Privacy Notice Staff, Volunteer or Prospective Staff

1625 Independent People is a charity and a registered society (Co-operative and Community Benefit Societies Act 2014, reg: 23964R exempt from registration with the Charity Commission).
 
Our registered office is Kingsley Hall, 59 Old Market Street, Bristol,  BS2 0ER.
 
Our designated Appointed Person is the Corporate Services Director, who can be contacted at: 

• 59 Old Market Street, Bristol, BS2 OER
• 0117 317 8800
• data.controller@1625ip.co.uk

We are registered with the Information Commissioner's Office and act as the data controller when processing your personal information (Registration number - Z2300287).

We process your personal information to meet our obligations to you and others - and to provide you with information about our existing services or new ones.
 
We will only ask for the minimum amount that we need.
 
What personal information do we collect?  

• Name
• Date of birth / age
• Home address
• Email – personal
• Telephone numbers
• Next of kin
• Gender / gender identity
• Your physical description
• National Insurance number
• Passport details
• Driving licence details
• IP address
• Relationship / marital status
• Country of origin and immigration status
• Language(s) you use
• Education, employment and training / qualification records
• If you have any children / dependents
• Housing and homelessness records
• Financial and bank details
• Tax status
• CCTV imagery
• Salary, annual leave and pension information
• Recruitment information, including right to work documentation
• Work performance information and / or references from people who have known you in a work or volunteering capacity
• Absence from work, grievance, disciplinary and complaints records
• Vehicle(s) registration, description and insurance details
• Legal and / or contractual records
• History of what you have consented to us processing (where applicable)

Why we collect and process your personal information
 
The lawful basis for collecting and processing your personal data, will fall under one or more of the following categories (of Article 6 of the GDPR): 

• Consent: when you have given us consent
• Contract: when we have a contract with you or might do in the future
• Legal obligation: when we have to comply with the law
• Vital interests: when we have to protect somebody’s life
• Public task: when we have to perform a task in the public interest
• Legitimate interests: when it is for our legitimate business interests.

For more information, the link to these categories is here
https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/
 
Special category data
Due to the type of services we offer, 1625 Independent People sometimes needs to collect and process sensitive personal information about you – this is known as ‘special category data’.
 
We only collect this so we can deliver our services (under our contracts) and plan fundraising activity so we can develop new services.
 
Some special category data is protected by extra safeguards under the GDPR and we might need your consent to collect and process it.
 
Special category data includes:

• Race/ ethnic origin
• Religion
• Philosophical beliefs
• Health and medical information, including any access, support and dietary needs
• Political affiliation and trade union membership
• Genetic data
• Biometric data, e.g. fingerprint building access
• Photo ID
• Sexual orientation
• Criminal offences / criminal convictions
• Videos and photographs 

Why we collect and process your special category personal information
 
Special category data may fall under one or more of these categories (as listed under Article 9 of the GDPR):   

• Consent: when you have given us consent
• Employment:  when we need it to meet our responsibilities in relation to employment, social security and social protection law – or we both need it to exercise our rights in employment
• Vital interests: when we have to protect somebody’s life
• Legitimate activities: when it is for our legitimate business activity  - as long as it is not disclosed to anyone else without your consent
• Published by data subject: when it relates to information you have already made public
• Legal obligation: when we need it for legal claims or court action
• Substantial public interest: when there is a substantial public interest, but this will only be proportionate and we will safeguard your rights and the interests
• Health care: when it is for preventative or occupational medicine, the assessment of the working capacity of an employee, medical diagnosis, the provision of health or social care or treatment
• Public health: when it is in the public interest in the area of public health
• Archiving: when it is needed for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.

For more information, the link to these categories is here
https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/special-category-data/

We collect your personal information in the following ways:
 
When you give it to use directly
Examples of how you may give us your information might include: 

• Signing up for one of our events
• Communicating with us. 

When someone else gives it to us
We might collect personal information about you from the following places: 

• Online forms / databases – our own or from other organisations
• Sponsorship, referral and application forms / CVs – from you or from other organisations
• Post, email, text and telephone – from you or from other organisations
• Photographs, video and observation - including CCTV
• Records of meetings and interviews – with you, other people or other organisations
• Verbally – from you, other organisations and other individuals. 

