Data Privacy Notice

Herefordshire Vennture

1. Your personal data is valuable – what is it?

Personal data relates to a living individual who can be identified from that data. Identification can be by the information alone or in conjunction with any other information in the data controller’s possession or likely to come into such possession. The processing of personal data is governed by the UK General Data Protection Regulation (the “UK GDPR”).

2. Who are we?

Herefordshire Vennture (“Vennture”) Charity No. 1156851 is a charity supporting vulnerable people and families and is the Data Controller (contact details below). This means it decides how your personal data is processed and for what purposes.

In certain instances some personal data may be held for participants under initiatives controlled by public bodies such as Herefordshire County Council & DWP. For these types of initiatives, these bodies are ultimately the Data Controller for such personal data.

3. How do we process your personal data?

Vennture complies with its obligations under the “UK GDPR” by keeping personal data up to date; by storing and destroying it securely; by not collecting or retaining excessive amounts of such data; by protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data.

We use your personal data for the following purposes: –

to enable us to provide services for the benefit of the public as per our charity purposes.
to administer participant and assisted vulnerable people’s essential information required to promote their wellbeing;
to promote the interests of the Charity and aid fundraising;
to manage our employees and volunteers;
to maintain our own accounts and records as required;
to inform you of Vennture news, events and activities.

4. What is the legal basis for processing your personal data?

We are only able to use your personal data when the law allows us to. This is called the legal basis. What do we mean by legal bases? Privacy law allows us the following bases under which we can process your personal data:

Consent – You have given us your consent to process your personal data for the specific purpose we have explained to you. You have the right to withdraw your consent at any time. To do so please contact us.

Contract – We need to use your data to fulfil a contract you have with us. Alternatively, it’s necessary to use your data because we have asked you to, or you have taken yourself, specific steps before entering that contract.

Legal Obligation – We need to use your data to comply with the law.

Vital Interests – Processing your data is necessary to protect your vital interests or of another person. For example, to prevent you from serious physical harm.

Public Task – Using your data is necessary for the performance of a task carried out in the public interest, or because it is covered by a task set out in law, for example, for a statutory function.

Legitimate Interests – Processing your data is necessary to support a legitimate interest we or another party has, only where this is not outweighed by your own interests.

We have your explicit consent to keep you informed about Vennture.
It is necessary for carrying out legal obligations in relation to Gift Aid or under employment, social security or social protection law;

In line with this, we process your personal data under the following bases:

We have your explicit consent to keep you informed about Vennture.
It is necessary for carrying out legal obligations in relation to Gift Aid or under employment, social security or social protection law;
It is needed to participate in our initiatives by ourselves, any controlling public body or other funder who may require information about our activities. Personal data is typically anonymised in such cases, but our funders may require certain case examples about the work we carry out as a charity.

Processing relates only to data of present or former participants, employees, volunteers, donors and supporters, in relation to our charity purposes.

Your personal data will be treated as strictly confidential and will only be shared with others (a) if we are legally required to do so or (b) to carry out the purposes connected with Vennture and covered by a data sharing agreement with Vennture to which you have given explicit consent.

Where data is being processed as part of specific initiatives, where explicit consent has been gained, please refer to the privacy statement for that initiative.

5. Sharing your personal data

We do not transfer your data outside the UK.

6. How long do we keep your personal data?

We will only keep data for as long as it is necessary to do so. Specifically we retain;

Employee Records and Gift Aid declarations for 6 years after the year to which they relate;
data that may be necessary for safeguarding purposes is retained for 6 years after being obtained;
data on supporters & volunteers is retained for 2 years after their involvement;
participant data processed under initiatives controlled by other public bodies is retained for as long as each initiative’s terms & conditions requires as notified on the privacy statements of those initiatives;

There will be an annual audit of data held and any data no longer required will be deleted.

7. Your rights and your personal data

Unless subject to an exemption under the UK GDPR and/or EU GDPR, where applicable, you have the following rights with respect to your personal data:

to request a copy of your personal data held by us and have it corrected if inaccurate.
to request your personal data is erased.
to withdraw your consent to the processing of it, under certain circumstances.
to request that we provide your data and, where possible, transmit it directly to another data controller, (known as the right to data portability), where applicable;
to place a restriction on the further processing where there is a dispute, in relation to the accuracy of the data, the processing is unlawful and you oppose the data’s erasure;
to object to the processing of personal data where applicable.

If you are unhappy with any of the information in this privacy notice or on how we process your personal data, please contact us via the details below.

If you are still unhappy, please note that you also have a right to lodge a complaint with the Information Commissioners Office. This can be done in the following ways:

By post:

Information Commissioner’s Office:
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

By helpline: 0303 123 1113

The ICO website can be found here: https://ico.org.uk/global/contact-us/

8. Further processing

If we wish to use your personal data for a new purpose, not covered by this Data Privacy Notice, then we will provide you with a new notice explaining this new use prior to commencing the processing and setting out the relevant purposes and processing conditions. Where and whenever necessary, we will seek your prior consent to the new processing.

9. Contact Details

To exercise all relevant rights, queries of complaints please in the first instance contact us at, Herefordshire Vennture at enquiries@vennture.org.uk.
26 Vicarage Road, Hereford, HR1 2QN
Tel: 0330 2020730

10. Data Protection Officer

The contact details for our data protection officer are as follows:

By post:
DataCo International UK Limited
Suite 1, 3rd Floor Suite 1
11 – 12 St James’s Square
London
United Kingdom
SW1Y 4LB

By email: privacy@dataguard.co.uk
By phone: +442035146557