JAC DATA PRIVACY NOTICE

 

1. Your personal data – what is it?

Personal data relates to a living individual who can be identified from that data.  Identification can be by the information alone or in conjunction with any other information in the data controller’s possession or likely to come into such possession. The processing of personal data is governed by the General Data Protection Regulation (the “GDPR”).

 

2. Who are we?

Just Around the Corner (JAC) is the data controller (contact details Section 9).  This means it decides how your personal data is processed and for what purposes.

 

3. How do we process your personal data?

JAC complies with its obligations under the “GDPR” by keeping personal data up to date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data.

 

We use your personal data for the following purposes: -

• To enable us to provide a voluntary service for the benefit of the public in a particular geographical area as specified in our Charities Commission Registration;
• To enable us to provide services relating to our charitable purposes e.g. referrals, activities, and riding lesson;
• To administer membership records;
• To fundraise and promote the interests of the charity;
• To manage our employees and volunteers;
• To maintain our own accounts and records (including the processing of gift aid applications);
• To inform you of news, events, activities and services offered by JAC;

 

4. What is the legal basis for processing your personal data?

• Legitimate Interests for the processing of referral forms and liaising with referral contacts and invoicing.
• Explicit consent of the data subject so that we can keep you informed about news, events, activities and services.
• Processing is necessary for carrying out legal obligations in relation to Service Provision agreement; Gift Aid or under employment, social security or social protection law, or a collective agreement and safeguarding or data breach reports.
• Processing is carried out by a not-for-profit body with a political, philosophical, religious or trade union aim provided: -
  • the processing relates only to members or former members (or those who have regular contact with it in connection with those purposes); and
  • there is no disclosure to a third party without consent.

 

5. Sharing your personal data
   Your personal data will be treated as strictly confidential and will only be shared with other members of the Charity in order to carry out a service for purposes connected with the Charity.

We may share your personal data with affiliated organisations or with third parties with which we have partnered to allow you to integrate their services into our own services. We may use third party service providers (e.g. MailChimp) to help us operate our business.  This may require us to provide them temporarily with personal information such as email addresses.  These will only be used in conjunction with your interest in JAC.

We only share your personal data as necessary for any third party to provide the services as requested or as needed on our behalf. These third parties (and any subcontractors) are subject to strict data processing terms and conditions and are prohibited from utilizing, sharing or retaining your personal data for any purpose other than as they have been specifically contracted for (or without your consent). 

 

6. How long do we keep your personal data?
   We keep data in accordance with the guidance set out in the “Keep or Bin” section below. Specifically, we retain service user data while it is still current; referral forms and related information for length of contract + 2 terms (in case of follow on referral); Referral registers for length of contract + 10 years; gift aid declarations and associated paperwork whilst current + 6 years after last donation.

 

7. Your rights and your personal data

Unless subject to an exemption under the GDPR, you have the following rights with respect to your personal data: -

• The right to request a copy of your personal data which JAC holds about you;
• The right to request that JAC corrects any personal data if it is found to be inaccurate or out of date;
• The right to request your personal data is erased where it is no longer necessary for JAC to retain such data;
• The right to withdraw your consent to the processing at any time
• The right to request that the data controller provide the data subject with his/her personal data and where possible, to transmit that data directly to another data controller, (known as the right to data portability), (where applicable) [Only applies where the processing is based on consent or is necessary for the performance of a contract with the data subject and in either case the data controller processes the data by automated means].
• The right, where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction is placed on further processing;
• The right to object to the processing of personal data, (where applicable) [Only applies where processing is based on legitimate interests (or the performance of a task in the public interest/exercise of official authority); direct marketing and processing for the purposes of scientific/historical research and statistics]
• The right to lodge a complaint with the Information Commissioners Office.

 

8. Further processing

If we wish to use your personal data for a new purpose, not covered by this Data Protection Notice, then we will provide you with a new notice explaining this new use prior to commencing the processing and setting out the relevant purposes and processing conditions. Where and whenever necessary, we will seek your prior consent to the new processing.