The organisations that we get personal information from might be in the public and private sector.
 
For example, they might have already employed you and are providing reference information to us.

We need your data so we can: 

• Give you information about new services or ways to get involved with the organisation
• Enter into a contract with you – e.g. provide you with a voluntary role or a job
• To meet our legal responsibilities in the following areas:
  • Data protection / privacy
  • Marketing and communications
  • Employment, equalities, housing / homelessness, care, health
  • Safeguarding, crime / policing / criminal justice
  • Financial security and fraud prevention
  • Environment and health and safety
  • For business accounting, insurance and tax purposes. 

We will occasionally send you marketing information where we have assessed that it is beneficial to you as a supporter and also in our interests. Such information will be non-intrusive and is processed on the grounds of legitimate interests or by consent from you, depending on our relationship.

1625 Independent People will support you at all times to exercise your rights in in relation to our use of your personal data. Your rights will be different depending on which lawful basis we are using for processing your personal information.
 
If you would like us to act on any of the rights listed below, please contact us via data.controller@1625ip.co.uk or any member of staff, and ask for a Subject Access Request Form. You can ask someone else you know to complete and return the form to us on your behalf, or alternatively, you can ask any member of staff to help you complete the form with you. 

• Please try to be as clear as possible about what you are asking us to do
• Please send completed forms to data.controller@1625ip.co.uk
• We may ask you to confirm your identity before we look into your request
• We will aim too reply to all requests in full within 28 days, but if we think we have a valid reason for the response taking longer (upto an additional 2 months) we will let you know
• We will not normally charge a fee – only in exceptional circumstances – if this is the case, we will let you know
• In our final response to you – if we refuse your request or you are not satisfied - we will give you information about who you can complain to about our decision (see Lodging a Complaint Section).   

If you would like more detailed information about your rights, please click this link
https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/
 
The right to be informed
You have the right to be informed about personal information we process about you – which is contained within this Privacy Notice.
 
The right to access your personal information
You have the right to access personal information that 1625 Independent People processes about you, specifically: 

• What personal information we hold about you and their categories
• Why we process the information (the purpose)
• Who has the personal information been shared with – or who will it be shared with
• If you did not provide the personal information to us – who did
• How long we intend to store your personal information and the criteria we use to decide how long to store it for. 

The right to correct personal information (rectification)
If you believe that we hold any inaccurate or incomplete personal information about you, you have the right to ask us to correct it or add anything that is missing.
 
The right to erase your personal information (the right to be forgotten)
If you would like us to erase your personal information, please ask us.
 
Our response – whether we can erase all of the information or not – will depend on both the lawful basis we are using to process your data and other responsibilities we may have to hold onto it.
 
We will tell you if we can partially or fully erase your information – and give you the reasons.
 
The right to restrict processing
You have the right to ask us to stop processing your personal data, but there are limited circumstances in which you can ask this. These are:

• Where you think information is wrong and want us to correct it, you can ask us to restrict processing whilst we review your request to correct the information 
• When you think information has been unlawfully processed, but you do not want the information to be erased, only restricted
• When we think we no longer need the information, but you need us to keep it so you can deal with a legal claim
• If you have objected to us processing your data (see the right to object section) and we are considering whether we accept or refuse your objection. 

The right to object to processing
You have an unconditional right to object to us processing your personal information if it is used for marketing, including profiling you (see automated decision-making / profiling section).
Although the following categories are not unconditional, you can also object to us processing your information if:

• We use your information on what we think are our legitimate business interests (or the interests of a third party)
• We are carrying out work in the public interest or with official authority (including profiling)
• We are using your information for scientific or historical research or statistical purposes. 

When we have received an objection and we do not have grounds to refuse it, we will stop processing your personal information.
 
The right to obtain and re-use your personal information (data portability)
You also have the right to ask us to provide you with all the personal data we hold about you, so you can re-use it.
 
However, this right only applies: 

1. To personal data you have provided to us
2. Where our processing is based on your consent or if we have a contract with you

and 

3. When our processing is carried out by automated means (using electronic systems). 

If we accept your request, we will remove any information about other people (that you do not have a right to see) and we will provide your information to you or another organisation of your choice - in an electronic format that is commonly used, structured and can be read by other machines.
 
