(those that work for us in a paid or unpaid capacity)
About us
We, at The James Foundation, are a data controller for the purposes of the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA 2018).
This means that we are responsible for deciding how we hold and use personal information about you.
We are required, under data protection legislation, to tell you what information we hold about you, why we hold it, how we use it and to tell you about your rights.
This notice applies to current and former trustees, staff, volunteers and contractors.
This notice does not form part of any contract of employment or other contract to provide services.
We publish this notice on our website and may update it at any time.
It is important that you read this notice and any updates, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.
Data protection principles
We will comply with data protection law.
This says that the personal information we hold about you must be:
- used lawfully, fairly and in a transparent way;
- collected only for valid purposes that we have clearly explained to you and not used in any
way that is incompatible with those purposes;
- relevant to the purposes we have told you about and limited only to those purposes;
- accurate and kept up to date;
- kept only as long as necessary for the purposes we have told you about;
- kept securely.
The kind of information that we collect, process, hold and share
Depending on the nature of your association with Luna’s Fund, this could include the necessary personal information, but may also include certain special category information of a more sensitive nature:
- personal identifiers (such as, but not limited to, name, address, contact details, employee number and national insurance number);
- characteristics (such as, but not limited to, gender, race or ethnicity, religious beliefs, sexual orientation, marital status, Trade Union membership and nationality);
- information about criminal convictions and offences;
- employment particulars (such as, but not limited to, work history, start date, end date, working hours, post, roles, job title, professional membership, salary information and pension scheme details);
- information about your health, medical and medical administration (such as, but not limited to, fit notes, health assessments, occupational health referrals, disability, accident reports, medical conditions, health and sickness records);
- attendance and absence information (such as, but not limited to, signing in sheets, additional time worked, number of absences, absence dates and reasons);
- qualifications and training (such as, but not limited to, formal qualifications and training records);
- personal identification (such as, but not limited to, photograph, passport, birth certificate, marriage certificate and utility bill);
- next of kin and emergency contact information;
- financial information (such as, but not limited to, bank account details, payroll records and
tax status information);
- location of employment or workplace;
- travel information (such as, but not limited to, driving licence details, vehicle registration,
vehicle insurance);
- recruitment information (such as, but not limited to, Disclosure and Barring Service
information, right to work documentation, references and other information included in a
CV or cover letter or as part of the application process);
- performance and appraisal information;
- disciplinary and grievance information;
- CCTV footage and other information obtained through electronic means;
- information about your use of our information and communications systems;
- outside activity information (such as, but not limited to directorships, trusteeships,
employment, related party information).
Why we collect and use this information
We will only use your personal information when the law allows us to.
Most commonly, we will use your personal information in the following circumstances, to:
- administer the contract we have entered into with you;
- pay you, if you are an employee, and deduct tax and National Insurance contributions;
- make pension deductions and liaise with your pension provider;
- determine the terms on which you work for us;
- check you are legally entitled to work in the UK;
- safeguard vulnerable groups;
- conduct performance reviews, manage performance and determine performance
requirements;
- make decisions about salary reviews and remuneration;
- provide training and development opportunities;
- enable the development of a comprehensive picture of our workforce and how it is
deployed;
- inform the development of recruitment and retention policies and to make decisions on
recruitment, appointments and promotions;
- manage the charity and plan for the future, including accounting and auditing;
- assess qualifications for a particular job or task, including decisions about promotions;
- gather evidence for possible grievance or disciplinary hearings;
- deal with legal issues involving you, or other employees, workers, volunteers, trustees and
contractors, including accidents at work;
- ascertain your fitness to work and make reasonable adjustments under disability discrimination legislation;
- manage your attendance and sickness absence;
- comply with health and safety obligations and manage your wellbeing;
- prevent and detect fraud;
- ensure your suitability and legal status to drive on behalf of the charity;
- make decisions about your continued employment or engagement;
- make arrangements for the termination of our working relationship;
- provide effective charity governance;
- monitor your use of our information and communication systems to ensure compliance
with our policies;
- ensure network and information security, including preventing unauthorised access to our
computer and electronic communications systems and preventing malicious software
distribution;
- conduct data analytics studies to review and better understand employee retention an attrition rates;
- meet our equality objectives.
