The Yorkshire Rescue | GDPR / Privacy Policy 2023
Some abbreviations used in this Policy:
“TYR” identifies “The Yorkshire Rescue”.
“DPO” identifies “Data Protection Officer”.
NB: In the considered opinion of the Trustees, the scope and nature of the personal data held by TYR is not sufficient to warrant the explicit appointment of a DPO. Accordingly, no DPO is currently appointed.
Some definitions used in this Policy:
“Data Controller” The Board of Trustees is the Data Controller for TYR.
“Data Processor” The Board of Trustees is the Data Processor for TYR.
“Data subject” A person that has permitted TYR to control and process their personal data, and that of their pets.
Access to Data
Where necessary to pursue the legitimate purposes of TYR, only the Data Processor shall have access to the personal data held by TYR.
Training
The Data Processor will periodically undergo appropriate training commensurate with the scale and nature of the personal data that TYR holds and processes under the UK-GDPR.
TYR will ensure that all personal data that it holds will be:
processed lawfully, fairly and in a transparent manner in relation to data subjects;
collected only for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes;
adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;
kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes subject to implementation of the appropriate technical and organisational measures required by the UK-GDPR in order to safeguard the rights and freedoms of data subjects; and
processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
TYR will ensure that all personal data that it holds will:
NOT be disclosed to any third parties without the express consent of the data subjects, except in cases of suspected unlawful activity, or as directed by appropriate authorities. (Ref: By Legal Obligation)
The Data that TYR collects:
Contact Information
For the purposes of this Policy, “Contact Information” means any or all of a data subject’s:
full name (including any preferences about how they like to be called);
full postal address;
telephone and/or mobile number(s);
e-mail address(es);
if appropriate, social media IDs/User Names (e.g. Facebook etc.)
Relevant Animal Information
Any information that is relevant to the work of TYR.
TYR will obtain, hold and process all personal data in accordance with the UK-GDPR for the following purposes.
In all cases the information collected, held and processed will include “Contact Information”.
Methods of Data Processing
Lawful Processing
Data subjects who are interested in, and wish to be kept informed of, the activities of TYR:
a) Subject to the data subject’s consent, this may include information selected and forwarded by the TYR on activities by other organisations which are relevant to those of the TYR.
Note: this will not involve providing the data subject’s personal data to another organisation.
b) The information collected may additionally contain details of any particular areas of interest about which the data subject wishes to be kept informed.
c) The information provided will be held and processed solely for the purpose of providing the information requested by the data subject.
By Contract
For data subjects who sell goods and/or services to, and/or purchase goods and/or services from TYR.
The information collected will additionally contain details of:
a) The goods/services being sold to, or purchased from TYR;
b) Bank and other details necessary and relevant to the making or receiving of payments for the goods/services being sold to, or purchased from TYR. The information provided will be held and processed solely for the purpose of managing the contract between TYR and the data subject for the supply or purchase of goods/services.
By Legal Obligation
Where there is a legal obligation on TYR.
Personal information on trustees and employees may be collected, processed and shared, upon request, or if malpractice is suspected, with third parties such as, but not limited to, HMRC, the Charities Commission, TYR’s legal representatives, the Police etc.
The information provided will be held, processed and shared with others solely for the purpose of meeting TYR’s legal obligations.
By Vital Interest
TYR undertakes no activities which require the collection, holding and/or processing of personal information for reasons of vital interest. Processing personal data may be considered vital if it impacts a data subject's survival.
By Public Task
TYR undertakes no public tasks which require the collection, holding and/or processing of personal information.
Legitimate Interest
For Volunteers, including Trustees:
In order to be able to operate efficiently, effectively and economically, it is in the legitimate interests of TYR to hold such personal information on its volunteers and trustees as will enable TYR to communicate with its volunteers on matters relating to the operation of the charity, for example:
the holding of meetings;
providing information about TYR’s activities – particularly those activities which, by their nature, are likely to be of particular interest to individual volunteers/trustees;
seeking help, support and advice from volunteers/trustees, particularly where they have specific knowledge and experience;
ensuring that any particular needs of the volunteer/trustee are appropriately and sensitively accommodated when organising meetings and other activities of TYR.
Individual Rights
The right to be informed
When collecting personal information TYR will provide to the data subject, free of charge, a Privacy Policy written in clear and plain language which is concise, transparent, intelligible and easily accessible containing the following information:
identity and contact details of the data controller;
purpose of the processing and the lawful basis for the processing;
categories of personal data (not applicable if the data are obtained directly from the data subject);
any recipient or categories of recipients of the personal data;
details of transfers to third parties and safeguards;
retention period or criteria used to determine the retention period;
the existence of each of data subject’s rights;
the right to withdraw consent at any time, where relevant;
the right to lodge a complaint with a supervisory authority;
the source the personal data originates from and whether it came from publicly accessible sources (not applicable if the data are obtained directly from the data subject);
whether the provision of personal data is part of a statutory or contractual requirement or obligation and possible consequences of failing to provide the personal data (not applicable if the data are NOT obtained directly from the data subject);
the existence of automated decision making, including profiling and information about how decisions are made, the significance and the consequences.
Notes on The right to be informed
In the case of data obtained directly from the data subject, the information will be provided at the time the data are obtained.
In the case that the data are NOT obtained directly from the data subject, the information will be provided within a reasonable period of TYR having obtained the data (within one month), or, if the data are used to communicate with the data subject, at the latest, when the first communication takes place; or if disclosure to another recipient is envisaged, at the latest, before the data are disclosed.
The right of access
The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him/her/them are being processed, and, where that is the case, access to his/her/their personal data and the information detailed in TYR’s relevant Privacy Policy.
The right to erase (The right to be forgotten)
Except where the data are held for purposes of legal obligation or public task, the data subject shall have the right to require the controller without undue delay to erase any personal data concerning him/her/them.
The right to restrict processing
Where there is a dispute between the data subject and the controller about the accuracy, validity or legality of data held by TYR, the data subject shall have the right to require the controller to cease processing the data for a reasonable period of time to allow the dispute to be resolved.
The right to data portability
Where data are held for purposes of consent or contract, the data subject shall have the right to require the controller to provide him/her/them with a copy in a structured, commonly-used and machine-readable format of the data which he/she/they has/have provided to the controller, and have the right to transmit those data to other controller(s) without hindrance.
The right to object
a) The data subject shall have the right to object, on grounds relating to his, her or their particular situation, at any time to the processing of personal data concerning him/her/them which is based Public Task or Legitimate Interest, including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
b) Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to the processing of personal data concerning him/her/them for such marketing, which includes profiling to the extent that it is related to such direct marketing.
c) Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.
d) At the latest, at the time of the first communication with the data subject, the right referred to in paragraphs a) and b) shall be explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information.
Rights in relation to automated decision making and profiling
Except where it is: a) based on the data subject’s explicit consent, or b) necessary for entering into, or performance of, a contract between the data subject and the data controller; the data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him/her/them or similarly significantly affects him/her/them.
Acknowledgement
TYR gives due credit and thanks to Small Charity Support.
This Policy is made available to other charities and not-for-profit organisations under a Creative Commons Attributable – Non Commercial – Share Alike International 4.0 License.