PRIVACY NOTICE

This notice explains how and why Beverley Community Lift (BCL) uses personal information from staff, volunteers, service users, organisations and other members of the public.

The privacy notice is regularly reviewed and updated in line with the services BCL delivers and the suppliers that we use. The date that it was last modified is at the end of this notice. It is recommended that you check BCL’s website for any changes made to this privacy notice.

BCL is listed on the Information Commissioner’s register of data controllers under Registration Number Z1947272.

In this notice, BCL uses the term personal information to mean any information from which you can be identified. This might include your name, your home address, your email contact details, and/or your telephone number. For some employees and volunteers this could also include criminal record and driving licence information.   Personal information does not include information where your identity has been removed (i.e. anonymous data).

BCL uses the term special categories of personal information to mean information about your ethnic origin; age; disability; sexual orientation and/or your health.

Personal information BCL collects and uses:

1.  Individual Transport Services

BCL provides a range of transport services to individuals. This section of the privacy notice explains how BCL collects and uses personal information from people, who use its volunteer car and minibus service.

When you contact BCL about these services, it will collect some personal information from you (for example your name, address, email contact details, telephone number).

BCL will only collect and use your personal information in this way if BCL is satisfied that it has a legitimate interest to record and retain this information for the purposes of delivering its services to you.

Depending on the nature of the services provided to you, BCL may also ask you to provide special categories of personal information about you (for example, information about your health or ethnicity). We will collect and use this kind of information:

if we have your explicit consent; and

for equalities monitoring purposes.

BCL uses a third-party, Shaunsoft Community Transport Software, to supply and support its community transport booking system. For more information, please see Shaunsoft’s privacy notice.

When we provide services on behalf of the East Riding of Yorkshire Council BCL will access your personal details via the Council’s secure email system.

2. Home to School Transport Services

When East Riding of Yorkshire Council (ERYC) contracts with BCL to provide home to school transport services, they may provide personal information about the children who will be using the services each day. This will include personal information (names, addresses, dates of birth). Where relevant and necessary, BCL may also receive information about ethnic origin, medical needs, health conditions, mobility issues, language or communication requirements and/or disabilities.  In this regard, BCL will be acting as a data processor on behalf of ERYC and it is the responsibility of the contracting body to ensure that it has appropriate consents or authorisations to transfer this information to us.

BCL will share this information with its drivers for the purposes of delivering the home to school transport services and will keep this information on record to comply with safeguarding best practice (see ‘Data Retention’ below).  BCL is satisfied that it has a legitimate interest to collect, use and retain this information for the purposes of delivering its home to school transport services.

3. Group Transport Services

If you register with BCL as a not for profit group, BCL will collect and record personal contact information for the organiser of the group (such as name, address, email contact details and telephone number).

BCL will only collect and use personal information in this way if:

it is necessary to enter into, or perform, a contract with you; or

if BCL is satisfied that it has a legitimate interest to record and retain this information for the purposes of delivering its services to you.

If BCL provides minibus services with a driver it may also obtain personal information about passengers such as their name, address and telephone numbers for pick-up and drop-off purposes. In this regard, BCL will be acting as a data processor on behalf of the group and it is the responsibility of the group organiser to ensure that it has appropriate consents or authorisations for individuals to transfer this information to BCL.  This passenger list information will not be retained any longer than is necessary to fulfil the transport booking(s).

4. Staff

BCL collects and processes a range of information about employees. This includes:

your name, address and contact details, including email address and telephone number, date of birth and gender;

the terms and conditions of your employment;

details of your qualifications, skills, experience and employment history, including start and end dates, with previous employers and with BCL;

information about your remuneration, including entitlement to benefits such as pensions;

details of your bank account and national insurance number;

information about your marital status, next of kin, dependants and emergency contacts;

information about your nationality and entitlement to work in the UK;

information about your criminal record;

details of your schedule (days of work and working hours) and attendance at work;

details of periods of leave taken by you, including holiday, sickness absence, family leave and sabbaticals, and the reasons for the leave;

details of any disciplinary or grievance procedures in which you have been involved, including any warnings issued to you and related correspondence;

assessments of your performance, including appraisals, performance reviews and ratings, training you have participated in, performance improvement plans and related correspondence;

information about medical or health conditions, including whether or not you have a disability for which BCL needs to make reasonable adjustments;

equal opportunities monitoring information, including information about your ethnic origin, sexual orientation, health.]

