Bolton CVS is the local infrastructure support organisation for the voluntary and community sector in Bolton and we provide a range of services to people, groups and organisations.
The personal information and data that you share with Bolton CVS is as important to us as it is to you and we commit to treating it carefully.
Our commitment to data protection is aligned to the Data Protection Act (DPA) 2018 and the General Data Protection Regulation (GDPR).
This Privacy Statement outlines our commitment to data protection, how we manage and process data and how that impacts on those who access our services.
1.1 Bolton CVS is the local infrastructure support organisation for the voluntary and community sector in Bolton and we provide a range of services to people, groups and organisations.
1.2 The personal information and data that you share with Bolton CVS is as important to us as it is to you and we commit to treating it carefully.
1.3 Our commitment to data protection is aligned to the Data Protection Act (DPA) 2018 and the General Data Protection Regulation (GDPR).
1.4 This Privacy Statement outlines our commitment to data protection, how we manage and process data and how that impacts on those who access our services.
2.1 Bolton CVS is committed to ensuring that any personal information that we hold about you or any individual that engages with our services and support in any capacity is:
(a) kept privately and confidential.
(b) kept and used in accordance with legislation.
(c) managed in line with good practice processes.
(d) always follows Bolton CVS’s internal procedures.
2.2 Bolton CVS uses your information in line with the way that we agreed with you when you signed up with us. In the event that there is a change to the way Bolton CVS processes and uses your data, we will always seek your consent ahead of any change.
2.3 Bolton CVS will not share your personal information with any 3rd party without your prior consent unless it is in accordance with a statutory request for information where we are required to do so.
2.4 Bolton CVS will not sell your data to anyone in any circumstance.
2.5 This Privacy Statement will be reviewed every 3 years.
3.1 Bolton CVS collect data and information to enable the team to effectively deliver their duties, to provide the services that our members and stakeholders request and to meet our quality, funder, compliance and legal obligations.
3.2 Bolton CVS collects data to communicate and engage with:
3.3 Bolton CVS collects data to track progress and to understand the impact of our work across our services and to better understand our stakeholders’ experience in order to further develop our offer, aligned to our charitable objects.
3.4 Data helps us to tell the story of what we do.
4.1 Bolton CVS uses the data that we collect to deliver our services and support.
4.2 All personal data stored by Bolton CVS is kept in either:
(a) Paper notes.
(b) Written records.
(c) Printed information.
(d) Electronic/digital format.
4.3 All paper-based or printed records and data collected by Bolton CVS is stored in either:
(a) a locked cabinet in a locked office (paper files);
(b) stored within a digital file on a restricted network.
(c) on a protected network or within a protected cloud-based database.
5.1 Bolton CVS aims to always collect consent from individuals where their data is collected and then used publicly, i.e. in case studies.
5.2 For the delivery of our services, Bolton CVS may collect specific consent and this is outlined in Section 8.
5.3. For media and case study consent, we assume that consent will remain for 5 years.
6.1 Bolton CVS uses a range of media to record and share our activity and the impact of the work that we do.
6.2 Bolton CVS uses photography and film within the Bolton Hub at key events and activities and we advise those accessing our services of this when they attend such activities.
6.3 When Bolton CVS uses video and film off-site, we ask for formal consent.
6.4 When Bolton CVS undertakes a case study with an individual, we ask for express consent.
7.1 Bolton CVS stores data in a number of ways and our database systems, the shared drive and our filing systems are all password protected.
7.2 CiviCRM is the online database that Bolton CVS utilises for day to day ‘contact relationship management’.
7.3 Our CiviCRM database enables us to record activities, record work undertaken and to retain information on the services that we’ve provided to our members and contacts.
7.4 The CiviCRM database is cloud-based and individual passwords are allocated to staff when they join the organisation.
7.5 Bolton CVS uses a shared drive for storing general information about people that may access our services. All file types that include personal identifying information or password protected in all cases, without exception.
7.6 Bolton CVS uses an online human resources system called ‘KBL HR’ and paper-based files for staff records and information.
7.7 Volunteer contact information is stored in a password protected spreadsheet.
7.8 The mobile number of all staff will be retained by the Chief Executive and within the ‘Duty’ and ‘On-call’ mobile and line managers, where necessary.
