Privacy policy

Data Protection policy

Updated June 2021

POLICY STATEMENT

Everyone has rights with regard to the way in which their personal data is handled. During the course of our activities we will collect, store and process personal data about those we help, our donors, our employees, our volunteers and other third parties.

Data users are obliged to read this policy because it contains important information about:

1. the data protection principles which we must comply with;

2. what is meant by personal data and sensitive personal data;

3. how we gather, use and (ultimately) delete personal data and sensitive personal data in accordance with the data protection principles;

4. your rights and obligations in relation to data protection; and

5. the consequences of failure to comply with this policy.

You must comply with this policy when processing personal data on our behalf. Any breach of this policy may result in disciplinary action.

ABOUT THIS POLICY

World Child Cancer UK and World Child Cancer US (‘we’, ‘us’, ‘our’) may process personal data about current, past and prospective beneficiaries, current, past and prospective donors, current, past and prospective employees, volunteers, trustees, supporters, suppliers, and others that we communicate with. Personal data, which may be held on paper or on a computer or other media, is subject to certain legal safeguards specified in the General Data Protection Regulation and the UK Data Protection Act 2018 (together, the ‘Act’) and other regulations. This policy sets out rules on data protection and the legal conditions that must be satisfied when we obtain, handle, process, transfer and store personal data.

1. This policy does not form part of any employee's contract of employment and may be amended at any time.
2. The Finance Director is responsible for ensuring compliance with the Act and with this policy. Any questions about the operation of this policy or any concerns that the policy has not been followed should be referred in the first instance to the Finance Director.

DEFINITION OF DATA PROTECTION TERMS

1. Data subject means the individual to whom the personal data relates.
2. Personal data means data relating to a living individual who can be identified from that data (or from that data and other information in our possession). Personal data can be factual (for example, a name, address or date of birth) or it can be an opinion about that person, their actions and behaviour.
3. Data controllers are the people who or organisations which determine the purposes for which, and the manner in which, any personal data is processed. They are responsible for establishing practices and policies in line with the Act.
4. Data users are those of our employees whose work involves processing personal data. Data users must protect the data they handle in accordance with this policy and any applicable data security procedures at all times.
5. Data processors include any person or organisation that is not a data user that processes personal data on our behalf and on our instructions. Employees of data controllers are excluded from this definition but it could include suppliers which handle personal data on our behalf.
6. Processing is any activity that involves use of personal data or sensitive personal data. It includes obtaining, recording or holding the data, or carrying out any operation or set of operations on the data including organising, amending, retrieving, using, disclosing, erasing or destroying it. Processing also includes transferring personal data to third parties.
7. Sensitive personal data includes information about a person's racial or ethnic origin, political opinions, religious or similar beliefs, trade union membership, physical or mental health or condition or sexual life, or about the commission of, or proceedings for, any offence committed or alleged to have been committed by that person, the disposal of such proceedings or the sentence of any court in such proceedings. Sensitive personal data can only be processed under strict conditions (see paragraph 6 for further details).

DATA PROTECTION PRINCIPLES

We will comply with the following enforceable principles when processing personal data:

1. we will process personal data lawfully, fairly and in a transparent manner;
2. we will collect personal data for specified, explicit and legitimate purposes only, and will not process it in a way that is incompatible with those legitimate purposes;
3. we will only process the personal data that is adequate, relevant and necessary for the relevant purposes;
4. we will keep accurate and up to date personal data, and take reasonable steps to ensure that inaccurate personal data are deleted or corrected without delay;
5. we will keep personal data for no longer than is necessary for the purposes for which the data is processed; and
6. we will take appropriate technical and organisational measures to ensure that personal data are kept secure and protected against unauthorised or unlawful processing, and against accidental loss, destruction or damage.

FAIR AND LAWFUL PROCESSING

1. The Act is not intended to prevent the processing of personal data, but to ensure that it is done fairly and without adversely affecting the rights of the data subject.
2. For personal data to be processed lawfully, they must be processed on the basis of one of the lawful bases set out in the Act. These include (but are not limited to) the data subject's consent to the processing, that the processing is necessary for the performance of a contract with the data subject, for the compliance with a legal obligation to which the data controller is subject, or for the legitimate interest of the data controller or the party to whom the data is disclosed. When sensitive personal data is being processed, additional conditions must be met (as set out in paragraph 6 below). When processing personal data as data controllers in the course of our activities, we will ensure that those requirements are met.

SENSITIVE PERSONAL DATA

Sensitive personal data is sometimes referred to as ‘special categories of personal data’.

We may from time to time need to process sensitive personal data. We will only process sensitive personal data if:

1. we have a lawful basis for doing so; and
2. one of the special conditions for processing sensitive personal data applies, e.g.

