Introduction
Marches Family Network is committed to protecting personal information and being transparent about what information they collect, use and store. This policy is in accordance with UK GDPR, the Data Protection Act (1998/2018), all other national laws and will be amended from time to time as regulations and best practice changes.
Scope
Marches Family Network take every effort to protect the privacy of all the children and young people, parents, carers, families, donors, volunteers and supporters and will never sell or give away information (name, address, email, etc.) to any third party unless consent has been given.
Under data protection regulations, Marches Family Network are required to appoint a Data Protection Officer (DPO) who ensures the information is always handled securely, in accordance with the law.
The Data Protection Officer for Marches Family Network is the Manager.
Marches Family Network uses personal data, so they must follow strict rules called data protection principles.
Responsibilities
Marches Family Network endorses fully and adheres to the six principles of data protection principles as set out in the Article 5 of the GDPR.
- Data will be processed lawfully, fairly and in a transparent manner.
- Data will be collected for specified, explicit and legitimate purposes and not processed in a manner that is incompatible with those purposes.
- Data will be adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed.
- Data will be accurate and, where necessary, kept up to date.
- Data will be kept for no longer than is necessary for the purposes for which it was collected.
- Data will be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
Legal Basis and What Can Be Collected
Marches Family Network always make sure there is a legal basis in data protection law before they start collecting and using information. The main legal basis they rely on are:
- Consent Where clear and informed permission has been given.
- Contractual Where there is a contract between Marches Family Network and an individual.
- Legal obligation Where a law says they have to.
- Legitimate interests Where it is necessary for their charitable aims and the benefits have been carefully balanced against respect for privacy, information rights, and expectations.
Marches Family Network collects data, including contact details and names. The individual details may differ depending on the individuals’ preferences and what data they have agreed to share with Marches Family Network. From time to time additional personal details may be requested, however Marches Family Network will always let the individual know why they believe this is necessary. Anyone has the right to withdraw their consent at any time.
Marches Family Network require more detailed personal information, such as medical information, for children and young people, staff and volunteers to ensure that they are adequately fulfilling their safeguarding duties and are able to provide a high-quality service.
When Marches Family Network processes personal data using legitimate interests as a legal basis, they will consider and balance any potential impact on the individual and their rights under GDPR and any other relevant law to ensure the legitimate business interests do not override the individuals’ interests.
Personal data may be shared, with or without an individual’s consent, when authorised by law or necessary to comply with a valid legal process.
Personal Data about Children and Young People and Families
If a child or young person and family are new to the service, Marches Family Network will ask for consent and will ensure permission to use personal data is freely given, specific, informed and unambiguous.
Children and young people’s data will be kept to deliver services and to ensure Marches Family Network fulfil their legal obligations, including safeguarding, and contact details for the child or young person’s parent/carer (including Personal Assistants where appropriate), to ensure the wellbeing and safety of the child or young person. They will also keep relevant personal medical details, without which they would be unable to meet their safeguarding obligations to the child or young person.
Marches Family Network have the right to refuse to meet the wishes of the parent/carer for a child or young person to attend Marches Family Network sessions if they cannot obtain the necessary details in a timely manner from the parent/carer to ensure the wellbeing and safety of the child or young person.
Personal Data about Staff
If an individual works or volunteers for Marches Family Network, they collect information during recruitment and ongoing work. This may include contact details including next-of-kin, bank details, personnel references, background checks, occupational health records, pension information and disciplinary records. This information is mainly provided directly by the worker or volunteer but may be obtained from a past employer. Marches Family Network only share information when it is necessary for the fulfilment of a workers employment contract and to provide the benefits and support promised to the worker.
Personal Data about Business Associates
If a company/charity has a business relationship with Marches Family Network, they collect administrative information about representatives, plus payment details and history. This may include contact information, communication history and bank details. This information is always provided by the company/charity. This information is not shared with anyone externally, except Marches Family Network’s accountant who may need to look at payment histories as part of the year end accounts procedure.
Marches Family Network collect information based on purchase agreements, which are a type of contract. Using this information ensures the goods and services they are buying are delivered in the agreed way and paid as required. There is no right to object to this information being collected, or restricting how it is used, because it has already agreed to as part of the purchase agreement.
How the Personal Data is Collected
Marches Family Network collect personal data when an individual registers to receive any regular updates online, by post, by phone, or in person. Data from application forms for employment, emails (meta data) and from third parties (such as Health and Social Care professionals) is collected. Personal data will only be taken if freely given, specific, informed and unambiguous and will be transferred to the appropriate database with the individuals details, the date of the event and type of consent given. Marches Family Network will also collect data for any participants of events run by them, or in association with third-party organisers. However, the data collected will not be shared with the third party unless consent to do so has been obtained.
How the Personal Data is Safeguarded
Marches Family Network has safeguards in place to protect personal data from loss, misuse, unauthorised use, access, inadvertent disclosure, alteration, and destruction.