8.1 Bolton CVS collects a range of data across our services and activities.
8.2 We have legitimate interests for collecting sensitive data as it enables us to achieve our charitable aims.
8.3 The table below outlines how, where and what we collect across our current services.
8.4.1 Bolton CVS Volunteer Centre When an individual is referred to the Volunteer Centre, we will take contact information that we use to contact you to inform you of volunteering opportunities as agreed when you discussed your preferences with Bolton CVS.
8.4.2 All information for Bolton CVS’s volunteer centre is recorded electronically either via email, excel spreadsheet, or a form that connects to our database.
8.4.3 Bolton CVS retains contact information for volunteers to undertake a follow- up with individual volunteers 6 months after they’ve been referred to a placement.
8.5.1 Group and Organisational Development Support Bolton CVS collects the contact information for the person (or people) that we work with from individual VCSE groups and organisations.
8.5.2 This information is kept on our database, aligned to the individual contact and the group.
8.5.3 Bolton CVS undertakes a periodic review of our contact information included on the database.
8.5.4 We periodically encourage our members and contacts at groups and organisations to update us of any key changes for their activities, such a change of key people or address.
8.6.1 e-communications Bolton CVS distribute 3 regular e-bulletins:
8.6.2 We retain a copy of the email address on our systems, together with the choice of e-bulletin made by the individual aligned to the contact record.
8.6.3 If you no longer wish to receive an e-bulletin or any communications from Bolton CVS, you can unsubscribe at any time directly from the e-bulletin or contact the team by telephone, email, via the website or by ‘popping in’.
8.7.1 Engagement – Where we collect contact information from people at events or in the community, this information with be either;
8.7.2 Bolton CVS does not use paper based forms in community settings to collect personal identifying information.
8.7.3 Bolton CVS collects demographic and satisfaction information that has no personal identifying information to track our engagement activities.
8.8.1 Funding: Community Investments and Grants Where we collect information aligned to Community Investments and Grants, we will store this information for a defined period (usually 7 years).
8.8.2 We share information about Community Investments and Grants with the programme funder and we will always share information publicly, as it doesn’t relate to a person.
8.8.3 Whilst we share the information on the groups or organisations we’ve funded, we will not ordinarily share personal identifiable information with a partner organisation unless there is a legal requirement or imperative for us to do so.
8.8.4 Bolton CVS will not share personal information with any 3rd party, without your prior consent around grants or community investments.
8.8.5 Details of financial awards to groups and organisations are publicly available and are published annually.
8.8.6 Bolton CVS has no access to the personal data held by those organisations who receive grants or community investments through our programmes and requests for such information relating to such data must be made directly to the recipient organisation.
8.9.1 Membership Where a group or organisation is established as a Bolton CVS member, we retain the information for member communications in line with the Bolton CVS membership agreement.
8.9.2 Membership of Bolton CVS is with the group and/or organisation and the contact information of individual people who are part of a member group will not be promoted without the express consent of the individual concerned.
8.9.3 Membership of Bolton CVS is terminated at the request of the member, as outlined in the membership agreement.
8.10.1 The Bolton Hub Where a tenant is based in the Bolton Hub, contact details are kept on file to contact individuals in an emergency.
8.10.2 All tenant and room hire details are used legitimately for the purposes of our business.
8.10.3 Signing in information is collected at reception for fire and health and safety purposes, this information is destroyed at least every four weeks and they are kept locked once removed from file at the end of each day.
9.1 Bolton CVS collects demographic information routinely and consistently across all of the services that we provide to ensure that we’re reaching different people across the population and to assess our reach.
9.2 Bolton CVS does not ordinarily align demographic information to personal contact information for our services.
9.3 This information is not perceived to be personal identifying information on its own and the data is processed via the CiviCrm database with the forms destroyed after being inputted.
9.4 No individual is obliged to complete demographic monitoring information at point of service if they choose not to.
10.1 Bolton CVS stores volunteer contact information in a shared excel file that is password protected. This is updated monthly.
10.2 Active volunteer email addresses are stored in an outlook distribution list which is accessible to all staff. This is updated monthly.
10.3 All volunteer communications, whether from Microsoft Outlook or the CiviCRM database, will be sent as ‘bcc’ in all instances.
10.4 Active volunteer telephone numbers will be shared on both the Duty and On-call mobile phones for business continuity purposes.