Your rights related to automated decision-making / profiling
Automated individual decision-making is when a decision is made by automated means without any human involvement. It does not have to involve profiling, although it often will do.
 
Profiling is any form of automated processing of personal information that uses the personal information to evaluate certain personal aspects relating to a person, in particular to analyse or predict aspects concerning that person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
 
Organisations use profiling to:

• Find something out about individuals’ preferences;
• Predict their behaviour; and/or
• Make decisions about them. 

Automated individual decision-making and profiling can lead to quicker and more consistent decisions. But if they are used irresponsibly there are significant risks for individuals. The GDPR provisions are designed to address these risks.
 
Automated decision-making / profiling at 1625 Independent People
 
If we receive a donation from you, or you show an interest in us, we may manually look you up, to send you a thank you for your support.
Furthermore, we may build a profile on our supporters to gain a greater understanding of out supporters, to ensure that our communications are relevant and timely, and to provide an improved experience for our supporters. Profiling allows us to the motivations target our resources effectively.
This enables us to communicate with our supporters more effectively and to reach out to individuals who may wish to give additional support with a further monetary gift or to volunteer their time/services to support homeless young people.  We may on occasion use third party suppliers to undertake these activities on our behalf and provide them with your information to the extent required, but this will only be done with GDPR compliant suppliers.  For more information on how we work with third parties, please see ‘Third Party’.
 
Role of consent for auto decision making
 
When you have consented to us using your personal information or providing you with promotional offers and marketing, you are free to withdraw this consent at any time – and this will not put you at any disadvantage in respect of the services or support we provide to you (please see the 'Withdrawing you consent' section for how to do this).
 
Where 1625 Independent People does use automated decision-making processes, we always inform the individual and advise them of their rights. We also ensure that individuals can obtain human intervention, express their point of view and obtain an explanation of the decision and challenge it.
 
You can opt out of your data being used for profiling. However, this may mean that you stop receiving marketing communications from us or they become more generic and less relevant to you as they are no longer based on your interests in our cause. If you do wish to opt-out emailing data.controller@1625ip.co.uk, call 0117 317 8800 or write to 1625 Independent People, Kingsley Hall, 59 Old Market Street, Bristol, BS2 0ER.

Third party data processors that we use
 

Processor - organisation name	Reason(s) we use the company	What information do we give them	For more information, please read their privacy notice (link)
Accuro	To transcribe records of HR meetings	Personnel information	http://www.accuro.co.uk/privacy-policy/
Alliance Communications	Telecoms provider	Personal information	http://www.alliancecoms.com/privacy-policy/
Bluefin Group (Markel, DAS, Allianz)	Insurers	Personal data as it relates to insurance claims	https://www.bluefinunderwriting.co.uk/privacy-policy/
BRC	Recruitment agency	Agency staff data	http://www.brcjobs.com/about/privacy-statements/
Bristol City Council lone working service	Lone working system for staff	Personnel information	https://www.bristol.gov.uk/about-our-website/privacy
CCTV providers (multiple)	For offices and housing services	Video data	Please contact us for further information
Channel Comms	Telecoms provider	Names and telephone numbers	https://www.channelcomms.co.uk/privacy-policy/
Concur Holdings	Finance processor	Individual and business payment information	https://www.concur.co.uk/privacy-policy
Corrigan Associates	Auditor	Individual and business financial transactions	https://www.corriganassociates.co.uk/privacy-policy/
Hays	Recruitment agency	Agency staff data	https://www.hays.co.uk/revised-privacy-policy/index.htm
Homeless Link: In-Form (Salesforce & Spanning Back Up)	Client record management system	Service user and staff data	https://www.homeless.org.uk/privacy-and-data-protection
HSBC	Bank	Individual and business payment information	https://www.hsbc.co.uk/1/2/privacy-notice
James Andrews	Recruitment agency	Agency staff data	https://www.jarsolutions.co.uk/privacy/
Michael Page	Recruitment agency	Agency staff data	https://www.michaelpage.co.uk/privacy-policy
Move GB	Corporate gym service	Personal information	https://www.movegb.com/privacy.html
Lindsey Hall	Occupational health provider	Personnel and health information	Not currently available
Omniledger Ltd	Client housing management system	Service user and staff data	https://www.omniledger.co.uk/privacy-statement/   https://www.omniledger.co.uk/gdpr-statement/
People HR	HR database	Personnel and health information	https://www.peoplehr.com/privacy.html
Peoples Pension	Pension provider	Personal and financial information	https://thepeoplespension.co.uk/privacy/
Purple Office	Confidential waste disposal	Personal and financial information	Not currently available
Ricoh	Printing and scanning	Personal and financial information	https://www.ricoh.co.uk/privacy-policy.html
Robert Half	Recruitment agency	Agency staff data	https://www.roberthalf.co.uk/legal-information/privacy-notice
Sage (UK) Ltd (Timewade Ltd)	HR, payroll and finance service	Personnel and finance information	https://www.sage.com/en-gb/legal/privacy-and-cookies/
The Stress Management Company	Staff wellbeing survey	Personnel information	Not currently available
Triangle Consulting Social Enterprise	Support planning service	Personal and financial information	http://www.outcomesstar.org.uk/privacy-policy/
Triodos	Mortgage provider	Personal and business financial information	https://www.triodos.co.uk/en/about-triodos/important-information/privacy-statement/
UK Healthcare	Staff health provider	Personnel and health information	https://www.ukhealthcare.org.uk/privacy-statement-uk-healthcare
UK Umbrella Service	Disclosure and Barring Service provider	Personal information	Not currently available
Westcom (SW) Ltd	Mobile phone provider	Personal information	Not currently available
Westgate IT Ltd	Overall IT and IT security provider	All types of data	https://westgateit.co.uk/Privacy_Policy.pdf
Zurich	Insurers (property)	Personal data as it relates to buildings	https://www.zurich.co.uk/en/services/privacy

