Our PRIVACY POLICY
Policy Statement
Women on the Frontline Ministries (WOFM), collects and uses information about people with whom it communicates. This personal information must be dealt with properly and securely however it is collected, recorded and used – whether on paper, in a computer, or recorded on other material – and there are safeguards to ensure this in the General Data Protection Regulation 2018.
WOFM regards the lawful and correct treatment of personal information as very important to the successful and efficient performance of its functions, and to maintain confidence between those with whom it deals. To this end WOFM fully endorses and adheres to the Principles of Data Protection, as set out in the General Data Protection Regulation 2018.
Purpose
The purpose of this policy is to ensure that the staff, volunteers and trustees of WOFM are clear about the purpose and principles of Data Protection and to ensure that it has guidelines and procedures in place which are consistently followed.
Failure to adhere to the Data Protection Act 1998 is unlawful and could result in legal action being taken against WOFM or its staff, volunteers or trustees.
Principles
The GDPR regulates the processing of information relating to living and identifiable individuals (data subjects). This includes the obtaining, holding, using or disclosing of such information, and covers computerised records as well as manual filing systems and card indexes.
Data users must comply with the data protection principles of good practice which underpin the Act. To comply with the law, information must be collected and used fairly, stored safely and not disclosed to any other person unlawfully.
To do this WOFM follows the eight Data Protection Principles outlined in the GDPR, which are summarised below:
- Personal data will be processed fairly and lawfully
- Personal data will be obtained only for one or more lawful purposes
- Personal data will be adequate, relevant and not excessive
- Personal data will be accurate and, where necessary, kept up to date
- Personal data will not be held any longer than necessary
- Personal data will be processed in accordance with the rights of data subjects
- Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data
- Data will not be transferred to a country outside the European Economic Area, unless that country has equivalent levels of protection for personal data.
The principles apply to “personal data” which is information held on computer or in manual filing systems from which they are identifiable. Women on the Frontline Ministries’ employees, volunteers and trustees who process or use any personal information in the course of their duties will ensure that these principles are followed at all times.
Procedures
The following procedures have been developed in order to ensure that Women on the Frontline Ministries meets its responsibilities in terms of Data Protection. For the purposes of these procedures data collected, stored and used falls into 2 broad categories:
- Internal data records;
- Staff, volunteers and trustees
- External data records;
- Members, customers, clients
WOFM as a body is a DATA CONTROLLER under the Act, although is not required to register with the ICO, as a not-for-profit organisation. The Directors are ultimately responsible for the policy’s implementation.
Internal data records
Purposes
- WOFM obtains personal data (names, addresses, phone numbers, email addresses), application forms, and references and in some cases other documents from staff, volunteers and trustees. This data is stored and processed for the following purposes:
- Recruitment
- Equal Opportunities monitoring
- Volunteering opportunities
- To distribute relevant organisational material e.g. meeting papers
- Payroll
Access
The contact details of staff, volunteers and trustees will only made available to other staff, volunteers and trustees. Any other information supplied on application will be kept in a secure filing cabinet and secure online systems, and is not accessed during the day to day running of the organisation.
Contact details of staff, volunteers and trustees will not be passed on to anyone outside the organisation without their explicit consent.
A copy of staff, volunteer, trustee emergency contact details will be kept in the Staff Handbookfor Health and Safety purposes to be used in emergency situations e.g. fire/ bomb evacuations.
Staff, volunteers and trustees will be supplied with a copy of their personal data held by the organisation if a request is made.
All confidential post must be opened by the addressee only.
Accuracy
WOFM Safe Women’s Project initiative will take reasonable steps to keep personal data up to date and accurate.
Personal data will be stored for 6 years after an employee, volunteer or trustee has worked for the organisation and brief details for longer. Unless the organisation is specifically asked by an individual to destroy their details it will normally keep them on file for future reference. The Directors have responsibility for destroying personnel files.
Storage
Personal data is kept in paper-based systems and on a password-protected computer system.
Every effort is made to ensure that paper-based data are stored in organised and secure systems.
Women on the Frontline Ministries operates a clear desk policy at all times.
Use of Photographs
Where practicable, we will seek consent from individuals before displaying photographs in which they appear. If this is not possible (for example, a large group photo), the organisation will remove any photograph if a complaint is received. This policy also applies to photographs published on the organisations website or in the Newsletter. We will endeavour at all times to only use photographs that cannot directly identify a person or their location.
Disclosure and Barring Service
WOFM will act in accordance with the DBS’s code of practice regarding the correct handling, use, storage, retention and disposal of certificates and certificate information.
