(in accordance with the General Data Protection Regulations 2016)

Introduction

As you participate in our activities, work with us, support us or use our website, we need to collect information about you. This is mainly for our daily activities, although it will also help us to understand our donors’ and customers’ preferences.

ReSkilled is committed to protecting your data and your privacy and we aim to ensure that any information you give to us is held securely and safely. ReSkilled will never sell your information for any reason whatsoever. We know that this is important and want you to be assured that you are always in control of how we use your personal information in regard to marketing and fundraising activities.

We do however need to collect and use your personal information for carefully considered and legitimate purposes which helps to ensure that we run efficiently, raise funds effectively and fulfil our charitable purposes.

Please read this notice carefully, along with any other documents referred to in it, in order to understand how we collect, use and store your personal data (Personal data is information which by itself can be used to identify you).

This notice sets out what information we collect, how we will use it, what the legal basis for this is and outline what your rights are in respect of your personal data. ReSkilled holds and processes personal details in accordance with the General Data Protection Regulations and is registered with the Information Commissioner.

The legal basis for using your personal data

GDPR provides 6 lawful reasons under which processing may be carried out. Of these, there are 3 that are relevant to ReSkilled’s operations:

• processing is necessary for the performance of a contract
• processing is necessary in it being a legitimate interest for ReSkilled to do
• the person has given consent to the processing of his or her personal data for one or more specific purposes

Performance of a contract – the main work that ReSkilled carries out involves contracts of various sorts, e.g. your participating in a project, purchasing products that we have made or giving donations that enable us to do the work that we do. This lawful basis is also required for processing financial transactions such as donations or product purchases.

Legitimate interest – ReSkilled needs to set up Information Sharing Agreements with referral agencies to ensure safety for all, both when at a project and for the referral agency to which project participants return, e.g. housing. The potential benefit and negative impact on the individual have to be considered when using this basis – see Legitimate Interests Assessment for Information Sharing with Referral Agencies.

Consent – where you have provided ReSkilled with your contact details, we will ask for your consent if we would like to use them for a specified new purpose, e.g. to keep you updated with ReSkilled’s progress and any new products. You can withdraw this consent at any time by contacting us by e-mail, in person or by phone.

The Purpose

The types of data that are needed (e.g. personal or sensitive) will vary depending on the purpose for which the data will be used – we do not need the same types of data from everyone. We will always try to be clear when communicating how we need to use your data. We use data:

1. To provide a safe environment – to inform ReSkilled of course Participants’ relevant background, e.g. ongoing health issues or criminal history in order to uphold both their safety and the safety of others. At times we may also need to contact a participant’s referring agency (e.g. housing) to share information where the safety of the individual or others, either at ReSkilled or the agency, could otherwise be at risk.
2. To facilitate ReSkilled’s pathway to employment – at the end of a Participant’s course, we will pass their Application Form and Initial Interview sheet onto Voluntary Action South West Surrey or Volunteer in Woking (as appropriate) in order to avoid the need for replication of the information.
3. For Employment purposes – Staff and Volunteers’ personal details are needed to assess their employment suitability at ReSkilled and also for contacting them, as needed for the purposes of ReSkilled’s functioning.
4. For equality monitoring – in order to monitor equality when recruiting Staff and Volunteers. This will be anonymised and stored separately upon receipt.
5. For donations – if you set up a Standing Order or make an online donation, we will request contact details as we would like to be able to get in touch to thank you.
6. To claim Gift Aid – we need your contact details for Gift Aid, whether it’s one-off or regular. We also have to record the fact that you are a UK tax payer and keep a record of the amount of Gift Aid we have collected.
7. To deliver products that you buy online – we only need your contact details, as the payment is processed by a 3^rd party, e.g. Paypal
8. For occasional marketing – we’d like to keep you informed about what’s happening here (Newsletter) and of any new products – you will have to opt in for this.

Types of data we collect and use

Personal information – many of the functions we perform at ReSkilled only require your name and address. Participants on courses will also be asked to provide (optional) any education and employment history to help us understand the starting point.

Sensitive personal information – for Participants on courses this means details such as health, and where relevant, unspent convictions. Staff and Volunteers will also be offered an equality monitoring form to complete regarding nationality, ethnic group, sex, age, marital status (for full list, see Equality Policy).

Where the information has come from

Depending on the nature of your interactions with ReSkilled, you will have provided us with different types of information, e.g. as a Participant, Volunteer, donor or customer. The information will therefore have come from one of the following: an application form you have completed for or with us; equality monitoring form; Participants’ referring agencies via specific Information Sharing Agreements; a Gift Aid form; a contact form or delivery address form on ReSkilled’s website.

