Privacy Policy Procedures

  1.  

    PRIVACY POLICY AND DATA PROTECTION PROCEDURES

    The Right Course

    Registered charity 1190520 (England and Wales)

     

     

     

    To make a complaint, to request information on how we store your data or to receive a copy of your data we hold on file, please contact:

     

    CEO: Simon Sheehan – simon.sheehan@therightcourse.org.uk 07974 229 183

    Trustee Responsible: Ali Zaidi – ali.zaidi@therightcourse.org.uk

    Contact full board on: trustee@therightcourse.org.uk

     

     

     

    INTRODUCTION

    1. This document describes TRC’s policy and procedures to ensure compliance with the Data Protection Act 1998 and 2003 Regulations, the EU Data Protection Directive and General Data Protection Regulation (GDPR) 2018.
    2. This policy and procedures document applies to all Personal Data held or processed by TRC at its London office, by remote and home workers and by designated volunteer It also applies to everyone who has access to, or who may potentially have access to, any Personal Data contained on computer databases, held on computer or in manual records held or being processed on behalf of TRC. This includes established and temporary employees who work under a contract of employment, all agency staff, contractors and consultants who work under a contract for service, volunteers and possibly others.
    3. Appendix I of this policy and procedures document outlines TRC’s additional data handling processes that relate specifically to GDPR 2018.

    THE DATA PROTECTION ACT 1998

    1. The Act sets rules for processing personal information, or Data, and applies to paper records as well as those held on computer, whether that be a database, spreadsheet, word-processing folder etc. In addition it allows individuals certain rights regarding information about them held by TRC in ‘relevant’ electronic or manual
    2. Personal Data as defined by the Act consists of information which relates to a living individual who can be identified from that information (or from that and other information in the possession of the Data Controller), including any expression of opinion about the individual and any indications of the intention of the Data Controller or any other person in respect of that individual. Examples of Personal Data include: name, postal address, email address, telephone – including mobile – number, bank account, credit/debit card This list is not exhaustive.

     

    DEFINITIONS

    1. Certain specific terms used in this document comply with those used within the Data Protection Act 1998 and GDPR 2018, and are detailed below:
      • “Data” is information which:
        • is processed by equipment operating automatically in response to instructions given for that purpose;
        • is recorded with the intention that it should be so processed;
        • is recorded as part of a relevant filing
      • “Relevant Filing System” means any set of information that is not processed by means of equipment but is structured in such a way that particular information relating to a particular individual is readily
      • “Personal Data” is data consisting of information which relates to a living individual who can be identified from that information (or from that and other information in the possession of the Data Controller), including any expression of opinion about the individual and any indications of the intention of the Data Controller or any other person in respect of that individual. Examples of personal data include: name, postal address, email address, telephone – including mobile – number, bank account, credit/debit card This list is not exhaustive.
      • “Sensitive Personal Data” means Personal Data relating to racial or ethnic origins, political opinions or beliefs, religious or other beliefs, TU membership, physical or mental health, disabilities, sexual life and the commission or alleged commission of any criminal offences. Sensitive personal data can only be processed under strict conditions which include, but is not restricted to, having the explicit consent of the individual Data Subject.
      • “Data Controller” is a person who determines the purposes for which and the manner in which Personal Data is to be
      • “Data Subject” is an individual who is the subject of Personal
      • “Processing” is obtaining, recording, holding or carrying out any operation on data, such as the organisation, adaptation, alteration, retrieval, disclosure, dissemination, rearranging or destruction of the information or data.
      • “Data Processor” is any person who processes data on behalf of the Data Controller. POLICY STATEMENT
    2. TRC will comply with its obligations under the Data Protection Act 1998 and GDPRF 2018 and wishes to assure Trustees, employees (current and former), volunteers, donors and supporters and all other persons about whom it retains Personal Data, that such Data will be processed in compliance with the Act and will be stored in a secure, confidential and appropriate manner. Such Data will only be stored whilst relevant and will not be disclosed to any person outside the Charity without the Data Subject’s written

