Updated September 2024.

Accumulate Data Protection and Privacy Policy

 

1.        Personal Data – What is it?

“Personal data” is any information about a living individual by which they can be identified. This includes name, phone number, email address or address. Identification can be by the information alone or in conjunction with any other information in the data controller’s possession or likely to come into such possession. The process of managing personal data is governed by the Data Protection Act 2018 (the “Act”) and the General Data Protection Regulations 2018 (the “GDPR”).

2.        Who is the Data Controller?

Accumulate is the data controller of the information. This means we decide how your personal data is processed and for what purposes.

3.        What personal data does Accumulate hold?

The data we process is likely to constitute sensitive personal data because we record information related to protected characteristics as defined by the Equalities Act 2010. The information we hold can include:

  • Name and title
  • Contact details such as telephone number, address and email address;
  • Date of birth
  • Gender or sex
  • Ethnicity
  • Nationality
  • Disability and medical information where necessary to ensure that the service we provide is appropriate to your needs
  • Bank account information (used primarily to process participants’ travel receipts)
  • Camera and video footage
  • Disclosure and Barring service (DBS) check data
  • Information contained in emails or other correspondence
  • Information shared for the purposes of safeguarding

4.        Who has access to your personal data?

Accumulate’s Leadership Team (Co-Directors) and administrator have general access to your personal information.

The safeguarding lead member of the Board of Trustees may have access to sensitive information that will only be accessed in order to perform their duties.

Partner organisations may collate information for registration and feedback on workshops and courses.

Personal data is not disclosed outside of Accumulate’s processes without the consent of the data subject (i.e. those to whom the data belongs) unless there is a safeguarding issue where there is a duty to disclose.

5.        Whose information do we hold and why?

Information is held in relation to participants, staff, volunteers, donors and partners.

We will collect and handle your personal information either with your consent or because it is necessary for us to do so for the purposes of our legitimate activities. Personal data collected may be used to:

  • Update you about Accumulate and external workshops, courses, events, opportunities and resources that we think may be of interest to you
  • Provide support during Accumulate workshops, courses, events and opportunities;
  • Enable and maintain appropriate safeguarding arrangements for vulnerable adult participants
  • To administer membership records and maintain our own financial accounts and records (including the processing of donations and gift aid applications).

Accumulate will comply with its legal obligations under GDPR by:

Keeping personal data up to date,

Storing and destroying data promptly and securely,

Only collecting or retaining necessary data,

Protecting personal data from loss, misuse, unauthorised access and disclosure including ensuring that appropriate technical measures are in place to do so.

7.        WhatsApp

Accumulate uses third-party instant messaging service, WhatsApp, as its main form of communication between participants, staff and volunteers via WhatsApp Groups.

By providing your name and telephone number (either directly or via a service such as a hostel) you are opting into the service and you are free to leave at any time by exiting the group or asking to be removed.

Within WhatsApp, your mobile number and personal information will be stored on the app and the other members of the group can see your mobile number and other personal information saved within your profile.You may edit the privacy settings within the app to limit access but, because of the way Whatsapp works, your data cannot be completely hidden from others in the group.

WhatsApp is responsible for data entered in messages on the service. By installing and using WhatsApp on your mobile phone, you agree to WhatsApp’s terms and conditions, over which Accumulate has no control. This includes granting WhatsApp access to your phone number and the contents stored in your mobile phone. We cannot guarantee the security of messages and you are responsible for the content of the messages you send. For more information on how WhatsApp uses your information, please view the WhatsApp privacy policy.

8.        Storage of Personal Data

Accumulate shall take reasonable and appropriate security measures to protect the storage of personal data, such as:

  • Storing hardcopies of documents with personal records in locked filing cabinet systems and locked rooms;
  • Electronic files will be saved on locked computers.

Accumulate will ensure that:

  • Host personal data are secured and protected against unauthorised access.
  • Accumulate computers and other electronic devices that may access or store personal data are password protected and encrypted.

9.        What is the legal basis for processing your personal data?

Data is processed by Accumulate because it is necessary for our legitimate activities. Examples of this are data used for registration, monitoring and evaluation of our workshops and courses, for safeguarding, for contact about our work, data analytics, research and for our legal purposes such as complying with guidance from the Charity Commission. We will always take into account your interests, rights and freedoms.

Not-for-profit organisations are permitted to process information about your protected characteristics to administer membership or contact details. Processing is carried out by a not-for-profit body with a philosophical aim provided that:

  • Processing relates only to Accumulate participation or donation and
  • There is no disclosure to a third party without consent.

Accumulate will ensure that your explicit consent has been obtained so that we can keep you informed about news, events, activities and resources, to process your gift aid donations and keep you informed about events and to further Accumulate objectives.

Where your information is used other than in accordance with one of these legal bases, we will first obtain your consent for that use.

10.   Sharing your personal data

Your personal data will be treated as strictly confidential and will only be shared between Accumulate staff and partners in order to carry out our activities. We will only share your data with third parties outside of Accumulate with your prior written consent or ‘opt-in’.

11.  Data Retention Policy

Accumulate may archive data as part of its historical record of participation.

You may withdraw consent for us to hold your data at any time and we will immediately take action to delete/destroy it.

Past participants will be kept on mailing lists until they ask to be removed.

In general, we will endeavour to keep data only for as long as is necessary for our activities.  This means that we may delete it when it is no longer needed without your prior consent.

Some records may be kept permanently where we are legally required to do so.  Other records may be kept for an extended period of time. For example, it is currently best practice to keep financial records for a minimum period of 7 years to support Charity Commission audits.

Accumulate shall ensure the disposal of personal data is performed appropriately with little possibility to recover the information from the disposal process. Such methods may include shredding paper records and deleting and wiping electronic records.

 

12.  Your Rights and your personal data

Unless subject to an exemption under the GDPR, you have certain rights with respect to your personal data. When exercising any of the rights listed below, in order to process your request, we may need to verify your identity for your security.  In such cases we will need you to respond with proof of your identity before you can exercise these rights.

The right to request a copy of your personal data which Accumulate holds about you. (Information will be provided within 30 days)

The right to request that Accumulate corrects any personal data if it is found to be inaccurate, incomplete or out of date.

The right to request that your personal data is erased where it is no longer necessary for Accumulate to retain such data.

The right to withdraw your consent to the processing at any time.

The right to data portability. You have the right to request that we transfer some of your data to another controller. (We will comply with your request, where it is feasible to do so, within one month of receiving your request.)

The right to object to the processing of personal data (where applicable).

The right to lodge a complaint with the Information Commissioner’s Office.

13.   Further Processing

If Accumulate wishes to use your personal data for a new purpose, not covered by this Data Protection Notice, we will provide you with a new notice explaining this new use prior to commencing the processing and setting out the relevant purposes and processing conditions. When and wherever necessary, we will seek your prior consent to the new processing.

14.   Contact Details

Please contact us if you have any questions about this Data Protection and Privacy policy, the information we hold about you or to exercise all relevant rights, queries or complaints:

 

The Data Controller: Accumulate

Contact: Marice Cumber and Rossanne Pellegrino

Email: info@accumulate.org.uk

 

You can contact the Information Commissioner’s Office by

Telephone – 0303 123 1113

Email – https://ico.org.uk/global/contact-us/email/

Post –  Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire. SK9 5AF.