This policy and code of practice applies to all Trustees, Associates, Representatives, Staff (paid and voluntary), and anyone else representing Bibles for Children. It has been prepared to comply with all published guidance and legal requirements including the new General Data Protection Regulations (GDPR) which came into force on 25 May 2018.
The purpose of the policy is twofold:
Firstly, to ensure that, as far as possible, all data which the charity acquires is stored and used in a way which preserves the control of the information with the data subject and prevents any misuse, or acquisition by any party not entitled to possess it.
Secondly to guide all staff and others acting in the name of the charity in the correct way to handle data and thereby protect themselves from the consequences of incorrect storage or misuse of personal data.
Principles
All reasonable steps should be taken to ensure that the Personal Data which we hold is:
- processed lawfully, fairly and in a transparent manner in relation to individuals.
- collected only for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing to provide audit trails shall not be considered to be incompatible with the initial purposes.
- adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed.
- accurate, having regard to the purposes for which they are processed, and are erased or rectified without delay when appropriate.
- kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest subject to implementation of the appropriate technical and organisational measures, and
- processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
Data Controller
Overall responsibility for Bibles for Children rests with the Trustees, who have appointed the Director of Operations, working under their direction, to be the Data Controller for the charity. The Data Controller shall be responsible for and be able to demonstrate compliance with these principles and the overall policy of the charity.
Data Processors
All staff and Executive Trustees are Data Processors, who are required to implement the Principles and Policy approved by the Trustees and are each legally responsible for their own actions.
Storage of Information
The information is held on the charity’s database in the computers used by its officers and Trustees and memory sticks used for backing up this data and conveying it between computers. The computers are all protected by passwords. The 8 approved memory sticks are held in secure locations when not in use and only used by the charity’s officers who are personally responsible for maintaining the security of the data on them. Copying of any personal data onto other computers, memory sticks or devices is strictly forbidden.
All computers and storage devices must be protected by strong passwords of at least 8
digits containing at least one upper case letter, one lower case letter, one numeral and
one symbol.
To be lawful, the reason why we hold and process personal data must always be covered by one of the following reasons:
Processing
- Consent: the individual has given Bibles for Children clear consent for us to process their personal data for a specific purpose. This covers publishing personal data in our Annual Report and on our website.
- Contract: the processing is necessary for us to fulfil a contract we have with the individual, or because they have asked us to take specific steps before entering into a contract. This covers submitting personal data to invoicees, contractors and banks to enable us to fulfil our contractual obligations.
- Legal obligation: the processing is necessary for us to comply with the law (not including contractual obligations). This covers submissions to the Charity Commission for England & Wales and the Office of the Scottish Charity Regulator in the Annual Returns, and to the Inland Revenue for claiming Gift Aid refunds.
- Public task: the processing is necessary for us to perform a task in the public interest or for official functions, and the task or function has a clear basis in law.
- Legitimate interests: the processing is necessary for our legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. This covers sending acknowledgement letters to donors and contacting them again in subsequent years to give up-to-date information about the charity and requesting further support. It also covers sending acknowledgement letters to presenters representing the charity in a school and subsequently contacting them and the school when the school is eligible for a
further presentation.
Portability of Data
We will only transfer personal data to another data controller if it is necessary for us to fulfil a contract or an order, or we are lawfully required to do so by a Government Department or Agency. Personal information on the charity’s database or elsewhere must not be passed to third parties without the written permission of the data subject. Similarly, such data must not be requested from other organisations. Data already in the public domain is excluded from this restriction.
The rights of Data Subjects
Individuals who have given personal data to Bibles for Children have the right to:
- request a copy,
- request that inaccurate or out-of-date information is corrected,
- request that some or all their personal information is deleted,
- withdraw their consent to the processing of some or all their personal data at any time,
- lodge a complaint with the Information Commissioner’s Office via their website here: ico.org.uk/make-a-complaint/
Any request received by Bibles for Children will be acted on as soon as reasonably practical, but that request will only apply to future storage and use and cannot be applied retrospectively particularly when prior consent has been given for personal information to be placed in the public domain.
Complaints regarding data
Any complaint regarding the actions or inaction of an individual regarding storage or use of data should be referred to the Data Controller. Any complaint regarding the actions or inaction of the Data Controller should be addressed to the Chair.
Data Controller:
| Mrs Elaine Martin Finance Director and Trustee |
Tel: 01761 479506 Tel: 07976 439990 Email: bibles4children2@aol.com Email: bibles4children4@aol.com |
Chair, Bibles for Children:
| Rev Paul Stephens | Tel: 01761 479506 Email: bibles4children8@gmail.com |