     

    authority, or unless required by law. “Sensitive” and other “Personal Data” relating to an individual will only be processed by TRC:

    • if this Data is required in connection with the employment of that individual by TRC or;
    • for purposes for which was originally gathered, and;
    • if held and processed in accordance with any requirements or instructions imposed by the Data

    EXEMPTIONS

    1. The following sets of information are exempt from the Data Protection Act 1998 and GDPR 2018 and are therefore excluded from the detailed provisions of this policy, but the spirit of the policy will be followed so far as is reasonably practicable.
      • Primary Primary exemptions include:
        • information which DMTFYP is required by law to make public;
        • information which DMTFYP is required to make in connection with legal proceedings;
        • information relating to national security;
        • Personal Data processed for the prevention of crime or prosecution of offenders or for the collection of tax;
        • information relating to any regulatory activity;
      • Miscellaneous Miscellaneous exemptions include:
        • Management Forecasts and Management Planning. This exemption is available to business to protect confidentiality of Personal Data processed for the purposes of management forecasting or management
        • Where Personal Data consists of records of the intentions of the Data Controller in relation to any negotiations with the Data Subject, such Personal Data is exempt from the subject information provisions to the extent that such information would prejudice negotiations.

    RELEASE OF PERSONAL DATA

    1. Subject to the exemptions of Paragraph 8, no Personal Data, whether held on computer or in hard copy will be released to any individual or organisation outside of TRC without the consent of the Data Subject and on the authority of the CEO of
    2. Within TRC access to Personal Data will only be on a ‘need to know’ basis when it is to be used for the tasks for which it was gathered and in strict accordance with this

     

    QUALITY AND CURRENCY OF PERSONAL DATA

    1. TRC will hold the minimum Personal Data necessary to enable it to perform its business. The Data will be erased once the need to hold it has passed. This stipulation shall, however, be subject to the specific requirements of the CEO, statutory legislation and authorised External Auditors who may require Data to be held to facilitate the closing or audit of TRC ‘s accounts.
    2. Every effort will be made to ensure that Data is accurate and up-to-date, and that inaccuracies are corrected without unnecessary delay. To this end employees are required to inform the CEO of any changes in their personal circumstances, e.g. address, telephone numbers, next of kin etc, as soon as the change
    3. TRC considers it justifiable under the Act to process Personal Data which it holds for Human Resource purposes when:
      • The Data Subject has been informed that Sensitive Data about them will be held by TRC;
      • The Data Subject has given their consent to Sensitive Data being held about them;
      • The processing is necessary to fulfil a contract to which the Data Subject is party;
      • The processing is necessary for legal purposes e.g. P.A.Y.E. and N.I. SECURITY OF INFORMATION
    4. Appropriate security measures will be taken against unauthorised access to, or alteration, disclosure or destruction of, Personal Data and against accidental loss or destruction of Personal
    5. TRC’s computers must not be used for private work, for domestic or recreational purposes or on behalf of other organisations except where this has been specifically approved in advance by the CEO,
    6. Manual records must only be used for their designated purposes. ACCESS RIGHTS FOR DATA SUBJECTS
    7. TRC will make all reasonable efforts to ensure that Data Subjects are aware of the Data which is kept about them, where it is kept and why it is kept. TRC will provide any individual who makes a subject access request in a reasonable manner a reply stating whether or not TRC holds Personal Data about that individual and, if so, a written copy in clear language of the current Data held. Where the information has to be provided in a coded form, an explanation of the meaning of the codes shall be provided. A small fee may be charged for dealing with the
    8. If the information to be provided to a Data Subject identifies another person in addition to the Data Subject, the information will not be disclosed unless and until the other person has given written authorisation for the disclosure to be made. Separate applications shall be required for each of TRC’s entries in the Data Protection Register.

