Personal Data and Privacy Policy
Policy statement
The Shaftesbury Refugee Group aims to use any information it legitimately holds about people in a fair and proper way. We respect people’s fundamental right to privacy and we recognise their right to have control over their own identity and their interactions with others.
We will always aim to act within the relevant laws and regulations affecting personal data privacy in force in the UK and stay up to date with these.
We will identify the ‘lawful basis’ for collecting and using personal data.
We will be clear, open and honest with people from the start about how we will use their personal data.
We will use any personal data as we have agreed with people and not do anything with the data in breach of any other laws.
We will use personal data in a way that is fair and not process the data in a way that is unduly detrimental, unexpected or misleading to the individuals concerned.
We will regularly check our compliance with our Personal Data Privacy Policy and, through that, the legislation in place using the GDPR Guidance Checklists provided by the Information Commissioner’s Office, here
Definitions
Personal data means information about a particular living individual. Even information which is public knowledge or is about someone’s professional life can be personal data. If a ‘data subject’ or individual could still be identified from the details, or by combining it with other information, it will count as personal data.
The Data Controller is Shaftesbury Refugee Group and the Trustees will ensure that the processing of personal data complies with data protection law.
The Data Processors for Shaftesbury Refugee Group is Google as any personal data we hold is held on a secure Google Drive account and Squarespace because our website is hosted by them. No personal data is held on individual computer drives.
The Data Protection Officer is a Trustee, Stuart Twiss, and they can be contacted by email at shaftesburyrefugeegroup@gmail.com or via the contact form on our website https://shaftesburyrefugeegroup.org.uk/contact-us
Implementation of this policy
TheTrustees of The Shaftesbury Refugee Group will check that the Charity has the consent of individuals to hold their personal data and will require the use of a standard privacy information notice for every member and beneficiary that it has contact with and whose personal data is held by us. This notice will be shared with the individual and held electronically with the personal data to which it pertains. See appendix. The Charity will not hold unnecessary data about an individual.
The Trustees will undertake a regular risk assessment to consider the risk of any loss of personal data security and take the necessary steps to maintain security.
The Trustees will comply in a timely way with any eligible Subject Access Request and will take steps to confirm the identity of the requester or theory representative and provide them with the information in a clear way and usually without a fee.
The Trustees will do all they can to ensure the accuracy of individuals’ personal data and will promptly rectify any errors in your personal data at an individual's request.
The Trustees will promptly erase any personal data held about an individual at an individual's request and at the end of the agreed retention period.
The Trustees will promptly place restrictions on the processing of an individual’s personal data at an individual's request.
The Trustees will promptly comply with an individual’s request to make their personal data portable and transfer it to the intended destination on their behalf.
The Trustees will promptly comply with an individual’s objection to the Charity processing their personal data.
Shaftesbury Refugee Group will not undertake automated decision making or profiling based on any personal data it has permission to hold.
Review
The Trustees will regularly ask the Data Protection Officer to check The Charity’s compliance with this policy using the checklists here and to report their findings to the Trustees as a whole.