Capital Mass Privacy Notice 2018
Introduction to the Privacy Notice
Capital Mass takes your privacy seriously. Our mission is to help tackle poverty and inequality and we will use your personal data which you have given to us in order to help us support our mission.
Why do we need a Privacy Notice?
Data Protection regulation in the UK requires all organisations to inform individuals about the personal data they hold and use, and the reasons for this. This Privacy Notice is intended to make it easier for you to find out how we use and protect your information.
Who does this Notice apply to?
This Privacy Notice is for all those whose personal information is dealt with in any way by Capital Mass. So, you may be an employee, a donor or simply signed up for one of our events, for instance.
How this Privacy Notice relates to you
We want to be open and transparent about how we use your personal data. We are a charity, a limited company, and subject to ecclesiastical law.
We’ve set out a range of reasons to why we might process your data. Even if the examples don’t all apply to you, we thought it best to have a single document that covers as many outcomes as possible.
We are not changing the ways we use your personal data. Our Privacy Notice has in it what the new Data Protection regulation, requires us to include, and it covers:
Your personal data – what is it?
Who are we?
What is the lawful basis for processing your personal data?
How does Capital Mass process your personal data, and for what purposes?
How is my information collected and how do I consent?
Sharing your personal data
How long do we keep your personal data?
Your rights and your personal data
Transfer of data abroad
- Changes to this Notice
Capital Mass holds a range of data. Do you hold all of this information about me? No we don’t; only a limited amount of examples in the Notice will apply to you. This will be data you have given us.
1. Your personal data – what is it?
“Personal data” is any information about a living individual which allows them to be identified from that data (for example a name, photographs, videos, email address, or address). Identification can be by the information alone or in conjunction with any other information. The processing of personal data is governed by the Data Protection Bill/Act 2017 the General Data Protection Regulation 2016/679 (the “GDPR”) and other legislation relating to personal data and rights such as the Human Rights Act 1998.
2. Who are we? This Privacy Notice is provided to you by Capital Mass who is the data controller for your data, which we hold and use. This means that we, Capital Mass, are responsible to you for how we process your data.
3. What is the lawful basis for processing your personal data?
The GDPR requires specification in the Privacy Notice of the lawful basis for processing personal data. Below are the lawful bases which are relevant for our processing activities.
a. legitimate interests, or the legitimate interests of a third party (such as another organisation partner organisation)
b. compliance with a legal obligation
c. performance of a contract, or to take steps to enter into a contract
d. to protect a person’s vital interests
e. where consent has been obtained
Religious organisations are also permitted to process information which reveal a person’s religious beliefs, to administer membership or contact details.
4. How will Capital Mass use the information about you?
Capital Mass collects data to ensure that we provide the best service.
We use your personal data for purposes included amongst the following:
a. To enable us to meet all legal and statutory obligations.
b. To gather statistics on activities in London aimed at tackling poverty and inequality. We also gather statistics and feedback from guests who’ve attended our events, in order to capture the learning for both guests and how Capital Mass can develop.
c. We will use your information to keep you informed of opportunities and events through Capital Mass and our partner organisations, Church Urban Fund and Diocese of London on tackling poverty and inequality. This communication will primarily arrive via the e-newsletter but may also be received via direct email from a Capital Mass employee.
d. To fundraise and promote the interests of the church and charity. E.g. information supplied by donors to use in supporting our work.
e. To maintain our own accounts and records. E.g. supplied – for invoicing and making payments. Personal data held in this regard forms part of our contractual arrangement with you.
f. To seek your views or comments
g. To notify you of changes to our services and events. E.g. for those who sign up to receive newsletters.
h. To send you communications which you have requested, or that may be of interest to you. These may include information about campaigns, appeals, or other fundraising activities. e.g. those who make donations to the Capital Mass
i. To process a grant or application
j. To manage our employees, volunteers and contractors. We will process data about individuals for legal, HR, administrative and management purposes and to enable us to meet our legal obligations.
e.g. re: Employees – to pay you, according to our contract with you; to monitor your performance, which we have a legitimate interest to do in taking forward Capital Mass aims and objectives; and to confer benefits, such as sick pay, which we have a legal obligation to do.