     

    1. Subject access requests should be made in writing to the CEO, TRC and must supply sufficient information both to confirm the individual’s identity, and to locate the Data The response to the application will be met as soon as possible and in any case, within 40 days of its receipt. The forty-day period commences when TRC receives sufficient information to respond to the Data Subject’s request. An application may be refused for any one register entry if requested more frequently than once in 3 months or twice in a 12 month period.
    2. Material inaccuracies or omissions discovered as a result of an enquiry will be corrected without delay, and the individual will be sent an amended copy of the data without further

    RESPONSIBILITY

    1. The CEO is responsible for submitting applications for notification to the Information Commissioner as required by the Data Protection Act 1998 and GDPR 2018 and for ensuring the maintenance, regular review and updating of this
    2. The CEO is responsible for appointing Data Controllers within their areas of
    3. Individual managers are responsible for ensuring this policy is applied within their own
    4. All those persons referred to within the scope of this policy are required to adhere to its terms and

    POLICY REVIEW

    1. This policy will be reviewed from time to time, to take account of changing legislation, organisational needs and trends in best
    2. Members of staff and volunteers will be informed of the changes as soon as possible and certainly no later than four weeks after effect.

    FURTHER ADVICE AND INFORMATION

    1. Further advice and information is available from the CEO, TRC who reserves the right to seek specialist advice from bona fide external sources.
    2. To make a complaint, to request information on how we store your data or to receive a copy of your data we hold on file, please contact:

    CEO: Simon Sheehan – simon.sheehan@therightcourse.org.uk 07974 229 183 Trustee Responsible: Ali Zaidi – ali.zaidi@therightcourse.org.uk

    Contact full board on: trustee@therightcourse.org.uk


     

    TRC’S COMPLIANCE PROCEDURES DATA PROTECTION OFFICER

    1. The Data Protection Officer for TRC is the charity’s

     

    To make a complaint, to request information on how we store your data or to receive a copy of your data we hold on file, please contact:

    CEO: Simon Sheehan – simon.sheehan@therightcourse.org.uk 07974 229 183 Trustee Responsible: Ali Zaidi – ali.zaidi@therightcourse.org.uk

    Contact full board on: trustee@therightcourse.org.uk

     

     

    PRINCIPLES

    1. TRC is committed to upholding the eight principles of the Data Protection Act 1998 by means of the following procedures:
      • Personal Data shall be processed fairly and lawfully. This is a key Principle which is encapsulated by the need to obtain the Data Subject’s consent to process his or her Data. When collecting Personal Data the Act demands that Data Subjects be notified of:
        • the name(s) of those who will be processing the Data, g. TRC;
        • the primary purpose of the processing – such as to record a donation, or provide goods and services;
        • details of other uses to which the Data may be put, e.g. sending out Highlights, appeal letters or advertising forthcoming events;
        • details of third parties to whom the Data may be disclosed;
        • how to opt out of the Data being used for anything other than the primary purpose for which it was
      • This requirement stands even when Personal Data is obtained from a third party, for example, a recruiting agency.
      • In order to comply with this Principle, ALL TRC forms whether hard copy or on the website, which collect Personal Data in any mode including, but not limited to, those for Christmas cards or other goods; events; requests for Highlights/e- newsletter, and donation forms, must include the following declarations:

    We would like to keep you up to date about our important work transforming lives through training and employment. We will only contact you through the communication channels you have given us consent for.


     

    Our communications could include our latest activities and news, fundraising campaigns, and upcoming events.

     

    Remember, you can change your mind at any time and let us know at info@therightcourse.org.uk

     

    We will keep your data securely. We will never pass your details to any third party for their marketing purposes. To read our full Privacy Policy, please click here. [with links back to this document]

     