1. the data subject has given explicit consent;
2. the processing is necessary for the purposes of exercising the employment law rights or obligations of the Company or the data subject;
3. the processing is necessary to protect the data subject’s vital interests, and the data subject is physically incapable of giving consent;
4. processing relates to personal data which are manifestly made public by the data subject;
5. the processing is necessary for the establishment, exercise or defence of legal claims; or
6. the processing is necessary for reasons of substantial public interest.

Before processing any sensitive personal data, staff must notify the Finance Director in order that he/she may assess whether the processing complies with the criteria noted above.

Sensitive personal information will not be processed until:

1. the assessment referred to in paragraph 6.3 has taken place; and
2. the individual has been properly informed (by way of a privacy notice or otherwise) of the nature of the processing, the purposes for which it is being carried out and the legal basis for it.

PROCESSING FOR LIMITED PURPOSES

In the course of our activities, we may collect and process the personal data set out in the Schedule below. This may include data we receive directly from a data subject (for example, by completing forms or by corresponding with us by mail, phone, email or otherwise) and data we receive from other sources (including, for example, other charities, sub-contractors in technical, payment and delivery services, and others).

We will only process personal data for the specific purposes set out in the Schedule below or for any other purposes specifically permitted by the Act. We will notify those purposes to the data subject (as set out in paragraph 8 below).

NOTIFYING DATA SUBJECTS

If we collect personal data directly from data subjects, we will inform them about:

1. the purpose or purposes for which we intend to process that personal data;
2. the types of third parties, if any, with which we will share or to which we will disclose that personal data; and
3. the means, if any, with which data subjects can limit our use and disclosure of their personal data.

If we receive personal data about a data subject from other sources, we will use reasonable efforts to provide the data subject with this information.

8.3 Data subjects have the right to request that their data is not kept on our systems. There should be an information opt-out option on all materials sent to data subjects.

8.4 We will issue privacy notices from time to time, informing you about the personal data that we collect and hold relating to you, how you can expect your personal data to be used and for what purposes.

DATA PROTECTION IMPACT ASSESSMENTS (DPIAS)

1. Where processing is likely to result in a high risk to an individual’s data protection rights (e.g. where we are planning to use a new form of technology), we will, before commencing the processing, carry out a DPIA to assess:
2. whether the processing is necessary and proportionate in relation to its purpose;
3. the risks to individuals; and
4. what measures can be put in place to address those risks and protect personal data.

RECORDS

1. In order to comply with our obligations under the Act, we keep written records of our processing activities, including records of processing which are high risk, i.e. which may result in a risk to individuals’ rights and freedoms or involve sensitive personal data or criminal records information.

PROCESSING IN LINE WITH DATA SUBJECTS’ RIGHTS

Data subjects (including you) have the following rights in relation to their personal data:

1. to be informed about how, why and on what basis that information is processed—see our Privacy Policy for further information in respect of this;
2. to obtain confirmation that their personal data is being processed and to obtain access to it and certain other information, by making a subject access request (see paragraph 18 below in respect of this);
3. to have their personal data corrected if it is inaccurate or incomplete;
4. to have personal data erased if it is no longer necessary for the purpose for which it was originally collected/processed, or if there are no overriding legitimate grounds for the processing (this is sometimes known as ‘the right to be forgotten’);
5. to restrict the processing of personal data where the accuracy of the information is contested, or the processing is unlawful (but they do not want the data to be erased), or where the we no longer need the personal data but the data subject requires the personal data to establish, exercise or defend a legal claim; and
6. to restrict the processing of personal data temporarily where they do not think it is accurate (and we are verifying whether it is accurate), or where they have objected to the processing (and we are considering whether our legitimate interests override the data subject’s interests).

INDIVIDUALS’ OBLIGATIONS

Individuals are responsible for ensuring that we keep their personal data up to date. You should let the Finance Director know if the information you have provided to us changes, for example if you move house or change details of the bank or building society account to which you are paid.

You may have access to the personal data of other members of staff, our suppliers, our donors or our beneficiaries in the course of your employment or engagement. If so, we expect you to help us meet our data protection obligations to those individuals.

If you have access to personal data, you must:

1. comply with our IT policy;
2. only access the personal data that you have authority to access, and only for authorised purposes;
3. only allow other staff to access personal data if they have appropriate authorisation;
4. keep personal data secure (e.g. by complying with our rules on access to premises, computer access, password protection and secure file storage and destruction);
5. not remove personal data, or devices containing personal data (or which can be used to access it), from our premises unless appropriate security measures are in place (such as pseudonymisation, encryption or password protection) to secure the information and the device; and
6. not store personal data on local drives or on personal devices that are used for work purposes.

You should contact the Finance Director if you are concerned or suspect that one of the following has taken place (or is taking place or likely to take place):

1. processing of personal data without a lawful basis for its processing or, in the case of sensitive personal information, without one of the conditions in paragraph 6;
2. any data breach as set out in paragraph 17 below;
3. access to personal data without the proper authorisation;
4. personal data has not been kept or deleted securely;
5. removal of personal data, or devices containing personal data (or which can be used to access it), from our premises without appropriate security measures being in place;
6. any other breach of this policy.

