ADD SOME TEXT THROUGH CUSTOMIZER
ADD SOME TEXT THROUGH CUSTOMIZER

Privacy Policy

INTRODUCTION

This policy sets out the organisation’s policy and systems in relation to the maintenance of confidentiality, data collection, sharing and the management of records.

  1. SCOPE
    • All paid staff, volunteers, trustees and trainees of the Ashok Tree Foundation, the Registered Charity and its Subsidiaries are required to abide by this policy.
    • This policy applies to the confidentiality of all employees, volunteers, potential employees and volunteers, ex-employees and ex-volunteers, trainees, service users, customers, donors, consultants, contractors and any other individual or organisation that has contact with the organisation directly or indirectly.
  2. PRINCIPLES
    • The organisation recognises the right of individuals to confidentiality and that they have a right to expect that personal details will be kept confidentially and in line with the requirements of law.
    • The organisation recognises that misuse of data can be damaging and distressing and is committed to the principles of the Data Protection Act which provides individuals with protection from unwanted or harmful use of data.
    • The organisation believes that the right to privacy, confidentiality and appropriate use of data are essential to ensure all individuals have full confidence in the organisation and are treated with respect and dignity.
  3. CONFIDENTIALITY
    • Policy
      • Confidentiality applies to all facts or information about an individual including, but not exclusively, personal data and can also apply to expressed opinions.
      • Facts and information about an individual will not be divulged or passed to a 3rd party without the individuals recorded consent (unless an exception applies – see below)
      • The fact that an individual has made contact with the organisation will not be divulged without their consent. This includes ensuring messages are not left on answerphones or with 3rd parties that could indicate this.
      • If the organisation is contacted by someone else on behalf of an individual, then we will only act on behalf of and/or share data with the individuals direct permission.
      • An individual’s approach is treated as being to the organisation, rather than the individual worker. As such discussion of issues relating to individuals within the organisation, on a ‘need to know’ basis, are permitted under this policy.
      • Where consent is provided to share data this will always be done using secure and confidential methods, either by post, secure fax or email with password protection.
    • Exceptions
      • It is recognised that there may be times when it is appropriate to breach confidentiality for legitimate reasons without permission. The reasons permitted under this policy are:
    • If there is, or suspected to be, an immediate risk to life or a risk of serious harm
    • When a safeguarding allegation or concern has been raised
    • If the organisation has a legal obligation to disclose particular information
    • If an allegation is made against the organisation that requires external investigation
    • If there is a reason to believe the individual is withholding consent but does not have mental capacity to make an informed decision (following capacity check)
      • The decision to breach confidentiality in these circumstances may be taken by the Chair or in their absence the Vice Chair.
    • Breaches of Confidentiality
      • All employees and volunteers will be made aware of this policy and of their right to invoke the Complaints Procedure if they believe information is divulged without their consent.
      • All other individuals will be made aware of this policy and of their right to invoke the Complaints Procedure if they believe information is divulged without their consent.
      • The organisation takes allegations of a breach of this policy seriously and will follow the Disciplinary procedure to investigate and deal with such allegations.
  4. DATA COLLECTION AND RECORD MANAGEMENT
    • Policy

The organisation is committed to implementing the principles of the Data Protection Act 1998 in its processing of personal data