They update and test security on an ongoing basis and restrict access to personal data to only those who need to know in order to provide Marches Family Network content or services. Please note that it is the responsibility of the sender to ensure that all emails are sent virus free from a reputable provider in order to pass through spam filters.
Storage of Personal Data
Marches Family Network store all their personal and company data on the Microsoft 365 cloud. This cloud storage is compliant with GDPR. Access to their data is provided via accounts with Multi-Factor Authentication enabled and access is further restricted to approved countries only.
Marches Family Network’s Microsoft 365 Cloud system is administered and maintained by their Managed Service Provider, which is John Finch Computers Ltd.
Paper-based records are securely kept at the Marches Family Network office with restricted access.
Privacy of Children and Young People’s Data
Children and young people merit specific protection with regard to their personal data, as they may be less aware of the risks, consequences, safeguarding concerns and their rights in relation to the processing of personal data. Marches Family Network have a legal obligation to keep children and young people’s data to ensure we can perform their duty of care to each child or young person that accesses Marches Family Network’s services and to allows them to offer high-quality short break services and sessions.
Parent/Carers are given the option to consent for Marches Family Network to use photographs, film footage or information for case studies to support their fundraising and marketing activities. They will not use any photographs or film footage for which they do not have consent.
Parents/Carers will be guided through Marches Family Network’s data privacy requirements as part of the registration process. If any parent/carer wishes to find out more before registering their child or young person, please call the Manager on 01568 614908.
Online Data Collection and Social Media
The www.marchesfamilynetwork.org.uk website is the only site that Marches Family Network manages and has ownership of.
Enquiries and feedback submitted through forms on the website are processed through a Simple Mail Transfer Protocol (SMTP) ‘noreply@’ email. No data submitted using forms on the website is stored on the website host server. The website has a Secure Socket Layer (SSL) certificate, evidenced by the https:// element of our URL and the padlock symbol.
Marches Family Network also has a presence on social network pages. Any comments made by individuals on these sites are not managed by Marches Family Network and as such are bound by the privacy policies of each site used. If anyone is not happy with the content that Marches Family Network post, which includes pictures, please contact the Manager with screenshots/details of the posts so that the concerns can be addressed. The website contains links to other websites. We are not responsible for the privacy policies or practices of third-party websites.
When and How Personal Data is Shared with Others
Promoting the welfare and protecting the safety of the children and young people that use Marches Family Network’s services is very important. Information that could be relevant to keeping a child or young person safe will be shared so that informed decisions can be made about a child or young person’s welfare. The information will be shared with relevant services, including social workers, health professionals and educational settings, as needed. Some data may also be shared with local authorities as part of monitoring requirements where a Service Level Agreement or contract for services provided is in place.
How Long is Personal Data Kept
The requirements for data retention differ according to the data subject. We retain all data in accordance with our Data Retention Policy.
Rights and Preferences
If an individual informs Marches Family Network that they want their personal data erased, or that they no longer wish to receive communication, Marches Family Network may retain some basic information in order to avoid sending unwanted materials in the future, and to keep a record of the request and response. Marches Family Network may not need consent for this, as long as they inform individuals the reason why they need the records and the lawful basis for this processing (e.g. legal obligation or legitimate interests).
Marches Family Network reserve the right not to erase data if they believe it in any way prevents them from meeting safeguarding or legal obligation towards the children and youngpeople in their care.
An individual has the right of access to their personal data under the GDPR Right of Access. Such requests must be specific about what information is required, and identity checks may be required to verify that it is the data subject (or his/her advocate) making the request.
An individual has the right to rectification of any information held by Marches Family Network which is inaccurate or incomplete, and the right to data portability. They may also exercise their right to object to the processing of their personal data in certain circumstances, such as direct marketing.
What Happens if Personal Data is not Provided
Marches Family Network are unable to provide short breaks and services for families without adequate data about the child or young person and family.
Getting in Touch
To confirm that Marches Family Network is processing personal data, to access, update or change the personal data that is held, preferences, or to obtain a copy for an individual’s own purposes, please contact the Manager on 01568 614908 or email manager@marchesfamilynetwork.org.uk
Erasing Personal Data
If an individual wants personal data erased, please send an email to: manager@marchesfamilynetwork.org.uk.
How to Make a Complaint About the Way Data is Held
Please contact the Data Protection Officer at Marches Family Network by emailing manager@marchesfamilynetwork.org.uk if there is a concern about the way Marches Family Network is handling information, particularly if there is a belief the data is:
- not being kept securely
- continually inaccurate
- being disclosed to others without permission
- being held for longer than is necessary
- being held for one reason and used for something else
Alternatively, if you would prefer to address the concerns to the Chair of Trustees you may do so by letter to:
Chair of Trustees
Marches Family Network
Mortimer House
Holmer Road
Hereford
HR4 9TA