This privacy policy tells you about the information we collect from you when you use our services, access our website or interact with us via email, phone or email. In collecting this information, we are acting as a data controller and, by law, we are required to provide you with information about us, about why and how we use your data, and about the rights you have over your data.
1 Who are we
We are Helen Rollason Cancer Charity. Our address is Yvonne Stewart House, The Street, Hatfield Peverel, Chelmsford, Essex, CM3 2EH. You can contact us by post at the above address, by email at dpo@helenrollason.org.uk or by telephone on 01245 380719.
2 The type of personal information we collect
We currently collect and process the following information:
- Basic personal identifiers such as name and contact details of those who have contact with us via our website enquiry forms, email address, newsletter sign up forms, engage with us on social media or who attend our fundraising activities, donate to us, work or volunteer for us, or are referred to or use our services
- Social and health data of service users where relevant to enable us to provide our service (such as medical health data, GP contact details, disabilities, and other services involved)
- Family members names and contact details of our service users where relevant to the service we provide, such as names and contact details of emergency contacts.
- Ethnic background data of our service users
- Information required to process people who work or volunteer for us such as National Insurance Numbers, bank details and DBS records
- Basic contact details of people who donate to us and participate in fundraising activities
3 How we get the personal information and why we have it
Most of the personal information we process is provided to us directly by you for one of the following reasons:
- To access one of our services
- To sign up to our mailing list
- To volunteer or donate
- To participate in fundraising activities
- Contact us via email, our website enquiry form, by phone, or on social media
- To work or volunteer for us
We also receive personal information from the following sources in the following scenarios:
- Referral to our services from other agencies with your consent
We use the information that you have given us:
- To provide our service safely to our service users
- To ensure our services are providing equal opportunities, good value for money and are best serving the community
- To respond to complaints and enquiries, and send out requested newsletters
- To contact people who have attended fundraising events or donated regarding future support
- To pay our staff
We do not share your information with anyone outside of the Helen Rollason Cancer Charity without your consent, with the exception of appropriate agencies when there are serious safeguarding concerns.
Under the UK General Data Protection Regulation (UK GDPR), the lawful basis we rely on for processing this information are:
- We rely on legitimate interests for processing data relating to our fundraising activities, social media engagement, newsletters, and dealing with general enquiries.
We rely on Legal Obligation and Health and Social Care Purposes (Schedule 1) as our lawful basis for processing employee and volunteer data, including DBS checks.
We rely on consent and Not-for-profit bodies (article 9) to process data relating to our service users, including the special category of health and social care data. You are able to remove your consent at any time. You can do this by contacting: dpo@helenrollason.org.uk.
4 How we store your personal information
Your information is securely stored on encrypted electronic systems that can only be accessed by authorised employees of the Helen Rollason Cancer Charity. Approved volunteers have restricted access to a limited amount of information that they require to provide our service.
We keep contact details of people who have participated in any of our fundraising activities, engaged with our social media, requested newsletters, or made general enquiries for seven years from the point of last contact. We will then delete their personal data from our electronic system. We destroy any paper copies immediately once they have been uploaded onto our system (within one working week).
We keep employee and volunteer data for seven years from the last date they worked or volunteered with us. We will then delete their personal data from our electronic system. We destroy any paper records immediately once they have been uploaded onto our system (within one working week).
The exception to our employee and volunteer data retention period is with regards to DBS checks. As soon as we receive a completed DBS check we make a record of the date and the outcome without any further details, and then destroy the original.
We keep data relating to our service users for seven years from the last point of contact. We will then delete their personal data from our electronic system. We destroy any paper copies immediately once they have been uploaded onto our system (within one working week). There may be times we wish to retain data in order to analyse or improve the service we provide. If we wish to retain data in this way it will be fully anonymised after the standard retention period so that it no longer contains any personal data.
We will review data we hold on a regular basis to ensure we remove any data that is no longer necessary.
5 Your data protection rights
Under data protection law, you have rights including:
- Your right of access – You have the right to ask us for copies of your personal information.
- Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
- Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances. However, there are some circumstances where we are legally required to retain your information (for example for historical Gift Aid claims).
- Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances.
- Your right to object to processing – You have the right to object to the processing of your personal information in certain circumstances.
- Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.
- You are not required to pay any charge for exercising your rights.
If you make a request, we have one month to respond to you.
Please contact us at dpo@helenrollason.org.uk if you wish to make a request.
6 How to complain
If you have any concerns about our use of your personal information, you can make a complaint to us at Yvonne Stewart House, The Street, Hatfield Peverel, Chelmsford, Essex, CM3 2EH.
You can also complain to the ICO if you are unhappy with how we have used your data. The ICO’s address: Information Commissioner’s Office Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
Helpline number: 0303 123 1113.
ICO website: https://www.ico.org.uk.
