Policy on Handling and Safekeeping of Data

Tower Hamlets Education Business Partnership (Tower Hamlets EBP) is a registered education charity (Registered Charity No. 1040962). We work with schools and employers, primarily in the London Borough of Tower Hamlets, to help young people do more, learn more, and become more.

This policy explains your rights as a volunteer, beneficiary or partner with Tower Hamlets EBP. These rights are set out by the General Data Protection Regulation (EU) 2016/679 (GDPR). The policy also explains how we handle any data shared with us or collected by us. It will cover what we do with your data and why, and what you can expect from us in return.

1. Definitions

In this document, the following definitions apply:

“Personal Data”-

data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into  the possession of, the data controller.

“Processing”-

obtaining, recording or holding information or data, or carrying out any operation/s on the information or data.

2. Your rights

Tower Hamlets EBP is committed to compliance with GDPR. We will take careful precaution to protect your data. The following principles will apply when we process your personal data:

  • only data that we need is collected and processed
  • your data is only seen by those who need it to do their jobs
  • your data is retained only for as long as it is required
  • your data is accurate and up to date
  • your data is only processed when we have a lawful basis to do so
  • you will be provided with a copy of data we hold on you, on request
  • your data will be erased from our systems on request, barring any legal restrictions.
  • when your data is processed on the basis of consent you have the right to withdraw this consent at any time.
  • your data is protected against unauthorised or unlawful processing and against accidental loss, destruction or damage

These principles will apply whether we hold your data on paper or electronically, and applies to data held as part of the Disclosure and Barring Service procedure.

3. Volunteers

What personal data we hold, for how long, and why

Tower Hamlets EBP processes the following categories of volunteer personal data for all volunteers:

  • Full name
  • Email address
  • Place of work
  • Volunteer training undertaken
  • Volunteering opportunities undertaken

This information is provided either by your employer or by yourself. We keep this information for the duration of any volunteering with us and for a maximum of five years after you last volunteered. Holding this information helps us coordinate volunteering opportunities, and accurately record our impact and volunteer number history.

Tower Hamlets EBP may also process the following categories of data if you undertake a Disclosure and Barring Service (DBS) application:

  • Date of Birth
  • Gender
  • DBS application reference number, certificate number, issue date, type of clearance requested, and application status

This information is obtained either directly from you, or shared with us by the GBG application system (https://www.gbgplc.com/) with your consent.

We keep your gender, DBS application reference number, certificate number, issue date, type of clearance requested, and application status for the duration of any volunteering with us and for up to five years after you last volunteered with us. Keeping this information helps us uphold high standards of child safeguarding and allows you to return easily to regular volunteering after an absence.

Date of birth is held for DBS applicants to avoid duplicates and data errors. However, 30 days after an application has been cleared or six months after the application submission date, whichever is sooner, we erase this information.

If you sign up for the DBS Update Service (https://www.gov.uk/dbs-update-service) we will ask you for additional consent to continue to hold your date of birth and to update your records automatically with the most recent information from the Update Service.  As above, your records will only be held and updated for the duration of any volunteering done with us and for up to five years after you last volunteered with us.

We do not hold physical DBS certificates for volunteers. If we are asked to hold any DBS certificates temporarily they are stored in a lockable, non-portable, secure container accessible only by our designated DBS Administrator.

(Please see our Ex-Offenders Policy for further information about how we handle DBS information.)

Tower Hamlets Education Business Partnership may also process the following categories of data if you undertake a Barred List check:

  • Full Name
  • Date of Birth

The data collected for and outcome of Barred List checks is held for up to 30 days then erased. We process this information for child safeguarding purposes on request from partner schools and always ask your permission before running the check.

How is this data processed or used?

  • Relevant staff members may access your DBS application to support you while your application is processed or to update you on the progress of your application. Our staff are committed to confidentiality and keeping your data safe.
  • Full name, date of birth, gender, DBS application reference number, certificate number, DBS issue date, type of disclosure requested, and DBS application status details submitted through your GBG application are automatically synced onto our system. These details are then manually linked with your volunteer profile.
  • We will share volunteer DBS application status where appropriate with staff at our partner schools to comply with safeguarding guidelines as part of your volunteering We aim to have data processing agreements in place with our partner schools to ensure they are handling your data securely and responsibly.
  • We never disclose the outcome of a DBS application to your employer; however, we may periodically update a company appointed volunteer coordinator about any outstanding applications. We share this information to make the application process as quick and easy as possible for you.
  • Your organisation may have an authorised DBS verifier who has access to your Disclosure and Barring Service GBG application. If you would like the name and contact details of your organisation’s verifier, please contact us using the details below.
  • Your name may be shared with a school ahead of your visit in order to comply with school child safeguarding procedures and security.
  • Volunteer evaluations are collected and processed. Evaluation data is shared externally only in statistical figures and anonymised quotations unless specific consent is given. The raw data is stored on SurveyMonkey (https://www.surveymonkey.co.uk/) and held for up to five years after they are uploaded.
  • Paper evaluation documents are held for up to twelve months during which they are uploaded onto SurveyMonkey. The paper evaluations are then carefully destroyed.
  • Tower Hamlets EBP may also hold images, video, and audio clips of you, or case studies you have written. This data is collected and stored with your consent and held for a period of up to five years (unless you have given specific consent otherwise).