10.5 Bolton CVS will store volunteer contact information and other personal data for the period that the individual volunteers with Bolton CVS.
10.6 Bolton CVS will retain basic data (including name, address, volunteer role and dates volunteered) about volunteers when they leave their volunteer position to provide monitoring information to funders and to provide references where required.
11.1 Bolton CVS stores staff information on a password protected online platform called ‘KBL HR’ and paper-based information in a locked cabinet.
11.2 Line Managers will maintain copies of one-to-one forms and Annual Reviews only.
11.3 Personal information such as emergency contacts, personal mobile phone numbers and home addresses will be shared internally if required during any business continuity situation or where the safety or security of a staff member is of concern, or we’re alerted to a situation that requires emergency contact.
11.4 We may have to share your data with third parties, including third-party service providers and other entities. We require third parties to respect the security of your data and to treat it in accordance with the law. If we do, you can expect a similar degree of protection in respect of your personal information.
11.5 “Third parties” includes third-party service providers (including contractors and designated agents) and other external entities. The following third-party service providers process personal information about you:
11.6 All our third-party service providers are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.
11.7 Bolton CVS will retain key employee data post-employment to be able to process reference requests.
12.1 Bolton CVS undertakes all recruitment electronically.
12.2 Where an application is received through the post, this will be scanned and processed electronically.
12.3 All personal identifying information collected at application stage will be maintained on file until the recruitment process is completed.
12.4 Contact information of referees will be used if an applicant is successful in their application.
12.5 After 9 months have passed following the completion of the recruitment process, all information relating to any applicant not appointed will be deleted and destroyed.
12. Subject data access requests.
12.1 You have the right to ask for the information that we hold about you as an individual.
12.2 Bolton CVS will respond to any formal request to share data.
12.3 Where requests are made electronically, in writing or in person, identification will need to be provided before Bolton CVS can provided any data relating to a person other than where there’s a statutory or legislative responsibility.
12.4 Bolton CVS will commit to providing a reasonable and indicative completion date for providing any data following a subject data access request by an individual.
13.1 Bolton CVS uses Closed Circuit Television (CCTV) in the Bolton Hub.
13.2 The data is kept and maintained on a hard-drive and is not shared off-site.
13.3 The data is kept for a maximum of 5 weeks, where it is automatically deleted.
13.4 There is a clear sign within the entrance of the Bolton Hub to advise people accessing the premises that they are being filmed.
13.5 All recordings are digital and will ordinarily be saved as MPEG.
13.6 There is no audio or sound recorded.
14.1 Bolton CVS holds data on 3 separate hard and cloud-based systems.
14.2 Bolton CVS stores information on an on-site server which has an off-site back-up and a cloud back up. Data is stored on Microsoft’s cloud (Azure). The datacentre is Azure UK (South) which is located in London. All data is encrypted using AES 256bit encryption before it leaves your site and then is transferred using 256 bit SSL communication. Data is therefore fully encrypted on site, during transport and at the storage location.
14.3 KBL HR: https://kblsolicitors.xyhr.uk/
14.4 CiviCRM (and Bolton CVS website): Data is located within the Iomart data storage centre in Manchester. https://www.iomart.com/about-iomart/uk-data-centres-manchester/
15.1 You can ask Bolton CVS to delete your data at any time.
15.2 We may need to keep certain aspects of the data that we hold on record about you, particularly where this is connected to a constituted group or organisation that has received funding from us and we will advise you if this is the case.
15.3 We will explain to you exactly what information can be deleted and the reasons if we’re unable to delete any element of your data.
15.4 To delete your data, please contact the team on 01204 546 010, email info@boltoncvs.org.uk or write to: The Data Controller (Chief Executive), Bolton CVS, The Bolton Hub, Bold Street, Bolton. BL1 1LS.
15.5 If you require further information about how we use data at Bolton CVS, please contact the Chief Executive.
22.1 Bolton CVS is registered with the Information Commissioners Officer under registration number: Z1062102.
(d) Data Controller Data Processor DPA. The individual with overall control. The person or organisation who’s processing data. Data Protection Act.
(g) GDPR
General Data Protection Regulation.
(i) ICO
Information Commissioners Office.
(v) VCSE
Voluntary, Community and Social Enterprise.