 

1625 Independent People takes your right to privacy seriously and takes every reasonable measure and precaution to protect and secure your personal data.
 
We work hard to protect your information from unauthorised access, alteration, disclosure or destruction and have several layers of security measures in place, including but not limited to: 

• Website security  
• Firewalls
• Anti-virus / anti-malware software
• Encryption of computers and portable electronic devices – which are also password protected
• Encrypted emails
• Restricted access to records and systems
• Policies and procedures that staff must follow - including data breach procedures
• Lockable offices and filing cabinets in all of our offices
• Regular monitoring of processes to test security. 

We will notify you at the earliest possible opportunity time if we have a data breach and we think it will result in a high risk. We will give you contact details for the person managing any breach and we will tell you: 

• What happened
• Whether there is risk to your personal information and if you should do anything
• What we have done and will continue to do to address the breach – to minimise any risk to you. 

Depending on the severity of a data breach, we may also inform the Information Commissioners Office. Their guidance on data breaches can be found here https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/personal-data-breaches/.

This section tells you about the safeguards we have in place that keep your personal information safe and private – if it is sent to countries or international organisation outside the EU.
 
To process data, 1625 Independent People utilise some products or services (or parts of them) that may be hosted or stored in non-EU countries, which means that we may transfer your information outside the European Economic Area ("EEA") for the below purposes: 

• To follow your instructions
• Comply with a legal duty or contract with you  
• Work with our suppliers (third party processors) who help us to run our business. 

Therefore, for example, when you use our services, use our website, send us an email or sign up to our newsletter the personal information you submit may be stored on servers which are hosted in non-EU countries.
 
Where this is the case, we take steps to ensure that those providers use the necessary level of protection to process your information securely. Third party processors that we use must abide by strict agreements and measures set out by 1625 Independent People to protect your data and comply with the relevant data protection laws.
 
If you would like a copy of the safeguards that our third party processors use, please refer to their own privacy statement in the third party processors section or contact us to request it.

In some circumstances, we have a legal or contractual responsibility to collect and provide your personal information to others, especially if we have to by law.
 
When we collect personal information from you, we will make it clear which categories or types of data are required and which are not – this will include which categories can only be processed with your consent.
 
You are not obliged to provide your personal information to us. However, as most of the information we collect is required for us to provide you with our services or employment - and to meet our obligations and our legitimate business interests - we will not be able to offer some our services if you do not provide certain personal information.

As noted in previous sections, we process some of your personal information under the ‘legitimate interests’ legal basis.
 