    • TRC complies with the Data Protection Act 1998. Information on the use of personal data by TRC is available from the CEO, The Right Course, 49 Netherwood Road, London W14 0BL. While the principles of ‘good information handling’ lay clear obligations on Data Controllers, Data Subjects can take steps to prevent any mishandling of their information by ensuring that they are aware of the nature of and purpose(s) for which information is being collected from them, at the time that it is collected.
    • Photographs, Videos and Film. Photographs, video and film taken of people participating in, or attending, fundraising or other events for TRC could conceivably be used on the charity’s website, Facebook page, YouTube channels, the Annual Report, e-newsletter or in press releases. In all cases, written and time lapse specific consent must be obtained from the Data Subject for the use of their image. This permission must be retained as evidence. In addition, pictures/videos should be reviewed and updated on a regular basis to ensure they remain
    • Before placing images on the website or any other medium which can be accessed worldwide, individual Data Subjects must be informed about and give their consent to, disclosure of their Personal Data to third parties overseas and possibly outside the
    • Information Already Held on Data Subjects. The spirit of the Act points to the need to inform them, in so far as is practicable, that their Data is being held.
    • Personal data shall be obtained only for one or more specified and lawful purposes and shall not be further processed in any manner incompatible with that purpose or for those purposes. Personal Data must only be used for the purpose(s) for which it has been collected. TRC will only disclose information where the Data Subject has provided their consent in writing or for those
    • Personal Data held shall be adequate, relevant and not excessive in relation to the purpose or purposes for which it is held. Data Controllers will set and apply standards to the Data held and processed within their areas or responsibility which is to include:

     

    • Guidance as to the relevance of specific items of Personal Data.
    • Personal Data shall be accurate and where necessary kept up to date. TRC must ensure, as far as is possible, that Personal Data held is accurate and will respond to Data Subject Access Requests updating their Data where Data Processors are to continually monitor the accuracy and suitability of the Data held, taking prompt, appropriate action as necessary to bring such Data up-to-date. Training on data entry and maintenance in the Filemaker Pro database system used by TRC will be provided to all new staff and volunteers, with regular refresher training available.
    • Personal Data will only be held for so long as is necessary to achieve the specified and lawful purpose or purposes for which it was
    • Destruction of Personal Data. Personal Data including lists; letters on which a Data Subject’s address or bank details are shown (such as appeal/thank you letters); event application forms or purchase requests particularly those showing Bank/credit or debit card numbers, must NOT be thrown into a waste paper Such documents/forms MUST be shredded in a cross-shredder.
    • Personal Data will be processed in accordance with the rights of the Data Any individual about whom Personal Data is retained or is being processed will be informed, on request, in writing by the CEO of the content of that data and:
      • the purpose for which the processing is being done;
      • to whom such Data may be disclosed;
      • the source of such Data and who will have access to the Data;
      • how to have such Data corrected or suppressed.
    • The rights of a Data Subject applies equally to employees who may request details as to the nature or existence of any Personal Data which may be held on them by writing to the
    • Where such a request cannot be complied with without disclosing information relating to another individual who can be identified from that information, the CEO is not obliged to comply with that element of the request unless the other individual has consented to the disclosure of the information to the person making the
    • Employees and other Data Subjects should be aware that they are not entitled to have access to confidential references provided to third parties about them, nor access to Personal Data processed for the purposes of management forecasting or planning which may be required for the conduct of the Charity’s business, nor to any information which records the Charity’s intentions towards such individuals as may be the subject of negotiation between
    • Personal Data must be secure against unauthorised or unlawful processing, accidental loss or destruction or All employees must be alert to and

     

    take due care with regard to storage of Data and the protection of Data. Computer password protection is in place and in the case of hard copy Personal Data, filing cabinets must be locked and secure against unauthorised access.

