How we use your information

This privacy notice lets you know how Holborn Community Association (HCA) will use personal information. It applies to information we collect or receive about you:

• members of HCA;
• users of our services;
• visitors to our centres
• visitors to our websites;
• staff and volunteers (current and former) and job applicants;
• Anyone else who provides information to us for any other reason.

“staff or volunteers” includes employees (full time, part time and temporary), volunteers (regular, occasional and one-off), contractors, agents, other staff, retirees, workers, trustees and office holders.

Note we also provide space to other organisations and people who provide services and classes. You should be aware that if you provide personal data to the organiser of that service that the processing of that data is outside the scope of this Privacy Policy. If you are visiting one of our premises to access that service however we may still process your data, for instance in our use of CCTV.

Who We Are

“We” in this privacy policy refers to Holborn Community Association Ltd of 35 Emerald St, London, WC1N 3QW (company number: 02344228  registered charity number: 801064)

You may know us as

• Bedford House Community Centre;
• Millman St Resource Centre; or
• 1a Arts;

which are all centres in Holborn that HCA run.

How We Use Your Data

Overview

We will use your personal data only where its use is covered by one or more of the following:

• It is reasonably necessary to provide or consider providing a service that you have requested of us or expressed an interest in;
• It is within our legitimate interest as set out below (you can object to any of these and we will consider that objection fairly);
• We are required by law to do so;
• You have given us consent to do so.

The data that we capture will be restricted to that needed for the purpose that you provide it.

Our processing for certain purposes includes the processing of sensitive personal data such information about your health and/or criminal convictions.

We are responsible in processing your personal data:

• to keep it up to date (subject to you telling us of any changes);
• to keep and destroy it securely;
• to only collect data and retain data that is not excessive; and
• to implement appropriate technical measures o protect it from loss, misuse, unauthorised access and disclosure.

Processing to enable us to provide a Service

If you use any of our services such as:

• being a user of Millman St
• attending or applying to join a class that we run such as (but no limited to) gymnastics or pottery;
• going on a trip or to an event we organise;
• volunteering or taking part in our Befriending scheme;
• using our drop in Under 5’s service; or
• any other service we provide.

then we will collect the data that is reasonably necessary for provision of the services concerned and will use and share the data only as reasonably required to provide that service.

If you are a member of HCA (having joined, normally, at our AGM) then we will use your name and contact details to contact you as provided by our constitution and the companies act, this would typically be to tell you about our AGM and to provide our annual report and any other similar notices.

Processing within our legitimate interest

In addition to the purposes strictly necessary to provide you with services you have requested we will also process data for the following purposes that fall within our legitimate interest:

• to tell you about events and services we provide that are similar to ones that you have taken part in or shown an interest in in the past (we will give you the option to opt out of these communications whenever we make one);
• to fulfil our charitable purposes;
• to enable us to provide a voluntary service for the benefit of the public in our area of interest;
• to implement our safeguarding polices and procedures in order to protect all children and vulnerable adults;
• to handle complaints;
• to fundraise and promote the interests of HCA;
• to manage and administer our staff and volunteers;
• to maintain our accounts and statutory records;
• to seek your views and comments and to consult with you about HCA and our services;
• to notify you of changes to our organisation, services, events and hours of opening;
• to send you communications which you have requested and that may be of interest to you, these may include information about campaigns, appeals, other fundraising activities;
• to process an application for a job or role;
• we will process data about staff and volunteers for legal, personnel, administrative and management purposes (including pre-appointment checks and safeguarding purposes) and to enable us to meet our contractual obligations, for example to pay staff, monitor performance and to confer benefits in connection with a staff or volunteer role;
• to notify you of changes to this privacy policy (though we are not obliged to do this and you should revisit this page to see the latest version if you want to know any changes or if you provide new data to us).
• to analyse use of our website so as to maintain and improve it.

Our processing also includes the use of CCTV systems for the protection of all who use our premises and the prevention and prosecution of crime.