Where this is the case, we have carried out a thorough ‘Legitimate Interests Assessment’ to ensure that we have weighed your interests and any risk posed to you against our own interests - ensuring that they are proportionate and appropriate. You can request a summary of this assessment.
 
We use the legitimate interests legal basis for processing your data in the following categories:
 

The purpose of processing this data using legitimate interests	Examples of data categories
Employment, including to monitor and report on equalities data	Special category data

1625 Independent People only ever retains personal information for as long as is necessary and we have retention policies in place to make sure we delete your personal data in a secure way once it has expired.
 
This includes deletion from the systems of third party processors that we use.
 
We have a Data Retention Protocol in place, which contains the criteria we use to decide how long to store each element of your personal data.
 
How long we store your data depends on our relationship with you, what the data is and what type of responsibilities we have, for example, legal requirements or industry guidelines.
 
Where you have consented to us using your details for direct marketing, we will keep your data until you notify us otherwise and / or withdraw your consent.
 
You can request deletion of your data at any time by contacting us as noted in the ‘Your Rights’ section.

In some situations, we will need your consent before we can process your personal information.
This includes the processing of some ‘special category’ information and when we may want to share your personal information with other services or people.
We will provide the consent request in a way that should be easy for you to understand and gives you the opportunity to opt in. We will separate out all categories, so you can choose or decline each category.
You have the right to refuse to give us consent – this will not cause you any detriment, but you may not be able to receive some information from us or hear about new services or ways to get involved with our activities or we may not be able to share information with others.
You can modify or withdraw consent at any time, which we will act on immediately, unless we have a legitimate or legal reason for not doing so.
 
Employees, volunteers and prospective employees
We do not use consent as a legal basis for obtaining or processing personal information of staff, volunteers or prospective staff. If the lawful basis for our processing changes and consent becomes applicable, prospective volunteers and staff will be asked to consent to processing at the point they apply to work with us.
 
Our HR policies and employment / volunteer contracts ensure that employees are provided with the appropriate information disclosure and are aware of how we process their data and why – and when they have the option to provide signed consent.
 
All employees are provided with our Induction Handbook which informs them of their rights under the data protection laws and how to exercise these rights and are provided with a Privacy Notice specific to the personal information we collect and process about them.

You can withdraw your consent at any time – where we rely on consent to process your personal information.
You can also tell us at any time if you want to stop receiving direct marketing information.
If you make either of these choices, it will not detrimentally affect our relationship with you. We will stop processing your personal information or sending you unwanted information immediately and keep a record of your request. You can opt back in and give us your consent at any time, if you choose to do so.
If you wish to withdraw your consent, please email data.controller@1625ip.co.uk or please ask a member of our staff to help you do this.

We keep our privacy notice under regular review and from time to time we may change the content, especially when data protection laws change. If we make any significant changes we will draw attention to them.

This Privacy Notice was last updated on 24 May 2018. Older versions can be obtained by contacting us.

1625 Independent People only processes your personal information in compliance with this Privacy Notice and in accordance with the relevant data protection laws.
 
If you wish to make a complaint regarding the processing of your personal data or you are unsatisfied with how we have handled your information, you have the right to lodge a complaint with the supervisory authority.
 
The supervisory authority contact details are:  

• Information Commissioner’s Office
• Telephone: 0303 123 1113
• Website (report a concern page) https://ico.org.uk/concerns/
• Live chat (9am – 5pm, Mon – Fri) https://ico.org.uk/global/contact-us/live-chat

Our details are: 

• 1625 Independent People
• Address: 59 Old Market Street, Bristol, BS2 OER

• Telephone: 0117 317 8800
• Email: data.controller@1625ip.co.uk

A ‘cookie’ is a small piece of data sent from a website and stored on the user’s computer by the user’s web browser while the user is browsing. When you visit a site that uses cookies for the first time, a cookie is downloaded onto your computer/mobile device so that the next time you visit that site, your device will remember useful information such as items added in the shopping cart, visited pages or logging in options.
 
Cookies are widely used in order to make websites work, or to work more efficiently, and our site relies on cookies to optimise user experience and for features and services to function properly.
 
Most web browsers allow some control to restrict or block cookies through the browser settings, however if you disable cookies you may find this affects your ability to use certain parts of our website or services. For more information about cookies visit https://www.aboutcookies.org.