Privacy Policy/GDPR Statment

Privacy Notice

Introduction

This Privacy Policy tells you how and why Spruse Stevenage Reuse Scheme collects, stores and uses your personal data. It tells you about your rights in relation to your personal data and how the law protects you. It also covers how to contact us and the authorities in the event you have a complaint.

We ask that you read this policy carefully so that you are fully aware of how and why we are using your data. If you have any questions, or would like to exercise your privacy rights, please contact us directly.

Whose data do we collect?

We hold data on suppliers of equipment and services, donors, customers, volunteers and staff

How we obtain your data

The majority of the information we hold about you has been provided directly to us by you, in order to collect or deliver your furniture or to register you with the scheme in order to pay the reduced price or to collect your gift aid.

If you have been referred to our service, your data will have been provided by the referring agency and we will use to arrange your delivery.

What we do with your data and why

Customers/Donors/Volunteers

The core purposes of our data processing are to:

Deliver or Collect your items or to register customers to enable them to pay the reduced price.
administer volunteering opportunities
to administer the giftaid programme

We collect the following classes of information:

name(s) and address, phone numbers and email addresses.
records of donations, collections and giftaid status
records of volunteering or working for Spruse Stevenage Reuse Scheme
information about our relationship with you such as correspondence, attendance at meetings.

Protecting your data

We have appropriate security measures in place to prevent personal data from being accidentally lost or used or accessed in an unauthorised way. We limit access to your personal data to those who have a genuine business need to know it. Those processing your data will do so only in an authorised manner and are subject to a duty of confidentiality. We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so. When communicating with us by email you should ensure that you take all reasonable precautions to protect any sensitive personal data.

We do not share your data with anyone else or any other organisation unless it is necessary for the purpose for which you have given us the data. Examples are given below:

We will provide information to HMRC on Gift Aided donations since we have a legal obligation to provide this information.
We may share basic information on the attendees at an event or function or meeting with the host or other person who has a volunteer role in Stevenage Community Trust.

Data retention

We will only retain your personal data for as long as is necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

By law we have to keep basic information about our customers (including Contact, Identity, Financial and Transaction Data) for six years after they cease being customers for tax purposes.

In some circumstances you can ask us to delete your data: see below for further information.

In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

A cookie is a small file which is placed on a computer's hard drive, or in the browser memory, to make a website work, or work more efficiently for returning visitors. The Stevenage Community Trust website uses cookies for the following functions: Google Analytics.

Google Analytics records visitor trends and uses a cookie to track which pages are accessed. The cookie contains no personally-identifiable information, but it does use your computer’s IP address to determine where in the world you are accessing the site from, and to track your page visits within the site.

Enabling/disabling cookies

You have the ability to accept or decline cookies by modifying the settings in your browser. However, our website may not function correctly if cookies are disabled.

Our responsibilities

The law requires us to tell you the basis on which we process your data.

Some activities (for example sending you emails which promote Spruse’s interests) require your consent. If the law requires your consent to process data in a certain way then we will obtain it before carrying out that activity.
Other activities are carried out to fulfil a contract or agreement. Examples include organising a ticketed event requiring us to know who you are and to process your information in order to do the thing you have asked us to do. If a contract is in place then we will process your data based on that contract.
In all other cases the law allows us to process your data if it is in our legitimate interest to do so, but only so long as we need to and your “interests or your fundamental rights and freedoms are not overriding”. Practically speaking this means we carry out an exercise to check that we will not cause you harm by processing your data, that the processing is not overly intrusive and that we will only do so in a way which is described in this privacy notice.
We will keep data for as long as is necessary or legally obliged. Relationships between customers or donors and Spruse Stevenage Reuse Scheme are often long term, and so we expect to keep your data for as long as that relationship exists, or until we no longer require it.

When it is no longer needed, all personal data will be destroyed securely.

Your rights

The law requires us to tell you that you have a variety of rights about the way we process your data. These are as follows:

Where our use of your data requires consent, you may withdraw this consent at any time.
Where we rely on our legitimate interest to process data, you may ask us to stop doing so.
You may request a copy of the data we hold about you.
You may change or stop the way in which we communicate with you or process data about you, and if it is not required for the purpose you provided it, then we will do so. Activities such as processing Gift Aid donations may mean we cannot entirely stop processing your data. We will always endeavour to comply with such a request, however.
If you are not happy with any aspect of how we collect and use your data, you have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). If you do have a complaint we would be grateful if you would contact us first so that we can try and resolve it for you.
It is very important that the information we hold about you is accurate and up to date. Please let us know if at any time your personal information changes by emailing us at enquiries@stevenagecommunitytrust.org

Contacting us

If you have any questions about this privacy notice, about the way in which we process your data, or if you wish to change the way we use your data, including how we communicate with you, please contact us:

Spruse Stevenage Reuse Scheme

2-4 Willows Link

Stevenage

SG2 8AR

01436 362900

info@spruse.org.uk

Spruse Stevenage Reuse Scheme

GDPR Compliance Statement

Spruse Stevenage Reuse Scheme is committed to ensuring the security and protection of the personal information that we process, and to provide a compliant and consistent approach to data protection.

We have created this GDPR Compliance Statement to explain our approach to implementing our GDPR compliance programme. It describes the implementation of our data protection roles, policies, procedures, controls and measures to ensure ongoing compliance with GDPR.

Our GDPR Principles

Spruse Stevenage Reuse Scheme takes the privacy and security of individuals and their personal information very seriously. Our principles for processing personal information are:

We will process all personal information fairly and lawfully
We will only process personal information for specified and lawful purposes
Where practical, we will keep personal information up to date
We will not keep personal information for longer than is necessary.