Winchester Churches Nightshelter Privacy Notice

Updated 26th June 2018

The Winchester Churches Nightshelter (WCNS) is open 365 days a year offering an essential lifeline to those who are struggling with homelessness through provision of safe, high quality accommodation and food, support and access to counselling, medical and other services. We exist to help as many people as possible into successful independent living and to raise public awareness about those suffering from homelessness.

When doing this, we process personal information (also known as ‘personal data’) about people who receive our services – or those who provide us with support through campaigns, donations or volunteering. We are committed to protecting your privacy and take this responsibility very seriously. This notice outlines what data we collect, how we may use it, how we protect your data and your rights, in accordance with the prevailing legislation. Please read this notice carefully and if you have any questions, please telephone our Office on 01962 862050 or contact us at data@winchesterbeacon.org.uk

References to WCNS, ‘we’ or ‘us’ means The Winchester Churches Nightshelter, registered Charity No: 1080443 of Jewry Street, Winchester, SO23 8RZ. For the purposes of data protection law, WCNS is the data controller with conduct of your personal data.

How do we collect information?

Residents / Prospective Residents

We collect data from you during your relationship with us. This may be via:

  • Any paper forms you complete
  • Referral information from other Agencies that we may be in contact with
  • Verbal data collection
  • Communication via social media
  • Photographs, video or audio recordings
  • Forms, cookies and analytics via our website, or online surveys. You can find out more information about cookies, here

Some of the data we collect about you will be personal data. Personal data is information which identifies you, whether directly or indirectly.

Volunteers and Supporters

We collect data from you during your relationship with us. This may be via:

  • Any paper forms you complete
  • Verbal data collection
  • Communication via social media
  • Photographs, video or audio recordings
  • Forms, cookies and analytics via our website, or online surveys. You can find out more information about cookies, here

Some of the data we collect about you will be personal data. Personal data is information which identifies you, whether directly or indirectly.

Additional information regarding collection of employee data will be provided in our Employee Privacy Notice.

Why we collect your data

We only collect personal details needed to fulfil the service you expect from WCNS. Depending on the nature of the interaction, the information collected may include: –

  • The personal details required to allow us to provide you with the advice and support that you have requested. This may cover your full name and contact information, your date of birth, employment and financial details, family, lifestyle, medical and social circumstances.
  • Data needed to record and contact you regarding payments you make to us – e.g. bank account details for setting up regular direct debits.
  • Contact details to allow communication with you regarding our activities, fundraising, campaigns and donations.
  • Data for job applications or volunteer placements.
  • Participation in surveys and research (although this is voluntary).
  • Gift Aid information for any donation you may make.
  • Information to improve our services and user experiences.
Using your personal data

Residents / Prospective Residents

If you are receiving accommodation, advice, guidance or support from us, we will need to process your data because of your specific relationship with us. Our lawful ground for processing your personal data is that we have a legitimate interest in doing so in order to provide our services to you. In accordance with data protection law, we have fully considered your interests and fundamental rights and freedoms as an individual and are confident that they do not override our legitimate interest to carry out the processing.

As well as personal information (such as your name, address and data of birth) we may collect sensitive personal information (also known as special categories of data) of which may include:

  • Racial or Ethnic origin
  • Sexual Orientation
  • Physical or Mental Health Condition
  • Criminal conviction history

We use this data to ensure services are delivered appropriately and to monitor Equality, Diversity and Inclusion. We will apply additional security and confidentiality measures when processing your sensitive personal information, and we will ask for your specific informed consent at the time of collecting this type of data. Where you provide consent for us to process sensitive personal information, you have the right to withdraw this consent at any time. If you do withdraw your consent then we may be unable to provide certain services to you where those services require the processing of your sensitive personal information.

We will keep all your case information – including notes, letters and information given to us about you – in a confidential record that is specific to you. We use a password protected Microsoft Access database to support our service. This means that we can keep the information you provide to us, so we are able to see the history and relevant details of your case(s). This ensures that we provide appropriate and accurate advice or support. We take information security very seriously. No one is allowed access to our database system or files except WCNS staff and approved office volunteers, and no one will be allowed access to your information unless they need this in order to provide the service to you, or for one of the other purposes discussed in this notice. Our database remains on site with a back-up record held by our Computer Services provider, ensuring that the data remains secure, with access by approved personnel only.

We may use your anonymised data for statistical reports. These statistics will not include any information that could be used to identify you or any individual.

