Volunteers, internships and work experience GDPR privacy notice

Privacy notice

This notice explains how HorseWorld Trust (referred to in this notice as we, us or our) collects and uses personal data about existing and former volunteers, interns and work experience students for purposes related to your placement or volunteering with us.
This notice covers the following:

What is personal data?

How do we collect personal data?

What personal data do we collect?

How do we use your personal data?

What is the legal basis that permits us to use your personal data?

What happens if you do not provide the personal data that we request?

How do we share your personal data?

How do we keep your personal data secure?

When do we transfer your personal data overseas?

For how long do we keep your personal data?

Your rights in relation to your personal data

Complaints

The table at the end of this notice provides an overview of the personal data that we collect, the purposes for which we use that data, the legal basis which permits us to use it and the rights that you have in relation to your personal data.
We keep this privacy notice up to date, so if there are any changes to the way in which your personal data is used this privacy notice will be updated and we will notify you of the changes.

Contact details

Our contact details are as follows:
Address: HorseWorld Trust, Delmar Hall, Keynes Farm, Staunton Lane, Whitchurch, Bristol, BS14 0QL
Telephone: 01275 832425
We have appointed a Data Management Officer who has responsibility for advising us on our data protection obligations. You can contact the Data Management Officer using the following details:
Name: Sheryle Cuff
Telephone: 01275 893036
Email: Sheryle.Cuff@horseworld.org.uk

What is personal data?

Personal data is any information that relates to a person who can be identified from that data (a data subject). This could include information such as your name, contact details and date of birth.

How do we collect personal data?

We collect personal data about you from various sources including:
  • from you when you contact us directly through the application process or during your placement / when volunteering with us;
  • from other people when we check references or carry out background checks – if we do this we will inform you during the application process of the exact checks that are carried out;
  • any personal data we obtain from searching public records, such as the Electoral Roll, to help us verify your identity; and
  • we also collect information about volunteer-related activities through the course of your placement / when volunteering with us.

What personal data do we collect?

We collect the following categories of personal data about you:
  • Personal contact details such as name, title, address, telephone number and personal email addresses
  • Date of birth
  • Gender
  • Equal opportunities monitoring information such as ethnicity, religion, disability and sexual orientation
  • Marital status
  • Next of kin and emergency contact information
  • Start and end date of placement or volunteering role
  • Location of placement or volunteering role
  • Information on the number of hours you volunteer
  • Copy of your driving licence if you need to drive as part of your placement or volunteering activities
  • Application information (including references and other information provided as part of the application process)
  • Copies of identification documents such as your passport and driving licence
  • Compensation/expenses records
  • Performance information
  • CCTV footage and other information obtained through electronic means
  • Information about your use of our information and communication systems
  • Photographs and video footage
  • Information about your race or ethnicity, religious beliefs, sexual orientation and political opinions
  • Information about your health, including any medical condition, health and sickness records
  • Information about criminal convictions and offences committed by you

How do we use your personal data?

We use your personal data for the following purposes:
  • To make decisions about your placement or voluntary role with us
  • To determine the terms of your placement or voluntary role with us
  • For business management and planning purposes
  • To determine any performance requirements
  • To make decisions about compensation/reimbursement of expenses
  • To assess your qualifications for a particular task
  • For education, training and development
  • To deal with legal disputes, including accidents at work
  • For regulatory purposes
  • To comply with health and safety obligations
  • To prevent and detect fraud or other criminal offences
  • To monitor compliance with our policies and our contractual obligations, including the use of our information and communication systems to ensure compliance with our IT policies
  • To ensure network and information security, including preventing unauthorised access to our computer and electronic communications systems and preventing malicious software distribution
  • To carry out equal opportunities monitoring
  • For insurance purposes
  • To provide a reference upon request from a third party
  • To comply with health and safety law and other laws which affect us
We do not take automated decisions about you using your personal data or use profiling in relation to you.

What is the legal basis that permits us to use your personal data?