DATA SECURITY

We will ensure that appropriate technical and organisational security measures to protect against unlawful or unauthorised processing of personal data, and against the accidental loss of, or damage to, personal data are in place.

We will put in place appropriate procedures and technologies to maintain the security of all personal data from the point of collection to the point of destruction. Personal data will only be transferred to a data processor if such data processor agrees to enter into a data protection agreement that is compliant with the Act.

All documents or files with sensitive personal data should be password protected.

We will maintain data security by protecting the confidentiality, integrity and availability of the personal data, defined as follows:

1. Confidentiality means that only people who are authorised to use the data can access it;
2. Integrity means that personal data should be accurate and suitable for the purpose for which it is processed;
3. Availability means that authorised users should be able to access the data if they need it for authorised purposes.

Security procedures include:

1. Entry controls. Any stranger seen in entry-controlled areas should be reported;
2. Methods of disposal. Paper documents containing personal data that are no longer required should be shredded;
3. Equipment. Data users must ensure that individual monitors do not show confidential information to passers-by and that they log out of or lock their laptop when it is left unattended.

TRANSFERRING PERSONAL DATA TO A COUNTRY OUTSIDE THE EEA

We may transfer personal data outside the European Economic Area (EEA) (which comprises the countries in the European Union and Iceland, Liechtenstein and Norway) to a country outside of the EEA on the basis of:

1. an adequacy decision;
2. binding corporate rules;
3. standard data protection clauses (known as model); or
4. where some other mechanism that (i) allows for such transfers outside of the EEA; and (ii) complies with the Act is in place. 

Personal data we hold may also be processed by staff operating outside the EEA who work for us or for one of our suppliers. That staff maybe engaged in, among other things, the fulfilment of contracts with the data subject, the processing of payment details and the provision of support services.

DISCLOSURE AND SHARING OF PERSONAL INFORMATION

We may share personal data we hold with HMRC, our pension provider, Companies House, The Charity Commission and other third parties, as necessary.

If we are under a duty to disclose or share a data subject's personal data in order to comply with any legal obligation, or in order to enforce or apply any contract with the data subject or other agreements; or to protect our rights, property, or safety of our beneficiaries, donors, employees, suppliers, or others.

We may also share personal data we hold with selected third parties for the purposes set out in the Schedule.

STORAGE AND RETENTION OF PERSONAL DATA

Personal data (including sensitive personal data will be kept securely and stored in accordance with our Data Retention Policy). 

DATA BREACHES

A data breach may take many different forms, for example:

1. loss or theft of data or equipment on which personal data is stored;
2. unauthorised access to or use of personal data either by a member of staff or third party;
3. loss of personal data resulting from an equipment or systems (including hardware and software) failure;
4. human error, such as accidental deletion or alteration of personal data;
5. unforeseen circumstances, such as a fire or flood; and
6. deliberate attacks on IT systems, such as hacking, viruses or phishing scams.

We will:

1. make the required report of a data breach to the Information Commissioner’s Office without undue delay and, where possible within 72 hours of becoming aware of it, if it is likely to result in a risk to the rights and freedoms of individuals; and
2. notify the affected individuals if a data breach is likely to result in a high risk to their rights and freedoms and notification is required by law.

SUBJECT ACCESS REQUESTS

Data subjects must make a formal request for information we hold about them. This must be made in writing. Employees who receive a written request should forward it to the Finance Director as soon as possible.

When receiving telephone enquiries, we will only disclose personal data we hold on our systems if the following conditions are met:

1. we will check the caller's identity to make sure that information is only given to a person who is entitled to it; and
2. we will suggest that the caller put their request in writing if we are not sure about the caller’s identity and where their identity cannot be checked.

Our employees will refer a request to their manager for assistance in difficult situations. Employees should not be bullied into disclosing personal information.

TRAINING

1. We will ensure that staff are adequately trained regarding their data protection responsibilities. Individuals whose roles require regular access to personal data, or who are responsible for implementing this policy or responding to subject access requests under this policy, will receive additional training to help them understand their duties and how to comply with them.

CONSEQUENCES OF FAILING TO COMPLY

We take compliance with this policy very seriously. Failure to comply with the policy:

1. puts at risk the data subjects whose personal data is being processed;
2. carries the risk of significant regulatory fines; and
3. may, in some circumstances, amount to a criminal offence by the individual.

Because of the importance of this policy, failure to comply with any requirement of it may lead to disciplinary action under our procedures, and this action may result in dismissal for gross misconduct. If a non-employee breaches this policy, they may have their contract terminated with immediate effect.

If you have any questions or concerns about anything in this policy, do not hesitate to contact Finance Director.

CHANGES TO THIS POLICY

We reserve the right to change this policy at any time.

THE SCHEDULE

DATA PROCESSING ACTIVITIES

All of the above categories include current, past or prospective data subjects.