 

9. Contact Details

 

To exercise all relevant rights, queries or complaints, please in the first instance contact JAC, Rehoboth, Forest Road, Wokingham, RG40 5QY.

You can contact the Information Commissioners Office on 0303 123 1113 or via email https://ico.org.uk/global/contact-us/email/ or at the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire. SK9 5AF.

 

 

BIN IT OR KEEP IT

 

	FINANCE, INSURANCE, REGISTERS & LICENCES	Keep For	Final Action
	Finance Basic record description
	Annual audited accounts	Permanent	Permanent
	Cash books, bills, vouchers, bank statements, other subsidiary financial records	Current year + 6 years	Destroy
	Planned giving schemes	Current year + 6 years	Destroy unless anonymised
	Gift Aid Declarations	Keep as long as they are valid + 6 years	Destroy
	Insurance Records
	Employers’ liability Insurance	Current year + 40 years	Destroy
	Insurance policies – other than employers’ liability	Current year + 6 years	Destroy
	Licences
	Copyright Licence information	Current year + 6 years	Review/Sample
	Riding Establishment Licence	Current year + 6 years??	Review/Sample
	Animal Registers/Passports
	Horse/Donkey Passports	As long as the animal is still owned by JAC	Pass to new owner or on death return to Horse Passport Agency
	Holding Register Goats/Sheep	Current year + 3 years after death of animal	Destroy
	Legal Documents Basic record description	Keep For	Final Action
	Deeds, Local Partnership Agreements, statutory documents etc; title deeds, other documents relating to title, acquisition, disposal, or rights over a property; statutory notices, orders etc, and relevant correspondence	Permanent	Permanent (deposit)
HEALTH & SAFETY		Keep For	Final Action
Accident Reporting
Accident reporting sheets or book – if relating to adults		Date of incident + 20 years	Destroy
Accident reporting sheets or book – if relating to children		The date when a child became an adult + 20 years	Destroy
RECRUITMENT & SAFEGUARDING		Keep For	Final Action
Recruitment and Safeguarding
Safer Recruitment Front Sheet with DBS Number and Date for clear checks.		Within 6 months of the recruitment decision	Destroy
Risk assessment recommendations and management plan in the event of an unclear or blemished DBS disclosure.		50 years after appointment/employment ceases	Destroy
Personnel records relating to employees not working with children and vulnerable adults: including annual performance assessments, disciplinary matters, job descriptions, training and termination documentation.		6 years after employment ceases	Destroy
Personnel records with contact with children and vulnerable adults including all documentation concerning any allegations and investigation regardless of the findings.		50 years after employment ceases or after the conclusion of the matter.	Destroy
Records of other safeguarding adult or child protection incidents either within JAC or within a family/ by an individual where JAC was the reporting body or involved in care or monitoring plans. That is, any sex offender risk assessments and monitoring agreements.		50 years after the conclusion of the matter.	Destroy
ACTIVITIES AND REFERRALS
Records of referral registers – electronically		Duration of placement with JAC + 10 years.	Destroy
Referral forms, activity records, activity consent forms, etc and related general safety risk assessments. Any communication from parents or other parties in relation to the above.		Duration of placement + 2 terms	Destroy

 

Your data may also be available to our website provider to enable us and them to deliver their service to us, carry out analysis and research on demographics, interests and behavior of our users and supporters to help us gain a better understanding of them to enable us to improve our services. This may include connecting data we receive from you on the website to data available from other sources. Your personally identifiable data will only be used where it is necessary for the analysis required, and where your interests for privacy are not deemed to outweigh their legitimate interests in developing new services for us. In the case of this activity the following will apply:

1. Your data will be made available to our website provider
2. The data that may be available to them include any of the data we collect as described in this privacy policy.
3. Our website provider will not transfer your data to any other third party, or transfer your data outside of the EEA.
4. They will store your data for a maximum of 7 years.
5. This processing does not affect your rights as detailed in this privacy policy.