Under data protection legislation we are only permitted to use your personal data if we have a legal basis for doing so as set out in the data protection legislation. We rely on the following legal bases to use your personal data:
  • Where we need your personal data to perform any agreement we have entered into with you.
  • Where we need to comply with a legal obligation.
  • Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
  • In more limited circumstances we may also rely on the following legal bases:
  • Where we need to protect your interests (or someone else's interests).
  • Where it is needed in the public interest or for official purposes.
  • The table at the end of this notice provides more detail about the personal data that we use, the legal basis that we rely on in each case and your rights.
Some personal data is classified as "special" data under data protection legislation. This includes information relating to health, racial or ethnic origin, religious or philosophical beliefs, political opinions, genetic and biometric data, sex life, sexual orientation and trade union membership. This personal data is more sensitive and we need to have further justifications for collecting, storing and using this type of personal data. There are also additional restrictions on the circumstances in which we are permitted to collect and use criminal conviction data. We may process special categories of personal data and criminal conviction information in the following circumstances:
  • In limited circumstances with your explicit consent, in which case we will explain the purpose for which the personal data will be used at the point where we ask for your consent.
  • We will use information about your physical and mental health or disability status to comply with our legal obligations, including to ensure your health and safety in the workplace.

We will use information about your race or ethnic origin, religious or philosophical beliefs, your sexual life or sexual orientation to ensure meaningful equal opportunity monitoring and reporting – the legal basis of this processing is that it is in the public interests to carry out diversity monitoring.

What happens if you do not provide the personal data that we request?

We need some of your personal data in order to manage your placement or volunteering with us. For example, we may need to know who to contact in the event of an emergency. We also need some personal data so that we can comply with our legal obligations. For example, we need information about your health and fitness to comply with our health and safety obligations.
Where personal data is needed for these purposes if you do not provide it we may not be able to offer a placement or voluntary role with us or continue with your placement or volunteering. We explain when this is the case at the point where we collect personal data from you.

How do we share your personal data?

We share your personal data in the following ways:
  • Where we use third party services providers who process personal data on our behalf in order to provide services to us. This includes IT systems providers. We will share your personal data with regulators, including the Charity Commission, where we are required to do so to comply with our regulatory obligations.
  • We will share your personal data with third parties where we are required to do so by law.
Where we share your personal data with third parties we ensure that we have appropriate measures in place to safeguard your personal data and to ensure that it is solely used for legitimate purposes in line with this privacy notice.

How do we keep your personal data secure?

Data is stored in locked cabinets and IT data is hosted within Microsoft Office 365 (Exchange, OneDrive, SharePoint), and Dynamics 365, this is managed and hosted within the Microsoft Cloud space. The security measures in place to secure such data include firewalls, virus-checking, anti-spyware tools, security updates, password protection, regular back-ups. Old computers are removed by a third party who follow strict WEEE and data destruction policies.
We will ensure access to personal data is restricted to employees on a need to know basis.

When do we transfer your personal data overseas?

When personal data is transferred to countries outside of the UK and the European Economic Area those countries may not offer an equivalent level of protection for personal data to the laws in the UK.
We share your personal data with third party partners as part of our IT data hosting arrangements. In exceptional circumstances, these third parties may transfer your data to their data centres outside the EEA. We have agreements in place with these providers in relation to data security and have received assurances that any such data is protected in accordance with the requirements of the GDPR.

For how long do we keep your personal data?

As a general rule we keep your personal data for the duration of your placement or volunteering activity and for a period of 7 years after your placement ends or 7 years after the last occasion on which you volunteered. However, where we have statutory obligations to keep personal data for a longer period or where we may need your personal data for a longer period in case of a legal claim, then the retention period may be longer.