Whilst we have a legitimate interest in processing your data we will only process your data for the following purposes where we have received your consent:

  • Communications about our charitable purpose, campaigns and fundraising.
  • Marketing purposes.
  • Service questionnaires to obtain feedback on the services we provide
  • In house research questionnaires.
  • Informing you about products and services provided by WCNS

We use a third-party provider, MailChimp, to deliver our newsletter.

For more information, please see MailChimp’s privacy notice

Volunteers, Supporters, Employees

As well as personal information (such as your name, address and data of birth) we may collect sensitive personal information (also known as special categories of data) of which may include Racial or Ethnic origin. We use this data to ensure services are delivered appropriately and to monitor Equality, Diversity and Inclusion. We will apply additional security and confidentiality measures when processing your sensitive personal information, and we will ask for your specific informed consent at the time of collecting this type of data. Where you provide consent for us to process sensitive personal information, you have the right to withdraw this consent at any time.

We will keep all your information in a confidential record that is specific to you. We use a password protected Microsoft Access database to support our service. We take information security very seriously. No one is allowed access to our database system or files except WCNS staff and approved office volunteers, and no one will be allowed access to your information unless they need this in order to provide the service to you, or for one of the other purposes discussed in this notice. Our database remains on site with a back-up record held by our Computer Services provider, ensuring that the data remains secure, with access by approved personnel only.

We may use your anonymised data for statistical reports. These statistics will not include any information that could be used to identify you or any individual.

Whilst we have a legitimate interest in processing your data we will only process your data for the following purposes where we have received your consent:

  • Communications about our charitable purpose, campaigns and fundraising.
  • Marketing purposes.
  • Service questionnaires to obtain feedback on the services we provide
  • In house research questionnaires.
  • Informing you about products and services provided by WCNS

We use a third-party provider, MailChimp, to deliver our newsletter.

For more information, please see MailChimp’s privacy notice

Retention of your data

Whatever your relationship with us, we will only store your information for as long as is reasonably necessary. This may depend on a law or regulations that the information falls under such as financial regulations, Limitations Act, Health and Safety regulation etc., or any contractual obligation we might have – such as with government contracts or if we have a business case, such as with research data. For business case data, we will anonymize the data so no individual is identifiable. Once the retention period has expired, the information will be confidentially disposed or permanently deleted. Details of our retention period for information can be accessed here

Disclosure of your personal data

We will not, without your consent, supply any of your personal data to any third party – except where:

  • The transfer is to a secure data processor, which carries out data processing operations on our behalf subject to strict contractual obligations to keep your data safe and confidential.
  • We are required to do so by law enforcement or regulatory bodies where this is required or allowed under the relevant legislation.
  • There is a medical emergency whereby you are unable to give your consent to us sharing your data.

Residents at the Nightshelter are asked to give consent to share data on their arrival. Data may be shared with other support services, Housing Officers, accommodation providers, funders or third-party survey providers. We will make sure your details are safe, secure and only used for the limited purposes for which you have granted permission.

We will never share or sell your personal data to a third-party organisation for marketing, fundraising or campaigning purposes.

Campaigning / Direct marketing

We would love to keep you up to date with our fundraising, marketing and campaign activity. We will obtain your consent to contact you by email, phone, SMS or post. This allows us to send you the information and fundraising appeals we believe you may be interested in.

We will never share or sell your personal data to a third-party organisation for their marketing, fundraising or campaigning purposes.

If you would like to change your consent, update your details or unsubscribe from our communications at any point, you can do this by contacting our Office:

Any electronic communication will have a link to unsubscribe from future electronic communications, so you can manage your own consent.

If you make any changes to your consent, we will update your record as soon as we possibly can. If you tell us you do not wish to receive marketing, fundraising or campaign communications, you may still receive transactional and service-based communications confirming and servicing other relationships you have with us unless and until our legal ground for sending such other communications ceases to apply.

How do we collect information?

We collect data from you during your relationship with us. This may be via:

  • Any paper forms you complete
  • Referral information from other Agencies that you may be in contact with
  • Verbal data collection
  • Communication via social media
  • Photographs, video or audio recordings
  • Forms, cookies and analytics via our website, or online surveys. You can find out more information about cookies, here

Some of the data we collect about you will be personal data. Personal data is information which identifies you, whether directly or indirectly.

Why we collect your data

We only collect personal details needed to complete the recruitment process.