How we share your personal data

Your information will never be sold to any third party. We will only use your information for the purposes described above.

This means that depending on the nature of the information, it may be shared with: ReSkilled Staff and Volunteers; ReSkilled’s Treasurer; the relevant referral agency according to our specific Information Sharing Agreement with them; Voluntary Action South West Surrey, Volunteer Woking or other agreed next stage provision after a course with ReSkilled.

If ReSkilled should use another agency to help with marketing or the distribution of publicity materials, your express permission will be required beforehand and it will be on the basis that they cannot use the information for any other purposes.

Banking information

If you use your credit or debit card to donate to us or buy something online, transactions are performed by a third-party payment-processing partner. We do not handle your bank details.

Data retention periods

Your information will only be held onto for the duration of your engagement with ReSkilled. This means:

For Participants – the duration of the course(s), before being forwarded onto Voluntary Action South West Surrey or Volunteer in Woking. If a Participant chooses to suspend attending the course, their paper-based information will be stored securely for six months from their last attendance in case they choose to return at a later date. After six months any information held electronically will also be deleted

For Staff and Volunteers – the duration of volunteering or employment. Equality monitoring information will be converted into statistical data as soon as practicable and the forms destroyed

For donors – the duration of ongoing donations

For online customers – for a maximum of 60 days after the product has been ordered

For those wishing to receive updates about ReSkilled – contact details will be held until either the person requests their removal or ReSkilled ceases to operate

Your rights under the General Data Protection Regulations

Where ReSkilled uses your personal information on the basis of your consent or a contract, you have the right to withdraw that consent or terminate the contract at any time. Simply contact us at info@reskilled.org and they will amend your contact preferences.

The law also gives you a number of other rights regarding your personal data:

The right to be informed about how we use your information – we will always try to inform you clearly before you provide any information. This may be in the form of a Privacy Statement on a form, through our Privacy Policy or in more detail on this Privacy Notice

The right to have your personal data corrected if you believe that the information that we hold is inaccurate

The right to object to our processing your personal data

The right to restrict our processing your personal data – this does not apply to data for which there are legitimate reasons for our needing to use it. Please contact us if you are unsure

The right to have your personal data erased (also known as the “right to be forgotten”)

The right to have access to your personal data in order to know what personal information of yours we hold – please Contact us to make a “Subject Access Request”. We will have 30 days to comply once we have successfully confirmed your identity and are satisfied that you therefore have rights to see the requested records

The right to data portability, i.e. to be able to move, copy or transfer your personal data in order to minimise the overall processing of personal data. We will always store your information in widely used formats (paper or electronic).

The right to object to automated decisions – this does not apply to ReSkilled. It is where a computer-based process is used to make decisions that have a legal or significant effect on you.

Data security

We will always do our best to keep the information that you entrust to us, secure. The level of security will also take into account the particular risks associated with inappropriate disclosure of the information.

All paper-based information will be stored securely in a lockable, non-portable, storage container with access strictly controlled and limited to those who are entitled to see it as part of their duties.

Electronically stored information will be encrypted and we use secure software to transfer information across the internet. Whilst we will always try to ensure the security of your information, we cannot guarantee the overall security of using the internet.

Staff and Volunteers will be required to sign a confidentiality agreement stating that they will not disclose any personal information of those attending the project.

For further details, please refer to the Privacy Policy.

Data anonymisation

Your personal information may be used to help us run more efficiently and raise funds more effectively by our using it for statistical purposes. We will always anonymise the data first so that you cannot be identified by it.

Changes to ReSkilled’s Privacy Notice

This Privacy Notice came into effect on 13^th July 2022. We may need to update it periodically, so please check the date here to see if we have done so.

Privacy Policy

We have tried to cover all of the areas concerning ReSkilled’s use of data in this Privacy Notice. However, please also see the ReSkilled Privacy Policy.

Data security breaches

The GDPR introduces a duty on all organisations to report certain types of personal data breaches to the ICO and in some cases to the individuals affected. For more information, please see the ReSkilled Privacy Policy.

What to do if you have any concerns

If you have any questions about this policy or how your data is handled, please e-mail us at: info@reskilled.org  or write to:

ReSkilled Data Protection Officer

ReSkilled

37 Hazel Avenue

Guildford

GU1 1NP

You also have the right to contact the Information Commissioners Office (ICO) if you have any concerns about how we handle your data, using their helpline 0303 123 1113 or at ico.org.uk