BCL collects this information in a variety of ways. For example, data is collected through application forms, CVs or resumes; obtained from your passport or other identity documents such as your driving licence; from forms completed by you at the start of or during employment); from correspondence with you; or through interviews, meetings or other assessments.

In some cases, BCL collects personal data about you from third parties, such as references supplied by former employers, information from employment background check providers, information from criminal records checks permitted by law.

Data is stored in a range of different places, including in your personnel file, in BCL’s HR management systems and in other IT systems including BCL's email system.

Your information will be shared internally, including your line manager, senior managers and 3rd parties where necessary, HR Consultant, H&S Consultant, Occupational Health (where necessary), outsourced Payroll.

BCL shares your data with third parties in order to obtain pre-employment references from other employers, obtain employment background checks from third-party providers and obtain necessary criminal records checks from the Disclosure and Barring Service.

BCL will not transfer your data to countries outside the European Economic Area

BCL will hold your personal data for the duration of your employment. The periods for which your data is held after the end of employment is 6 years.

5. Training

BCL will share your details with the following third-parties if you undertake certain training courses:

Driver Certificate of Professional Competence

Minibus Driver Awareness Scheme (MiDAS),

BCL may also ask for information about your ethnicity where there is a substantial public interest to do so, in order to monitor equality of opportunity and treatment.  This information will be stored in an anonymised format.

6. Marketing

Emails

BCL would like to keep in touch with you about the work that it does and the services provided.

BCL will only send you marketing communications by email with your consent. If you consent to receive email marketing communications, BCL will add your name and email contact details to its marketing database

You can opt out of email marketing by replying with ‘unsubscribe’ or you can email manager@bclift.org.uk or telephone on 01482 868082 at any time to opt out, change or update your contact details or to update your communication preferences.

Post

BCL may send marketing information by post if it is satisfied that it has a legitimate interest, for example, sending leaflets to current or potential service users.  You can contact BCL by email at manager@bclift.org.uk by post at 25 Corporation Road, Beverley, HU17 9HG or by telephone on 01482 868082 at any time to say you no longer wish to receive marketing by post or to update your contact details.

Telephone

From time to time, BCL may make marketing telephone calls to you but will never use automated calling systems. BCL will only contact you in this way if it is satisfied that it has a legitimate interest to do so and it will always check our own marketing preference records before we make any telephone marketing calls to you.  You can contact us on 01482 868082 or by email to manager@bclift.org.uk at any time if you no longer wish to be contacted by telephone for marketing purposes.

7. Monitoring and Development

BCL use anonymised information to carry out research into the use of our services and our effectiveness.  In some circumstances, we may share the results of this research with third parties such as organisations that fund our work but this information will always be anonymised so that it can no longer be associated with you.

8. Visitors to our website

Information collection and use

BCL will not sell, share, or rent information obtained through its website to others in ways different from what is disclosed.

BCL may collect basic personal information from you, in order to keep you informed with information, at your request. At any time, you can request to be removed from BCL’s contact database, and you will not be contacted again.

Secure storage

All data is stored with BCL’s web host. Only authorised members of staff who need the information to perform a specific job are granted access to personally identifiable information.

Sharing

BCL will not, under any circumstances, share with any third party individual IP addresses, email addresses, personal contact details or other information collected through its website or related statistic tracking systems. If information sharing is required for the purposes of this or any other event, you will be given immediate notice.

External links

BCL’s web site contains links to other sites. Please be aware that BCL is not responsible for the privacy practices of such other sites. BCL encourages its users to be aware when they leave its site and to read the privacy statements of each and every web site that collects personally identifiable information. This privacy policy applies solely to information collected by BCL’s web site.

Data protection

As BCL is not classed as a “data controller”, it does not have to notify the Information Commissioner about the information it collects or its practices. Please note however, that BCL complies meticulously with the eight principles of the Data Protection Act 1998 and understands best practice for managing information.

9. People who contact BCL via social media

If you send BCL a private or direct message via social media, it may share this information with other personnel within the organisation if it is satisfied that it has a legitimate interest to do so, for example, in order to respond to a specific query or to pass on information. BCL will not share any personal information that you provide in a message with any other organisations without your consent.