Your rights in relation to your personal data

You have a number of rights in relation to your personal data, these include the right to:
  • be informed about how we use your personal data;
  • obtain access to your personal data that we hold;
  • request that your personal data is corrected if you believe it is incorrect, incomplete or inaccurate; request that we erase your personal data in the following circumstances:
  • if we are continuing to process personal data beyond the period when it is necessary to do so for the purpose for which it was originally collected;
  • if we are relying on consent as the legal basis for processing and you withdraw consent;
  • if we are relying on legitimate interest as the legal basis for processing and you object to this processing and there is no overriding compelling ground which enables us to continue with the processing;
  • if the personal data has been processed unlawfully (i.e. in breach of the requirements of the data protection legislation);
  • if it is necessary to delete the personal data to comply with a legal obligation;
  • ask us to restrict our data processing activities where you consider that:
  • personal data is inaccurate;
  • our processing of your personal data is unlawful;
  • we no longer need the personal data but you require us to keep it to enable you to establish, exercise or defend a legal claim;
  • you have raised an objection to our use of your personal data.
  • request a copy of certain personal data that you have provided to us in a commonly used electronic format. This right relates to personal data that you have provided to us that we need in order to perform any agreement with you and personal data where we are relying on consent to process your personal data;
  • object to our processing of your personal data where we are relying on legitimate interests or exercise of a public interest task to make the processing lawful. If you raise an objection we will carry out an assessment to determine whether we have an overriding legitimate ground which entitles us to continue to process your personal data;
  • not be subject to automated decisions which produce legal effects or which could have a similarly significant effect on you.
  • If you would like to exercise any of your rights or find out more, please contact Human Resources. The table at the end of this notice provides more detail about the personal data that we use, the legal basis that we rely on in each case and your rights.

Complaints

If you have any complaints about the way we use your personal data please contact the Data Management Officer who will try to resolve the issue. If we cannot resolve your complaint, you have the right to complain to the data protection authority in your country (the Information Commissioner in the UK).

Table: quick check of how we use your personal data

Purpose

Personal data used

Legal basis

Which rights apply?*

Application decisions

Personal contact details and application information.

Legitimate interest. It is in our interests to ensure that our volunteers/ interns/ work experience students are suitable for our business needs, goals and objectives.

The generally applicable rights plus the right to object.

Management of your placement / volunteering and the processing of expenses

Personal contact information, bank account details, start and end date of placement / volunteer hours and date of birth, compensation / expenses records.

Legitimate interest. It is in our interests and the interests of our volunteers/ interns/ work experience students to ensure that placements / volunteering are properly managed and any expenses incurred are reimbursed.

The generally applicable rights plus the right to object.

Compliance with our statutory duties to ensure a safe place of work

Information about your health, including any medical condition, health and sickness records and location of placement / volunteering.

Legal obligation.

The generally applicable rights only.

Management of sickness absence

Personal contact details, placement / volunteering records (sickness hours/days) and information about your health.

Legitimate interest. It is in our interest to manage our business needs if our volunteers/ interns/ work experience students are going to be absent from their placement / scheduled volunteer activity.

The generally applicable rights plus the right to data portability.

To monitor compliance with our policies

Personal contact details, information about your use of our information and communication systems, CCTV footage and other information obtained through electronic means and performance information.

Legitimate interest. It is in our interests to ensure our volunteers/ interns/ work experience students are complying with our policies to ensure our business can function effectively and because non-compliance with policies can result in termination of the placement or voluntary role, ultimately affecting our day to day operations and business plans.

The generally applicable rights plus the right to object.

Fraud and crime prevention

Information about criminal convictions and offences committed by you, personal contact details and CCTV footage and other information obtained through electronic means.

Public interest and legitimate interest. It is in our interests as well as the interests of our volunteers/ interns/ work experience students to ensure the prevention of fraud and crime is monitored. This will ensure a safe workplace for all.

The generally applicable rights plus the right to object.

Diversity monitoring

Gender, marital status and dependents, location of placement / volunteering and information about your race or ethnicity, religious belief and sexual orientation.

Public interest.

The generally applicable rights plus the right to object.

To deal with legal disputes

Personal contact details, placement / volunteering records, performance information, compensation/expenses records, photographs, CCTV footage and other information obtained through electronic means and information about criminal convictions and offences committed by you.

Legitimate interest. It is in our interests to process personal data to make and defend legal claims to ensure that our legal rights are protected.

The generally applicable rights plus the right to object.

Business management and business planning

Information about your use of our information and communication systems, placement / volunteer records, location of placement / volunteering and personal contact details.

Legitimate interests.It is in our interests to undertake this processing to ensure we can improve any business operations which will ultimately improve the overall quality of the placement / volunteering. Volunteers/ interns/ work experience students will ultimately benefit as the workplace and its procedures may be strengthened.

The generally applicable rights plus the right to object.



*The following generally applicable rights always apply: right to be informed, right of access, right to rectification, right to erasure, right to restriction and rights in relation to automated decision making. For more detail about your rights and how to exercise them please see Your rights in relation to your personal data