveys.
- When you apply for a job with us.
- When you apply for a volunteering opportunity with us.
- Employee data is governed by a separate privacy notice.
- When you interact with us through partners. For example, this could be when you are referred to one of our services by another organisation such as hospital audiology services.
- When you interact with us through third parties. For example, if you provide a donation through a third party such as Just Giving or one of the other third parties that we work with and provide your consent for your personal information to be shared with us.
- When you access Shropshire RCC social media. We might also obtain your personal data through your use of social media such as Facebook, Twitter, LinkedIn or YouTube, depending on your settings or the privacy notices of these social media and messaging services. To change your settings on these services, please refer to their individual privacy notices, which will tell you how to do this (all links open in a new window; please note we can’t be responsible for the content of external websites):
6. DIRECT MARKETINGmore
We will only contact you about our work and how you can support Shropshire RCC by phone, email, post or text message, if you have agreed for us to contact you in this manner.
To stop receiving direct marketing communications from us:
Email us at firstname.lastname@example.org or write to us at Marketing Manager, Shropshire RCC, 4 The Creative Quarter, Shrewsbury Business Park, Shrewsbury, Shropshire. SY2 6LG.
7. HOW WE PROTECT YOUR PERSONAL DATAmore
We treat your data with the utmost care. We employ appropriate administrative, technical, organisational, and physical security measures to protect your information and data against accidental or unlawful destruction, loss, or alteration, and against unauthorised disclosure and access.
We use standard industry practices to protect user information, including firewalls and SSL encryption. Our staff and volunteers follow detailed data protection procedures when handling personal data.
Unfortunately, no data transmission or storage can be guaranteed to be 100% secure. While we strive to protect your personal information, we cannot guarantee security of the information you transmit to us via email or through our websites.
8. HOW LONG WILL WE KEEP YOUR PERSONAL DATA?more
Whenever we collect or process your personal data, we will only keep it for as long as is necessary for the purpose for which it was collected. This will be based on either a legal requirement (where a law says we have to keep information for a specific period of time) or in line with the the Information Governance Alliance’s guidelines.
At the end of that retention period, your data will either be deleted completely or anonymised, for example by aggregation with other data so that it can be used in a non-identifiable way for statistical analysis and business planning. Paper records are confidentially shredded.
Some examples of personal data retention periods:
Donations subject to Gift Aid
We will keep a record of your Gift Aid donation for seven years to comply with HMRC rules.
Individual Grant Applications
If you are successful in receiving an individual grant award from Shropshire RCC we will retain your grant application for 7 years. If you are not successful the information will be retained for 2 years.
If you request that we stop sending you marketing materials we will keep a record of your contact details and the minimum appropriate information to enable us to comply with your request not to be contacted by us.
9. WHO DO WE SHARE YOUR PERSONAL DATA WITH?more
The personal information we collect about you will be used by our staff (and volunteers) at Shropshire RCC so that we can support you.
We will never sell or share your personal information with organisations so that they can contact you for any marketing activities. Nor do we sell any information about your web browsing activity.
Examples of the kind of third parties we work with are IT companies who support our websites and other business systems. They are required to comply with all relevant Data Protection Laws and to ensure that your privacy is respected and protected at all times.
We will only share your data with third parties for their own purposes in very specific circumstances, for example if you are a Wheels to Work client and you have an accident on one of our mopeds we may be required to disclosure your personal data to the police or other enforcement body, upon a valid request to do so.
10. WHAT ARE YOUR RIGHTS OVER YOUR PERSONAL DATA?more
The data that we keep about you is your data and we ensure that we keep it confidential and it is used appropriately. You have the following rights when it comes to your data.
- You have the right to request a copy of all of the data we keep about you. Generally, we will not charge for this service;
- You have the right to ask us to correct any data we have which you believe to be inaccurate. You can also request that we restrict all processing of your data while we consider your rectification request;
- You have the right to request that we erase any of your personal data which is no longer necessary for the purpose we originally collected it for.
- You may also request that we restrict processing if we no longer require your personal data for the purpose we originally collected it for, but you do not wish for it to be erased.
- You can ask for your data to be erased if we have asked for your consent to process your data. You can withdraw consent at any time – please contact us to do so.
- If we are processing your data as part of our legitimate interests as an organisation or in order to complete a task in the public interest, you have the right to object to that processing. We will restrict all processing of this data while we look into your objection.
- Ask us to stop using your personal data for direct marketing (either through specific channels, or all channels). We must always comply with your request.
Checking your identity
To protect the confidentiality of your information, we will ask you to verify your identity before proceeding with any request you make under this Privacy Notice. If you have authorised a third party to submit a request on your behalf, we will ask them to prove they have your permission to act. You may need to provide adequate information for our staff to be able to identify you, for example, a passport or driver’s licence. This is to make sure that data is not shared with the wrong person inappropriately. We will always respond to your request as soon as possible and at the latest within one month.
11. CONTACTING THE REGULATORmore
If you feel that your data has not been handled correctly, or you are unhappy with our response to any requests you have made to us regarding the use of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office.
You can contact them by calling 0303 123 1113 (local rate) or 01625 545745 (national rate). Or go online to www.ico.org.uk/concerns (opens in a new window; please note we can't be responsible for the content of external websites). Or write to them at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
12. ANY QUESTIONS?more
We hope this Privacy Notice has been helpful in setting out the way we handle your personal data and your rights to control it.
To exercise any of your rights, or ask us any questions about our data protection practices, please either speak to your Shropshire RCC contact (if you have one) or telephone 01743 360641 and ask to speak to a member of the Senior Management Team. You can also write to us at:
Information Governance, Shropshire RCC, 4 The Creative Quarter, Shrewsbury Business Park, Shrewsbury, Shropshire. SY2 6LG.
This notice was last updated on 24/05/2018