We want everyone who supports Glossop Arts Project (GAP), participates in sessions or who works or volunteers with GAP to feel confident and comfortable with how any personal information that is shared with us will be looked after.
This Data protection and Privacy Policy sets out how we collect, use and store personal information (this means any information that identifies or could identify individuals).
This policy applies to all trustees, staff, students and volunteers of Glossop Arts Project.
Introduction
The purpose of this policy is to enable Glossop Arts Project (GAP) to:
- Comply with the law in respect of the data it holds about individuals
- Follow good practice
- Protect GAP’s participants, staff, volunteers and other individuals
- Protect the organisation from the consequences of a breach of its responsibilities
Brief Introduction to the General Data Protection Regulation (GDPR)
The GDPR replaces the Data Protection Act 1998, as of 25th May 2018. The Data Protection Act and GDPR give individuals the right to know what information is held about them. It provides a framework to ensure that personal information is handled properly. The Act works in two ways. Firstly it states that anyone who processes personal information must comply with 8 principles, which make sure that personal information is:
- Fairly and lawfully processed
- Collected and processed for specific, explicit and legitimate purposes only
- Adequate, relevant and not excessive
- Accurate and up to date
- Not kept for longer than is necessary
- Processed in line with the rights of Data Subjects (person whose personal data is being processed)
- Secure
- Not transferred to other countries without adequate protection
The second element covered by the Act provides individuals with important rights, including the right to find out what personal information is held about them on computer and on most paper records.
Policy Statement
Glossop Arts Project will:
- Comply with both the law and good practice
- Respect individuals’ rights
- Be open and honest with individuals for whom we hold data
- Provide training and support for staff and volunteers who handle personal data so that they can act confidently and consistently
GAP recognises that its first priority under the Data Protection Act is to avoid causing harm to individuals. Information about staff, volunteers, participants and other stakeholders will be used fairly, securely and not disclosed to any person unlawfully.
Secondly the Act aims to ensure that the legitimate concerns of individuals about the ways in which their data may be used are taken into account. In addition to being open and transparent, GAP will seek to give individuals as much choice as it possible and reasonable over what data is held and how it is used.
All new staff will be given training on the data protection policy and procedures. They will be told how they should store and handle personal information and be asked to sign to say they have understood. All volunteers will be made awareness of the importance of confidentiality as part of their induction.
What we do and your rights
We collect personal data from our participants, volunteers, staff and other stakeholders.
We collect this data in the legitimate interests of supporting and enabling our work, and for some types of data collection for the performance of a contract. We ask for consent for data processing where appropriate and when we ask for personal data we will inform you of how we intend to manage it and what measures we will take to ensure its security.
We hold the following types of data:
- Organisational information – publicly available information about organisations and referral agencies
- Personal information – information about individuals such as names, addresses, job titles, email addresses, payroll information and telephone numbers
- Sensitive personal information – sensitive information may include, only where necessary, details of health conditions and other relevant information about employees and contractors and emergency contact details or support agencies – where appropriate.
How we collect data
GAP collects personal data in the following ways:
1) When you interact with us directly: This could be if you make an enquiry about our activities, join a group, participate in a workshop, apply or a job or volunteering opportunity, make a donation, or otherwise provide us with your personal information. This includes when you phone us, visit our website, donate via our on-line shop, or get in touch via the post or in person.
2) When you interact with us through partner organisations or referral agencies. This could be if a support agency contacts us on your behalf, we are delivering activities in partnership with other organisations.
Example forms and contact methods we use include:
- Participant referral/registration forms
- Media Consent forms
- Job or Volunteer application forms and DBS checks where appropriate
- Event booking or activity registration forms
- Session feedback information e.g. Warwick Edinburgh Wellbeing questions, session evaluations
- Emails received
- Verbal updates on relevant information from participants which may then be transferred on to the individual’s record
- GAP database for mailing purposes
3) When you visit our website: We gather general information which might include which pages you visit most often and which services, events or information is of most interest to you. We may also track which pages you visit when you click on links in emails from us. We also use “cookies” to help our site run effectively.
We use this information to personalise the way our website is presented when you visit to make improvements and to ensure we provide the best service and experience for you. Wherever possible we use anonymous information which does not identify individual visitors to our website. For more information about how we use Cookies please see our Cookie Policy.
We will ensure that all personal information supplied is held in accordance with EU General Data Protection Regulation and UK Data Protection legislation.
Why we collect data
We collect this data to enable us to provide quality, accessible, appropriate and enjoyable sessions and services for participants, to promote and share our work via newsletters, encourage the giving of donations or fundraising, to carry out impact evaluation and administration in connection with funding and business development, and to offer services and events to the wider public.
Processing and consent
It is a legal requirement that people know what we are doing with their information and who it will be shared with.
To this end, when we ask for personal data we will outline why we are requesting it, how we will use and manage it and, where appropriate, ask for your consent to do so. Equally we will ask for your consent before including you in any photographs or mentions in publicity or web-based resources.
We will not use this personal data for other purposes without asking your permission. We will not keep this information for longer than necessary.
Standard statements will be included on forms where data is collected. Where forms ask for mandatory information we will explain why.
We will never sell your data to third parties.
All staff and volunteers are required to read, understand and accept any policies and procedures that relate to the personal information they may handle in the course of their role.
Significant breaches of this policy will be handled under GAP’s disciplinary procedures.
Access to information
We will seek to maintain accurate information by creating ways in which individuals can update the information held.