When you apply for a job with us, your personal data will be collated in order to monitor the progression of your application, and to monitor the effectiveness of the recruitment process through the statistics collected. Where we need to share your data – such as gathering references or obtaining a Disclosure and Barring Services check – you will be informed beforehand unless the disclosure is required by law. These checks are only done after a position has been offered only on the successful candidate. On the application form, you are asked to complete the referee details and can tick permission to contact referee. If you have been successful and offered a role, we will automatically send out reference requests.

Personal data about unsuccessful applicants is held for 12 months after the recruitment exercise is complete for that particular vacancy. Applicants can ask us to remove their data before this time if they do not want us to hold it. If we feel there is another suitable vacancy available, we will contact the applicant prior to sharing your application details with the relevant manager.

Once you have taken up employment with us we will compile a file relating to your employment. The information contained in this will be kept secure and will only be used for purposes directly relevant to your employment. Once your employment with us has ended, we will retain the file in accordance with the requirements of our retention schedule and then delete it from our files.

Security of your personal data

We use appropriate physical, electronic and organisational measures to keep your information secure, accurate and up to date. Although we use appropriate security measures once we have received your personal information, the transmission of data over the internet is never completely secure. We cannot guarantee the security of information transmitted to our website, so any transmission is at the user’s own risk.

Your rights

Under data protection law you have the following rights:

• The right to be informed

Through the provision of our privacy notices, we will be open and transparent about how and why we use your personal information.

• The right to withdraw consent

If we are processing your data on the basis of your consent then you have the right to withdraw that consent at any time. Consent can be withdrawn by notifying us using the details set out below. The lawfulness of our historic processing based on your consent will not be retrospectively affected by your withdrawal of consent

• The right of access to personal data

You have the right to make a written request (called a ‘subject access request’) to receive copies of some of the information we hold on you. You must send us proof of your identity, or proof of authority if making the request on behalf of someone else before we can supply the information to you.

From 25 May 2018 you will:

(a) no longer have to pay a £10 fee unless you are requesting copies of documents you already possess, in which case we may charge our reasonable administrative costs. We will also be allowed to charge you for our reasonable administrative costs in collating and providing you with details of the requested information which we hold about you if your request is clearly unfounded or excessive. In very limited circumstances, we are also entitled to refuse to comply with your request if it is particularly onerous; and

(b) in certain circumstances, be entitled to receive the information in a structured, commonly used and machine-readable form. You should send your subject access request and proof of identify / proof of authority:

  • by email to data@winchesterbeacon.org.uk; or
  • by post to The Manager, Winchester Churches Nightshelter, Jewry Street, Winchester, SO23 8RZ

• The right to rectification

You can ask us to rectify your personal data if it is inaccurate or incomplete.

• The right to erasure

The right to erasure is also known as ‘the right to be forgotten’. In some circumstances, you can ask us to delete or remove personal data where there is no compelling reason for its continued processing. This is not an absolute right, and we will need to consider the circumstances of any such request and balance this against our need to continue processing the data. Our response will also be guided by the provisions of our retention schedule.

• The right to restrict processing

In some circumstances you can ask us to restrict processing, for example:

•If you disagree with the accuracy of personal data

 If we’re processing your data on the grounds of legitimate interests (as detailed earlier), and whilst we consider whether our legitimate grounds override those of yours.

• The right to data portability

If the situation arises where it would be helpful for you to move, copy or transfer personal data we hold about you, across different services, you may be able to ask us to do this. Please contact us to discuss.

• The right to object to marketing

You can tell us if you object to our processing of your personal data:

• based on legitimate interests

• for the purpose of direct marketing (including profiling);

• Rights in relation to automated decision making and profiling.

We do not undertake automated decision making and profiling. We will provide an update should there be any change in this position.

Updating your information

If you believe that any of the personal information held or processed by us is incorrect then please contact us via:

• Email: data@winchesterbeacon.org.uk

• By post to the Winchester Churches Nightshelter at: Jewry Street, Winchester, SO23 8RZ.

We will update the information as soon as we possibly can.

If you want to remove yourself from any of our marketing communications and or our volunteer database, please email admin@winchesterbeacon.org.uk.

We regularly check this notice to ensure we provide you with the most up-to-date information regarding our data processing activities. We strongly advise you to read this page from time to time to ensure you are happy with any changes that might be made. This privacy policy was last updated on 25.06.2018