Processing based upon your consent

As a charity we cannot communicate with you electronically about campaigns or for fundraising purposes without your consent and so we will only do this where you have given us that consent and you can withdraw that consent at any time by emailing data@holborncommunity.co.uk

Processing of Sensitive Personal Data

We may process sensitive personal data relating to staff and volunteers including, information about your physical or mental health or condition and/or information about criminal convictions in order to:

• monitor sick leave and take decisions as to fitness for work;
• monitor our compliance with equal opportunities legislation; and
• carryout our safeguarding responsibilities.

We may process sensitive personal information relating to the physical and mental health of users of our services where

• it is necessary for that user’s safety and well-being;
• to ensure we provide the service that is appropriate;
• to verify that a user qualifies for external funding for a particular service.

Who else will we provide your data to?

We will treat your personal data as confidential and only share it with others where we do so to fulfil the data processing set out in this Privacy Policy. So for instance we may use a subcontractor to provide a service or fulfil a particular requirement.  We also regularly work with professional advisers to help on specific tasks.  In all cases we will ensure these parties have a privacy policy in line with our own.

Transfer of data outside of the UK and the EU.

We hold all our data within the UK if we use a supplier who stores data outside the EU we will only do that we have a contract with the supplier requiring them to provide equivalent levels of protection for your personal information as it would have anywhere in the EU.

How long will we keep your data?

The length of time we keep your personal data will vary depending on the purpose for which we held it, staff and financial data we will retain for at least 7 years. In general, we will seek to keep data only for as long as we need it. We may delete your personal data if we no longer needed.

Your rights in respect of your personal data

You as someone whose personal data we process have certain rights as to how we process it; namely:

The right to be informed

You are entitled to be informed in a transparent manner about the processing of your data and that is what we have set out in this Privacy Policy. If you have any questions about how your data is processed, then please contact us on [telephone number] and we will try to answer your questions.

The right of access

You are entitled to know what data we are processing and to receive a copy of it. You can request this from us at any time. This is known as a Subject Access Request and in normal circumstances we cannot charge you for providing you with a copy of your personal data that we process. We will normally provide you with a copy of your data within one month of receiving your request.

The right to rectification

You are entitled to have corrected any incorrect or incomplete information that we hold on you.

The right to be forgotten

You are entitled to request that we delete your personal data where we no longer have a legal basis for processing it. We will delete your data if you request that we do so and if:

• It was no longer necessary for the purpose you gave it to us,
• We were processing it based solely on your consent and you have withdrawn your consent; and
• There is no overriding legitimate interest for us to continue to process it.

The right to restrict processing

You are entitled to request that we restrict the processing of data so that we only store your data and not process it further and we shall comply where one of the following applies:

• the accuracy of the personal data is contested by the you, for a period enabling us to verify and or rectify the accuracy of the personal data;
• we have processed the data without a lawful basis and you do not wish us to delete it and have asked that we restrict its use instead;
• we no longer need the personal data for the purpose originally intended, but you want us to retain it in relation to a legal claim;
• you have raised an objection to the processing of the data and we are in the process of considering whether to agree to that objection.

The right to data portability

You are entitled to request and to receive your personal data that we process in a reasonable electronic format so you can reuse it or provide it to a third party for them to reuse it for you. You are entitled to receive this data free of charge and within one month of your request.

The right to object

You are entitled to object to our processing of your personal data for our legitimate interests beyond that which is strictly necessary in relation to a contract you have entered in to. If you make such a request we will either agree to your request or let you know any reason we have for not agreeing to it.

Where we have passed your data to another party and you make a request to exercise your rights in relation to that data we will endeavour to pass on your request to all such third parties who will be similarly obliged to treat your request in accordance with your rights as a data subject.

Your right to lodge a complaint with the Information Commissioner.

You are entitled to make a complaint to the Information Commissioners Office which you can do:

• via their website https://ico.org.uk/; or
• by calling 0303 123 1113 or 01625 545 745; or
• by writing to

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

The privacy policy was last updated on 10^th May 2018.