Information about individuals will not be disclosed to other organisations or to individuals who are not staff members or Trustees of GAP, except where this is a legal requirement, where there is explicit or implied consent or where information is publicly available elsewhere. On occasions we may, for health and safety or safeguarding reasons, feel it necessary to share some information with volunteers who are directly involved in supporting a session or contracted staff or visiting artists who need to know relevant information to ensure safe, appropriate and enjoyable sessions. This information sharing will be on a need to know only basis.
Individuals have the option not to receive newsletters or other communications from GAP .
There may be situations where we work in partnership with other organisations on projects which require some element of data sharing. Any information provided will be minimal and on a ‘need to know’ basis to best support individuals.
Individuals are entitled to have access to all information stored about them by GAP and for what purpose by submitting a request in writing to the Project Manager. All staff and volunteers are required to pass on anything which might be considered an access request to the Project Manager without delay.
If the individual making an access request is not personally known to the Project Manager their identity will be verified before handing over any information.
GAP will provide details of information to participants who request it unless the information may cause harm to another person.
Staff and volunteers have the right to access their file to ensure that information is being used fairly. If information held is inaccurate, the individual must notify the Project Manager so that this can be amended and recorded on file.
Subject to any rules of the organisation awarding the funding, information will not be retained once no longer required for its stated purpose. We will not keep more than a project requires or surplus information ‘just in case’. We have established retention periods and a process to delete personal information when no longer required.
Confidentiality and privacy
As confidentiality applies to a much wider range of information than Data Protection, GAP has a separate Confidentiality policy which all staff, students and volunteers are required to read in conjunction with this policy and adhere to. Staff, volunteers and contracted workers are required to sign a short statement indicating that they have been made aware of their confidentiality responsibilities.
GAP has a privacy statement for participants setting out how their information will be used. This is available on request (see appendix). A version of this statement will also be used on the GAP website.
Data location and security
Personal data, including sensitive information is collected and stored securely subject to appropriate security measures and is protected against misuse.
Your personal data is held in electronic and paper form as appropriate. Electronic data is protected by the use of passwords and held on secure computers/portable devices or securely via ‘the cloud’ operated by Glossop Arts Project and in some circumstances, on computers or portable devices owned by third party contractors. Paper information is kept in a locked cabinet and is destroyed confidentially when no longer needed. DBS check information is held in accordance with DBS code of practice.
We ensure that any third party contractors we use comply with the UK Data Protection legislation and EU General Data Protection Regulation.
Social media
GAP is beginning to deliver more of its content and create opportunities for participants to be involved and communicate with each other on-line as a way of maintaining connection with others during periods of lockdown or ill-health.
Engaging in these activities is optional and those that want to join in will need to ‘opt in’. We will ask all participants to be aware of how much personal information they share via these activities and to take responsibility for managing their privacy settings. GAP has a good practice code which we ask all users to adhere to. Further information is given in our Social Media policy and procedures.
If you share our content through social media, for example by liking us on Facebook, following on Instagram, those social networks will record that you have done so. They may set a cookie for this purpose.
In some cases, where a page on our website includes content from a social network, such as an Instagram feed, or Facebook comments box, those services may set a cookie even where you do not click a button. Further information about how the GAP website uses cookies see the Cookie policy on the website.
Direct Marketing
Glossop Arts Project will treat the following direct communication with individuals as marketing:
- Seeking donations and other financial support
- Promoting any of GAP’s services and projects
- Promoting any GAP events
- Promoting membership of Friends of GAP to supporters
- Promoting sponsored events and other fundraising activities linked to GAP activities or individuals
- Marketing any products for sale by GAP
- Marketing on behalf of any other external company or voluntary organisation which we feel will be of interest or benefit to users and supporters of GAP.
When data is first collected which might be used for any marketing purpose, this purpose will be made clear and individuals will be given a clear ‘opt out’. GAP does not have a policy of sharing lists, obtaining external lists or carrying out joint or reciprocal mailings.
Policy Review
This policy will be reviewed each year by the Trustees. It will also be reviewed in response to changes in relevant legislation, contractual arrangements, good practice or in response to an identified failing in its effectiveness.
Appendix: Privacy Statement
When you request information from Glossop Arts Project, sign up to any of our sessions or projects, give us a donation, follow us on social media or buy things from us, we obtain information about you. This statement explains how we look after that information and what we do with it.
We have a legal duty under the Data Protection Act to prevent your information falling into the wrong hands. We must also ensure that the data we hold is accurate, adequate, relevant and not excessive.
Normally the only information we hold comes directly from you. Whenever we collect information from you we will make it clear what information is required in order to provide you the information you need or activity you wish to participate in. You do not have to provide us with any additional information unless you choose to. We store your information securely and we restrict access to those who have a need to know. Our staff are trained in the secure handling of information.
If you have signed up to a session, project or other service we will also share your details with the worker providing that service on a need to know basis. This worker may hold additional information about your participation in these activities.
We would also like to contact you in future to tell you about other sessions or activities and events, to keep you informed about what we are doing and ways in which you might like to support us. You have the right to ask us not to contact you in this way. We will always aim to provide a clear method for you to opt out. You can also contact us at any time to tell us not to send you future mailings.
You have the right to a copy of all the information we hold about you (apart from a very few things we may need to withhold because they concern other people as well as yourself). To obtain a copy we ask you to write to Jo Shirley, Project Manager. We aim to reply as promptly as we can and within the legal maximum of 40 days.