4. Beneficiaries

What personal data we hold, for how long, and why

We may hold the following data on the beneficiaries we work with:

  • Full Name
  • Current and/or historic school, sixth form or college
  • Programme or project participation

We may also hold the following information:

  • Form Group/Year Group
  • Unique Pupil Number
  • Date of birth
  • Email address
  • Gender
  • Ethnicity
  • Special Educational Needs status
  • Workplace-relevant medical information.

Beneficiary data is obtained from the beneficiary’s school or college unless given directly by the student.

Beneficiary data (excluding email addresses, SEN and medical information) is retained for a period of eight years after they are involved in one of our projects. This is to allow us to track a beneficiary’s journey through our programmes, and analyse impact.

Where applicable, student email addresses, SEN and medical information are retained to allow the mentoring and work experience project managers to facilitate the running of the programmes. This data is deleted within three months of the completion of the programme or placement.

Beneficiary email addresses and other data provided when a young person subscribes to the Alumni Newsletter are held in accordance with our policy on newsletter subscribers as described below.

We use data on ethnicity, SEN status and gender to measure the impact of our services on different communities.

How is this data processed or used?

  • We share student and staff names with our partner companies, universities, and activity centres to facilitate a trip or visit. We only share these names with the knowledge of the lead contact teacher.
  • For students undertaking work experience, we share their names, school, and any workplace-relevant SEN or medical requirements. This information is shared with the permission of the school, student, and parent/guardian.
  • We aim to have data processing agreements in place with our partner companies to ensure they are handling your data securely and responsibly.
  • Student evaluations are collected and processed. Evaluation data is shared externally only in statistical figures and anonymised quotations unless specific consent is given, and the raw data is deleted after five years. This data is stored on SurveyMonkey (https://www.surveymonkey.co.uk/).
  • Paper evaluation documents are held for up to twelve months during which they are uploaded onto SurveyMonkey. The paper evaluations are then carefully destroyed.
  • Tower Hamlets EBP may also hold images, video, and audio clips of beneficiaries, or case studies written by or about beneficiaries. This data is collected and stored with consent from the beneficiary and/or their parent or guardian and held for a period of up to five years (unless we have been given specific consent otherwise).

6. Our partners

What personal data we hold, for how long, and why

Tower Hamlets Education Business Partnership processes the following categories of personal data for our company, school, university, and activity centre contacts:

  • Full names
  • Job titles
  • Professional contact details

The data outlined above is kept for the duration of the academic year for which the individual is our contact. If the individual leaves their organisation or ceases to be our contact, their name may be retained for a further five years then removed from our systems. This information is retained to facilitate effective relationship management.

How is this data processed or used?

  • The data above is shared only with your knowledge and permission, and only to facilitate the workings of the project or programme you are involved in (e.g. sharing your name with a school so they know who to ask for at your office reception).

7. Communicating with us

Work Experience Calls

Tower Hamlets EBP organises work experience placements for the young people we work with. As part of this work we call businesses in the London area to make enquiries about opportunities in their workplace. We may keep a record of these telephone calls to ensure our enquiries are as efficient and effective as possible, including a record of businesses or organisations who have asked not to be contacted in the future.

We do not share this data with any third parties.

Newsletters

Tower Hamlets EBP currently publishes three newsletters; Heads Up!, Volunteer Vault, and the Alumni Newsletter.

For each newsletter we record the following categories of data for subscribers:

  • Full name
  • Email address
  • Company/organisation

We also collect information through MailChimp about your engagement with our newsletters.

This data is held for the duration you are subscribed to a newsletter, and for up to five years after you unsubscribe. Holding this data helps us track engagement over time, and ensures we keep accurate records of your communication preferences.

We do not share this data with any third parties.

We will ask for your consent before adding you to one of our mailing lists and you will only be subscribed to newsletters you have opted to receive.

If you received a newsletter in error, please do not hesitate to contact us. You have the right to unsubscribe from our newsletters at any time.

Our website and contacting us

We collect information through Google Analytics about your use of the Tower Hamlets EBP website <www.thebp.org>. We may also collect information through our online profiles, such as our Twitter feed, Facebook page, and LinkedIn page. This data includes information about how you use our website, and interact with our social media. We may hold a record of this activity for up to five years.

Please be aware that if you contact us by telephone, letter, fax, email, our online enquiry form or via a social media website (e.g. Facebook, Twitter, or LinkedIn), we may keep a record of that correspondence for the period you are communicating with us and for up to five years afterwards.

We keep this data to improve our website, and the experience of communicating with Tower Hamlets EBP. We do not share this data with any third parties.

8. Storage and access

We sometimes ask our technical support or our CRM system managers to process your data on our behalf. We aim to have data processing agreements in place with our partners to ensure they are handling your data securely and responsibly.

Your data is held securely with restricted access. We have physical and technical measures in place to stop unlawful access and disclosure.

Our servers and website are hosted within the UK, and our Customer Relationship Management system is hosted by Microsoft within the EU.

Our server is backed up daily and we conduct regular system updates and virus checks.

We do not share or transfer personal data outside of the EU.

9. About this policy

Policy compiled by: Evie Tabor, Tower Hamlets EBP Data Protection Lead

Policy reviewed by: Helen Sanson, Director, and Vicky Mirfin & Ian Pope, Deputy Directors.

Policy last updated: May 2018

Next policy review: November 2018

Contact Tower Hamlets Education Business Partnership at:

Address: Norvin House, 45-55 Commercial Street, London, E1 6BD

Telephone: 020 7655 0300

Email: [email protected]

To request a copy of your data, request erasure of data, request the contact details of any data controllers we work with, or any other data protection questions, please email: [email protected]