    • Personal Data must not be:
      • left exposed on desks where unauthorised viewing or removal may be At the end of each working day all papers, disks, memory sticks etc holding Personal Data must be locked away in a secured filing cabinet.
      • removed from its normal place of storage without the authority of the Data Controller;
      • held on TRC laptops unless it is encrypted;
      • sent electronically, including by email, unless encrypted and password Personal Data submitted by means of the on-line forms on the TRC website must be encrypted.
      • stored on personal computers or laptops, or on personal memory sticks;
      • faxed or communicated over the
    • Personal Data downloaded to laptops and memory sticks must be limited to that which is absolutely necessary.
    • Contracts or Agreements with Third Parties. TRC passes Personal Data to associated third parties particularly for events administration and our into-work Any Data passed to a third party even if this is subcontracted remains the property of TRC and its processing by the third party must comply with the Act. TRC must ensure that the processing of Personal Data is carried out under a contract which is evidenced in writing and where:
      • a Data Processor acts only on the instructions of a Data Controller;
      • the third party complies with the obligations of the 7th principle which relates to security of the data, unauthorised processing and accidental loss or damage.
    • In establishing a contract with a third party to whom Personal Data is being passed, the contract should cover, in relation to the Act:
      • a commitment to security arrangements which must be at least to the same standard as that of TRC with specific procedures and policies in place together with arrangements for visiting the outsourcing company to check on their compliance with the Act;
      • contingency arrangements should the third party Data Processor not be able to Process;

     

    • confidentiality;
    • arrangements should Data Processor out-source elsewhere;
    • limitations on the Data Processor and purposes for which any other third party can use the Data;
    • to whom and on what terms are disclosures to be made (regulators, customers, police etc);
    • prior written notification should the third party decide to sell or is in financial difficulty;
    • termination arrangements, i.e. the return or verified destruction of the Personal Data by the third party on completion of the contracted activity as well as responsibility for on-going

     

     

    To make a complaint, to request information on how we store your data or to receive a copy of your data we hold on file, please contact:

    CEO: Simon Sheehan – simon.sheehan@therightcourse.org.uk 07974 229 183 Trustee Responsible: Ali Zaidi – ali.zaidi@therightcourse.org.uk

    Contact full board on: trustee@therightcourse.org.uk


     

    RECRUITMENT AND SELECTION, EMPLOYMENT AND ENDING EMPLOYMENT/ASSOCIATON WITH TRC

    1. Recruitment and Selection. The recruitment and selection process necessarily involves a prospective employer collecting and using information about an applicant. Much of this information is personal in nature and can affect an individual’s privacy. The following good practice guidance is issued by the Information Commissioner and will be followed by TRC:
      • Individuals responding to a job advertisement must be informed of the name of the charity and how the information they provide will be used. Therefore:
      • The name TRC must appear in all direct recruitment advertisements;
      • The advertisement must state that TRC will only use the personal information provided to process the
      • If a recruitment agency is being used, the Data Controller must ensure that it identifies itself in any advertisement and that it informs applicants that the personal information received by the agency will be forwarded to and held by, TRC;
      • The name TRC must be stated on any answerphone message which potential applicants are invited to
    2. References must not be taken up without the permission of the
    3. All assessment and interview notes, CVs or other forms of application together with all communication, including emails, with all applicants – even those unsuccessful – must be passed to the TRC without delay following final interviews. Interviewees may have the right to request access to their assessment and interview notes and have six months in which to bring a claim arising from the recruitment process e.g. discrimination. It is therefore important to collate all information as soon as possible in order to manage a disclosure request or as evidence in responding to a claim.
    4. Recruitment records will be retained by the CEO for a period of twelve (12) months after which they will be destroyed.
    5. All contracts of employment include an express consent by the employee to the processing of personal and sensitive information provided by them or legitimately acquired during the course of their employment by TRC.
    6. Members of Volunteer Committees and individuals on work experience placements are required to sign an agreement to maintain the privacy and confidentiality of all information in accordance with the Data Protection Act 1998 and GDPR 2018 during their association with TRC and comply with the charity’s policy and procedures.
    7. Ending Employment/Association. When ending employment, volunteering or any other form of association with TRC, Personal or Sensitive Data relating to the Charity’s donors, supporters, individual contacts or fellow employees must not be copied, down/uploaded, made note of or transferred in any way. Data Controllers are to include this directive in the Exit

     