During the course of your employment information you have given us may be shared with other relevant Capital Mass officers and our external agents (e.g. our payroll processors) to enable us to manage your employment and comply with our policies and procedures, e.g. prevention of illegal working, disciplinary, grievance, and performance management policies. Your information will be held securely in compliance with our retention/data deletion policy and where relevant, individual polices which reflect these arrangements.
k. We may process special categories of personal data relating to individuals including, for example as appropriate:
i. information about a physical or mental health condition in order to monitor sick leave and take decisions as to the individual’s fitness for work;
ii. the individual’s racial or ethnic origin or religious or similar diversity data in order to monitor compliance with equal opportunities legislation;
iii. in order to comply with legal requirements and obligations to third parties.
l. Our processing may include the taking of photographs, filming and live streaming of particular events for use in promotional or training events, and which may appear in promotional material and/or on our intranet and website. Our website is also accessible from overseas.
e.g. re: Employees and office holders’ photographic ID passes. Capital Mass has a legitimate interest in providing these for the safety of Capital Mass officers and staff.
m. Our processing also includes the use of CCTV systems for the prevention and prosecution of crime.
5. How is my information collected and how do I consent?
By signing up to attend a Capital Mass event (both by sign up online and using the sign in sheet on the day of the event) you consent to your information being shared with Capital Mass. Your information is also collected when you become a financial donor of Capital Mass and a when you sign up to receive our e-newsletter via the Capital Mass Website.
6. Sharing your personal data
Your personal data will be treated as strictly confidential. Your information will be saved on the Capital Mass IT Server and accessible by employees and board members of Capital Mass. Your information will only be shared with partner organisations if you give Capital Mass your consent. Your information will never be shared for marketing purposes. Any feedback which you give us consent to use will anonymised then be made public through the Capital Mass Website and Reports in order to promote and celebrate the work of Capital Mass and the parishes of the Diocese of London in tackling poverty and inequality.
7. How long do we keep your personal data?
In general, we will endeavour to keep data only for as long as we need it. This means that we may delete it when it is no longer needed, in line with our approach to data retention. We will keep some records permanently if we are legally required to do so. We may keep some other records for an extended period of time. For example, it is current best practice to keep financial records for a minimum period of 6 years to support audits from external bodies.
If you have signed up to receive the Capital Mass e-newsletter, we will keep your information for up to 5 years. Every 5 years you will be invited to re-subscribe to receive the e-newsletter.
If you have become a financial donor to Capital Mass, we will keep your information for up to 5 years. Every 5 years we will contact you to make sure the information we have is correct.
If you have attended an event and provided feedback your personal information one year after the event will be deleted from the platform used to sign up, as well as any sign in sheet used for the event. We will then anonymise the attendees but keep the statistics of who has attended and any feedback for up to 10 years.
8. Your rights and your personal data
You have the following rights with respect to your personal data:
To access information we hold on you – you can contact us in writing at any time (see 11. Contact Details)
To correct and update the information we hold on you - we will make relevant changes
To have your information erased - you can request deletion
To restrict the processing of your data – you can object to your data being used
To moving your data (data portability) – you can request data transfer
To withdraw your consent, where consent was sought – this can be at any time
To object to the processing of personal data where applicable.
- To lodge a complaint with the Information Commissioners Office.
When exercising any of the rights listed above, in order to process your request, we may need to verify your identity for your security. In such cases we will need you to respond with proof of your identity before you can exercise these rights.
9. Transfer of Data Abroad
In general we do not transfer personal data abroad. However, where this does occur, any electronic personal data transferred to countries or territories outside the EU will only be placed on systems complying with measures giving broadly equivalent protection of personal rights either through international agreements or contracts approved by the European Union.
10. Further processing
If we wish to use your personal data for a new purpose, not covered by this Privacy Notice, then we will provide you with a new notice explaining this new use prior to commencing the processing and setting out the relevant purposes and processing conditions. Where applicable and whenever necessary, we will seek your prior consent to the new processing.
11. Contact Details
Please contact us if you have any questions about this Notice or the information we hold about you or to exercise all relevant rights, queries or complaints at:
Address: GDPR, Capital Mass, 36 Causton Street, London SW1P 4AU
You can contact the Information Commissioners Office on 0303 123 1113 or via email https://ico.org.uk/global/contact-us/email/ or at the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire. SK9 5AF.
12. Changes to this notice
We keep this Privacy Notice under regular review and we will place any updates on this web page: www.capitalmass.org.uk/about/privacy-notice
This Notice was updated in May 2018.
Company Registration Number 9257264
Charity Registration Number 1159501