We will use your particularly sensitive personal information in the following ways:
- we will use information relating to leaves of absence, which may include sickness absence or family related leaves, to comply with our policies or employment and other laws;
- we will use information about your physical or mental health, or disability status, to ensure your health and safety in the workplace and to assess your fitness to work, to provide appropriate workplace adjustments, to monitor and manage sickness absence and to administer benefits;
- we will use information about your gender, race or national or ethnic origin, religious, philosophical or moral beliefs, or your sexual life or sexual orientation, to ensure meaningful equality monitoring;
- we will use Trade Union membership information to pay trade union premiums, register the status of a protected employee and to comply with employment law obligations.
- we will use information about criminal convictions and offences to inform our decisions about your suitability for employment, or continued employment, including in relation to our statutory duty to safeguard vulnerable groups.
The lawful bases on which we process this information
We will only use your personal information when the law allows us to.
Most commonly, we will use your personal information in the following circumstances:
- where we need to perform the contract we have entered into with you;
- where we need to comply with a legal obligation;
- where it is necessary for our legitimate interests (or those of a third party) and your
interests and fundamental rights do not override those interests;
- where we need to protect your interests or vital interests (or someone else’s).
Collecting this information
We typically collect personal information about trustees, staff, volunteers and contractors through the application, recruitment, selection and appointment processes, either directly from candidates or sometimes from an employment agency or background check provider.
We may sometimes collect additional information from third parties including former employers or background check agencies.
We will collect additional personal information in the course of role-related activities throughout the period of you being engaged by us, whether your work is paid or provided on a voluntary basis.
While the majority of information you provide to us is mandatory, some of it is provided to us on a voluntary basis.
In order to comply with data protection legislation, we will inform you whether you are required to provide certain information to us or if you have a choice in this.
If you fail to provide personal information
If you fail to provide certain information when requested, we may not be able to perform the contract we have entered into with you (such as paying you or providing a benefit), or we may be prevented from complying with our legal obligations (such as to ensure the health, safety and wellbeing of our workers) or from fulfilling our charitable objects.
Change of purpose
We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.
If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
Please note that we may process your personal information without your knowledge or consent, in compliance with what we have stated above, where this is required or permitted by law.
Retention of your information
We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements.
Details of retention periods for different aspects of your personal information are available in our retention policy, which can be found on our website.
To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.
Once you are no longer a trustee, member of staff, volunteer or contractor of the charity we will retain and securely destroy your personal information in accordance with our data retention policy or any applicable laws and regulations.
We will hold your personnel file for a period of 6 years from the date on which your employment with us ended.
Who we share this information with
We routinely share this information with the following third parties:
- HMRC;
- our payroll provider;
- our pensions administrators.
We share specific, relevant elements of information with:
- our legal advisors;
- our insurers;
- our occupational health advisors.
In addition, we also use third party software systems to host, but not process or access, our workforce data:
- information management systems.
Requesting access to your personal data
You have the right to request access to the information that we hold relating to you. To make a request for your personal information, contact our Data Protection Officer.
Your data rights
You have the right to:
- object to processing of personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground;
- prevent processing for the purpose of direct marketing;
- object to decisions being taken by automated means;
- in certain circumstances, have inaccurate personal data rectified, restricted, erased or
destroyed;
- request the transfer of your information to another party;
- seek redress for any breach of data protection legislation.
Concerns
If you have a concern about the way we are collecting or using your personal data, we ask that you raise your concern with us in the first instance.
Alternatively, you can contact the Information Commissioner’s Office at: https://ico.org.uk/concerns
Data security
We have put in place measures to protect the security of your information.
Third parties will only process your personal information on our instructions and where they have agreed to treat the information confidentially, to keep it secure and to be compliant with the prevailing data protection legislation.
We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.
In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a genuine need to know.
They will only process your personal information on our instructions and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.
Data Protection Officer
We have appointed a Data Protection Officer (DPO) to oversee compliance with this privacy notice.
If you have any questions about this privacy notice or how we handle your personal information, please contact the DPO.
You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.
If you would like to discuss anything in this privacy notice, please email: info@thejamesfoundation.co.uk