  • Personal data will be used for the purpose for which it was given
  • Personal data will be collected and processed fairly and lawfully
  • Data collected will be adequate, relevant and not excessive in relation to the purpose
  • As far as practicable steps will be taken to ensure that data is accurate and where necessary, up to date
  • Individuals will have a right of access to any records which relate to them personally, including any information from other parties
  • Data shall not be kept for longer than is necessary for the purpose
  • Technical and organisational measures will be taken against unauthorised or unlawful processing and against accidental loss, destruction or damage to data
    • Data Collection
      • It is necessary for the organisation to collect personal data and other information about an individual in order for it to carry out its functions as a service provider, fundraising organisation, employer and provider of volunteering opportunities.
      • The organisation will as far as reasonably practicable takes steps to ensure the information collected is accurate and relevant to the purpose it is being collected for.
      • At the point of data collection an individual will be informed as to the purpose and what the data will be used for and their permission will be recorded including if it will or may be shared. They will also be informed of their option to choose to allow the organisation to contact them for other purposes. Their choice in this matter will be recorded.
    • Data Retention and Storage
      • ‘Live’ records either electronic or paper-based will be stored securely and access will be restricted to those who are, by necessity, authorised to see and process them. The organisations methods for ensuring security include:
    • Use of locked drawers/filing cabinets with restricted key access
    • Use of door locks and/or key pads
    • Password protected access to our IT systems
    • Password protected access to the organisations database, along with different access levels to different types of data
    • Intruder alarms and security systems on all our premises
      • Archived paper-based records will be stored securely at our Head Office using a key lock with restricted access to the key.
      • Electronic records will be clearly labelled as such either on our server or the organisations database.
      • All archived records will be clearly labelled as to what they are and the disposal date.
      • All archived records will be retrievable and identifiable using the labelling system.
  • Record Retention
    • The attached Record Retention Standards Document at Appendix A provides details of how long each type of record will be kept ‘live’ and archived
    • Disposal
      • The organisation will annually dispose of all relevant archived records in accordance with the Record Retention Standards.
      • A confidential waste disposal service will be used to dispose of all records which include personal or other confidential data, both regularly throughout the year and at the annual disposal
      • Each site also has a shredder for immediate destruction of information along with a confidential waste box and staff and volunteers are trained in disposal of confidential material.
    • CRB and Rehab of Offenders Information
      • The organisation recognises that it has particular responsibilities in relation to the processing of data related to CRB and Rehab of Offenders Information and this policy should be read in conjunction with the organisation’s Policy Statement on the Secure Storage, Handling, Use, Retention and Disposal of Disclosures and Disclosure Information, which is Appendix B to this policy.
    • The Ashok Tree Foundation Partners
      • Any services or activity which involves delivery of the Ashok Tree Foundation products and services must also ensure they comply with the Ashok Tree Foundation Call Record Retention Procedures and Schedules.
    • Requests for Access to Data/Records
      • The organisation recognises that it may, in some circumstances, have obligations under the Freedom of Information Act to disclose data or information and will comply with these, taking the requirements of the Data Protection Act into consideration.
      • The organisation also recognises an individual’s right to request to see the information held about them.
      • All such requests should be made in writing to the Chair. The organisation will make an initial response within 10 working days.
  1. IMPLEMENTATION OF THE POLICY
    • Responsibilities of Management
      • The Management Committee are responsible for ensuring the correct and full implementation of this policy in their areas of activity, with the Chair having overall responsibility. The Management Committee is also responsible for ensuring that appropriate systems and resources are in place to enable its implementation.
      • The Management Committee are responsible for ensuring that their staff and volunteers adhere to this policy at all times and for ensuring its correct implementation.
    • Responsibilities of All Staff and Volunteers
      • All staff, volunteers, , trainees and consultants are responsible for ensuring they understand the requirements of this policy, what it means to them in their role and for ensuring they abide by its requirements. They are also responsible for reporting any potential or actual breaches of this policy to their assigned Management Committee Member.
    • Induction and Training
      • All staff, volunteers and consultants receive a copy of this policy at induction along with a discussion with their line manager to ensure understanding.
      • All staff and identified volunteers receive training on the requirements of the Data Protection Act, along with any other specified training as required by the particular role.

Appendix B

The Ashok Tree Foundation Policy Statement on the Secure Storage, Handling, Use, Retention

and Disposal of Disclosures and Disclosure Information

General principles

As an organisation using the Criminal Records Bureau (CRB) Disclosure service to help assess the suitability of applicants for the positions of trust, the Ashok Tree Foundation complies fully with the CRB Code of Practice regarding the correct handling use, storage, retention and disposal of Disclosures and Disclosure information. It also complies fully with its obligations under the Data Protection Act and other relevant legislation pertaining to the safe handling, use, storage, retention and disposal of Disclosure information and has a written policy on these matters, which is available to those who wish to see it on request.

Storage & Access

Disclosure information is never kept on an applicant’s personnel file and is always kept separately and securely, in lockable, non-portable, storage containers with access strictly controlled and limited to those who are entitled to see it as part of their duties.

Handling

In accordance with section 124 of the Police Act 1997, Disclosure information is only passed to those who are authorised to receive it in the course of their duties. We maintain a record of all those to whom Disclosures or Disclosure information has been revealed and we recognise that it is a criminal offence to pass this information to anyone who is not entitled to receive it.

Usage

Disclosure information is only used for the specific purpose for which it was requested and for which the applicant’s full consent has been given.

Retention

Once a recruitment (or other relevant) decision has been made, we do not keep Disclosure information for any longer than is absolutely necessary, and no longer than six months, in order to allow for the consideration and resolution of any disputes or complaints. If, in very exceptional circumstances, it is considered necessary to keep Disclosure information for longer than six months, we will consult the CRB about this and will give full consideration to Data Protection and Human Rights legislation. Throughout this time, the usual conditions regarding safe storage and strictly controlled access will prevail.

Disposal

Once the retention period has elapsed, we will ensure that any Disclosure information is immediately suitably destroyed by secure means, i.e. by shredding, pulping or burning. While awaiting destruction, Disclosure information will not be kept in any insecure receptacle (e.g. waste bin or confidential waste sack). We will not keep any photocopy Disclosure. However, notwithstanding the above, we may keep a record of the date of issue of a Disclosure, the name of the subject, the type of Disclosure requested, the position for which the Disclosure was requested, the unique reference number of the Disclosure and details of the recruitment decision taken.

Acting as an Umbrella Body

Before acting as an Umbrella Body (one which countersigns applications and receives Disclosure information on behalf of other employers or recruiting organisations), we will take all reasonable steps to ensure that they can comply fully with the CRB Code of Practice. We will also take all reasonable steps to satisfy ourselves that they will handle, use, store, retain and dispose of Disclosure information in full compliance with the CRB Code and in full accordance with this policy. We will also ensure that any body or individual, at whose request applications for Disclosure are countersigned, has such a written policy and, if necessary, will provide a model policy for that body or individual to use or adapt for this purpose.