10. Sharing personal information

BCL will only ever use your personal data if it is satisfied that it is lawful and fair to do so. It will never sell your personal data or share it with third parties who might use it for their own commercial purposes.

BCL will only disclose your personal information to third parties:

where you have given BCL consent to share the information with the specific third party;

where information such as your email address is passed to Humber IT who provide technical support to BCL;

where BCL use Sage 50 for our accounting records and Shaunsoft Community Transport Software to store information about our service users;

where BCL use Google Drive to share information;

if BCL is under a legal duty to disclose or share your personal information, for example, if required to do so by a court order or for the purposes of prevention of fraud or other crime;

in order to enforce any terms and conditions or agreements between yourself and BCL;

as part of a sale of some or all of BCL business and assets to any third party or as part of any business restructuring or reorganisation (BCL will always notify you in advance and we will aim to ensure that your privacy rights will continue to be protected); or

to protect BCL’s rights, property and safety, or the rights, property and safety of others (this includes exchanging information with other companies, organisations, legal advisers and regulators for the purposes of fraud protection and credit risk

11. Data Security

BCL has appropriate security measures in place to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

BCL holds data electronically in its secure Shaunsoft Community Transport Software booking system and on its on-site file servers, which are protected by both hardware and software firewalls.

BCL has off-site backup with Google Drive

BCL regularly backs up all of the data we hold.

BCL stores papers in lockable cabinets in our offices when not being actively used.

When necessary, BCL disposes of or deletes your data securely.

BCL ensures that its employees, agents and contractors are aware of their privacy and data security obligations and it takes reasonable steps to ensure that employees of third parties working on its behalf are aware of their privacy and data security obligations.

BCL limits access to your personal information to those employees, agents, contractors and other third parties who have a need to know.

The transmission of information via the internet is never completely secure. Although BCL will do its best to protect your personal information, it cannot guarantee the security of any electronic information transmitted and any transmission is at your own risk.

BCL has put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where it is legally required to do so.

12. Data retention

BCL will only retain your personal information for as long as necessary to fulfil the purposes it was collected for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal information, BCL considers the amount, nature, and sensitivity of the information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which BCL processes your personal data and whether it can achieve those purposes through other means, and the applicable legal requirements.

BCL’s default retention period for personal data is 6 years from the date it receive the information unless otherwise specified by law. It keeps personal data that may be required for safeguarding purposes for 35 years from the date of collection (as considered reasonable by High Court ruling 2015).

These retention periods may be extended or reduced if BCL deems it necessary, for example, to defend legal proceedings or if there is an on-going investigation relating to the information.

BCL reviews the personal data (and the categories of personal data) it holds on a regular basis to ensure the data it is holding is still required and is accurate. If it discovers that certain data is no longer necessary or accurate, it will take steps to correct or delete the data.

13. Your rights

Under certain circumstances, by law, you have the right to:

Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.

Ask BCL to correct any information that it holds about you which is incorrect, incomplete or inaccurate.

Ask BCL to erase your personal information from its files and systems where there is no good reason for it continuing to hold it.

Object to BCL using your personal information to further its legitimate interests (or those of a third party) or where it is using your personal information for direct marketing purposes.

Ask BCL to restrict or suspend the use of your personal information, for example, if you want BCL to establish its accuracy or the reasons for using it.

Ask BCL to transfer your personal information to another person or organisation.

If you want to access, correct or request restriction or erasure of your personal information, or to object to BCL using your personal data, or request that it transfers a copy of your personal information to another party, please contact manager@bclift.org.uk or 01482 868082. You may be asked you to put your request in writing.

If you have given your consent to BCL processing your personal information, you have the right to withdraw your consent at any time. To withdraw your consent, please contact manager@bclift.org.uk or01482 868082. Once your notification is received that you wish to withdraw your consent, BCL will no longer process your personal information and, subject to BCL’s retention policy, your data will be disposed of securely.

14. Queries and Complaints

Jan Stainforth, the CEO, oversees compliance with this privacy notice. If you have any questions about this privacy notice or how BCL handles your personal information, please contact Jan:

by email to manager@bclift.org.uk

by post at 25 Corporation Road, Beverley, HU17 8HG

by telephone on 01482 868082

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.

Published: May 2018 by Beverley Community Lift