    1. In accordance with statutory requirements Personnel files will be destroyed seven (7) years after the final date of

    NOTIFICATION

    1. It is the responsibility of all TRC Data Controllers to ensure that they advise the CEO of the following details whenever they establish a new set of data or wish to utilise Personal Data in a manner that is not already notified to the Information Commissioner:
      • the description of Personal Data and the purposes for which it is to be held or used;
      • the source from which the Data is or was obtained;
      • details of the persons to whom the Data may be disclosed;
      • the names of any countries outside the UK to which the Data may be
      • the purpose of any such use of Personal Data. DISCIPLINARY ACTION
    2. Every employee and volunteer should note that as an individual they can be held criminally liable and may have a monetary penalty notice imposed by the Information Commissioner if they knowingly or recklessly disclose personal information or the information contained therein to another person without the consent of the Data
    3. A failure to comply with this Data Protection Policy and/or Procedures document will be deemed a Gross Misconduct disciplinary offence which may result in the dismissal of the

    FURTHER ADVICE AND INFORMATION

    1. Any queries on the application or interpretation of this compliance document should be discussed with the CEO prior to any action being

     

     

    To make a complaint, to request information on how we store your data or to receive a copy of your data we hold on file, please contact:

    CEO: Simon Sheehan – simon.sheehan@therightcourse.org.uk 07974 229 183 Trustee Responsible: Ali Zaidi – ali.zaidi@therightcourse.org.uk

    Contact full board on: trustee@therightcourse.org.uk


     

    TRC SIGNATORY – DATA PROTECTION

     

     

    Signed:

    Name:             Simon Sheehan Position:     Chief Executive Officer Date:  25 May 2021

     

     

     

     

     
      

     

    Appendix I:

    Additional policies and procedures relating to the General Data Protection Regulation (GDPR 2018) which will come into EU law from May 25th 2018. The full GDPR is available at https://gdpr-info.eu/

    CONSENT

    • The central tenet of GDPR is to clarify that unambiguous and explicit consent must be given by a Data Subject for personal information to be stored and used. For TRC, this means that individuals receiving our communications and marketing materials must have given us their express consent to do
    • To request and capture this consent or refusal, TRC has devised a bespoke form, available on the website at https://therightcourse.org.uk/consent/
    • In the six months preceding GDPR coming into EU law (May 25th 2018) contact emails and letters have been sent out to the existing

    PROCESSES

    • TRC uses the password protected Filemaker Pro CRM system to store its data, including Personal Data. Filemaker is housed on an encrypted drive and a back-up of data is performed to a password cloud drive. All TRC staff and volunteers have limited access to and use Filemaker in the day-to-day operations of the
    • Training is provided to staff and volunteers on the appropriate usage, entry and storage of data on Filemaker, with refresher training available.

    CONSENT REQUESTS

    1. On receipt of a completed consent request form, which comes to email consent@therightcourse.org TRC personnel will check the record against Filemaker. Preferences are noted and a copy of the consent form saved on the encrypted
    2. New consent requests received always supersede previous consent preferences stored in Filemaker and must be replaced as soon as practicable. Normally this is within 14 days as stated on our website.

     

    DIAGRAM:

     
      

     

     

    TREATMENT OF DATA – EXAMPLE

    1. The principal communication sent out by TRC to external Data Subjects is a monthly This newsletter is sent out via MailChimp™ and recipients can unsubscribe at any time.
    2. With the application of GDPR, Data Subjects must be asked for their express consent before being added to the charity’s distribution Depending on whether they opt in or

     

    not, their data will be stored and/or treated in different ways as the diagram below shows.

     

     

    RIGHT TO COMPLAIN

    1. TRC has a full Complaints Procedure on its

    To make a complaint, to request information on how we store your data or to receive a copy of your data we hold on file, please contact:

    CEO: Simon Sheehan – simon.sheehan@therightcourse.org.uk 07974 229 183 Trustee Responsible: Ali Zaidi – ali.zaidi@therightcourse.org.uk

    Contact full board on: trustee@therightcourse.org.uk

     

     

    1. Internal data handling

    TRC has a step-by-step guide for staff and volunteers to ensure correct data handling and processing on the database ‘Filemaker’.

Full Policy