External data records
Purposes
WOFM obtains personal data (such as names, addresses, and phone numbers) from members/clients. This data is obtained, stored and processed solely to assist staff and volunteers in the efficient running of services. Personal details supplied are only used to send material that is potentially useful. Most of this information is stored on the organisation’s database.
WOFM obtains personal data and information from clients and members in order to provide services. This data is stored and processed only for the purposes outlined in the agreement and service specification signed by the client/ member.
Consent
Personal data may be collected over the phone and using other methods such as e-mail. During this initial contact, the data owner is given an explanation of how this information will be used.
Written consent is requested from donors and supporters. It is not requested from clients unless they are entering into a face-to-face casework arrangement (i.e. safe women’s project). Any phone-based clients are asked to give verbal consent and this is recorded in the client notes.
Personal data will not be passed on to anyone outside the organisation without explicit consentfrom the data owner unless there is a legal duty of disclosure under other legislation, in which case the Directors will discuss and agree disclosure.
Access
Only relevant staff, volunteers and trustees within the organisation will be given access to personal data.
All staff, volunteers and trustees are made aware of the Data Protection Policy and their obligation not to disclose personal data to anyone who is not supposed to have it.
Information supplied is kept in a secure filing, paper and electronic system and is only accessible by those individuals involved in the delivery of the service.
Information will not be passed on to anyone outside the organisation without their explicit consent, excluding statutory bodies e.g. the Inland Revenue.
Individuals will be supplied with a copy of any of their personal data held by the organisation if arequest is made.
All confidential post must be opened by the addressee only.
Accuracy
WOFM will take reasonable steps to keep personal data up to date and accurate.
Personal data will be stored for as long as the data owner/ client/ member uses our services and normally longer. Where an individual ceases to use our services and it is not deemed appropriate to keep their records, their records will be destroyed according to the Data Retention Schedule(See separate Data Retention Policy).
If a request is received from an organisation/ individual to destroy their records, we will remove their details from the database and request that all staff holding paper or electronic details for theorganisation destroy them. This work will be carried out by a Director.
This procedure applies if WOFM is informed that an organisation ceases to exist.
Storage
Personal data may be kept in paper-based systems and on a password-protected computer system. Paper-based data are stored in organised and secure systems.
WOFM operates a clear desk policy at all times.
Use of Photographs
Where practicable, WOFM will seek consent of members/ individuals before displaying photographs in which they appear. If this is not possible (for example, a large group photo), the organisation will remove any photograph if a complaint is received. This policy also applies to photographs published on the organisation’s website or in the Newsletter.
Responsibilities of staff, volunteers and trustees
During the course of their duties with WOFM, staff, volunteers and trustees will be dealing with information such as names/addresses/phone numbers/e-mail addresses of members/clients/volunteers. They may be told or overhear sensitive information while working for WOFM. The Data Protection Act (1988) gives specific guidance on how this information should be dealt with. In short to comply with the law, personal information must be collected and used fairly, stored safely and not disclosed to any other person unlawfully. Staff, paid or unpaid must abide by this policy.
Staff, volunteers and trustees are asked to read and sign the Handbook, including this policy, to say that they have understood their responsibilities as part of their induction. The Data Protection Summary summarises the main responsibilities for staff/ volunteers on a day to day basis.
Confidentiality
There will be times that staff may be exposed to sensitive information about clients. We take the issue of confidentiality very seriously. Please see our Confidentiality Policy for clear expectations of all staff/ volunteers. Individual projects will also have their own processes for handling sensitive information.
WOFM also have a clear process for dealing with safeguarding concerns affecting children and young people under 18, and vulnerable adults. See our Safeguarding Policy for details.
Compliance
Compliance with the Act is the responsibility of all staff, paid or unpaid. WOFM will regard any unlawful breach of any provision of the Act by any staff, paid or unpaid, as a serious matter which will result in disciplinary action. Any employee who breaches this policy statement will be dealt with under the disciplinary procedure which may result in dismissal for gross misconduct. Any such breach could also lead to criminal prosecution.
Any questions or concerns about the interpretation or operation of this policy statement should in the first instance be referred to the line manager.
Retention of Data
No documents will be stored for longer than is necessary. For guidelines on retention periods see the Data Retention Schedule.
All documents containing personal data will be disposed of securely in accordance with the Data Protection principles.
| Last Review | 10 June 2022 |
| Last Update | 17 January 2023 |
| Next Review | 17 January 2024 |
| Authorised By | Charlene Turpin (Chairperson) |