GDPR Policy

 

1.     Policy Statement

Samye Foundation Wales collects and uses information about people with whom it communicates.  This personal information must be dealt with properly and securely however it is collected, recorded, and used – whether on paper, in a computer, or recorded on other material- these are safeguards to ensure this in the Data Protection Act 2018 and GDPR.

 

Samye Foundation Wales regards the lawful and correct treatment of personal information as very important to the successful and efficient performance of its functions, and to maintain confidence between those with whom it deals.

 

To this end Samye Foundation Wales fully endorses and adheres to the Principles of Data Protection, as set out in the Data Protection Act 2018 and GDPR.

 

2.     Purpose

The purpose of this policy is to ensure that the staff, volunteers, and trustees of Samye Foundation Wales are clear about the purpose and principles of Data Protection and to ensure that it has guidelines and procedures in place which are consistently followed.

 

Failure to adhere to the Data Protection Act 2018 and GDPR is unlawful and could result in legal action being taken against Samye Foundation Wales or its staff, volunteers, or trustees.

 

3.     Principles

The Data Protection Act 2018 and GDPR regulates the processing information relating to living and identifiable individuals (data subjects).  This includes the obtaining, holding, using or disclosing of such information, and covers computerised records as well as manual filing systems and card indexes.

 

Data users must comply with the data protection principles of good practice which underpin the Act.  To comply with the law, information must be collected and used fairly, stored safely and not disclosed to any other person unlawfully.

 

 

 

 

To do this Samye Foundation Wales follows the six Data Protection Principles outlined in the Data Protection Act 2018 and GDPR, which are summarised below:

  1. Personal data will be processed fairly and lawfully
  2. Data will only be collected and used for specified purposes
  • Data will be adequate, relevant, and not excessive
  1. Data will be accurate and up to date
  2. Data will not be held any longer than necessary
  3. Data will be kept safe from unauthorised access, accidental loss, or damage

The principles apply to “personal data” which is information held on computer or in manual filing systems from which they are identifiable.  Samye Foundation Wales employees, volunteers and trustees who process or use any personal information in the course of their duties will ensure that these principles are followed at all times.

 

4.     Procedures

The following procedures have been developed in order to ensure that Samye Foundation Wales meet its responsibilities in terms of Data Protection.  For the purposes of these procedures data collected, stored, and used by Samye Foundation Wales falls into 2 broad categories:

 

  1. Samye Foundation Wales internal data records;

Staff, volunteers, and directors

  1. Samye Foundation Wales external data records;

Members, customers, and clients

 

Samye Foundation Wales as a body is a DATA CONTROLLER under the Act, and the Executive Committee is ultimately responsible for the policy’s implementation.

 

 

 

 

4.1       Internal data records

4.1.1        Purposes

Samye Foundation Wales obtains personal data (names, addresses, phone numbers, email addresses), application forms, and references and in some cases other documents from staff, volunteers, and directors.  This data is stored and processed for the following purposes:

  • Recruitment
  • Equal Opportunities
  • Volunteering opportunities
  • To distribute relevant organisational material e.g., meeting papers
  • Payroll

4.1.2        Access

The contact details of staff, volunteers and directors will only be made available to other staff, volunteers and directors.  Any other information supplied on application will be kept in a secure filing cabinet and is not accessed during the day to day running of the organisation.

 

Contact details of staff, volunteers and directors will not be passed on to anyone outside the organisation without their explicit consent.

 

A copy of staff, volunteer, director emergency contact details will be kept in the Emergency File for Health and Safety purposes to be used in emergency situations e.g., fire/bomb evacuations.

 

Staff, volunteers, and directors will be supplied with a copy of their personal data held by the organisation if a request is made. Information will be made available within one month of the request, and the first request is free.

 

All confidential post must be opened by the addressee only.

 

4.1.3        Accuracy

Samye Foundation Wales will take reasonable steps to keep personal data up to date and accurate.  Personal data will be stored for 6 years after an employee, volunteer or director has worked for the organisation and brief details for longer.  Unless the organisation is specifically asked by an individual to destroy their details it will normally keep them on file for future reference.  The Director has responsibility for destroying personal files.

 

4.1.4        Storage

Personal data is kept in paper-based systems and on a password protected computer system.  Every effort is made to ensure that paper-based data are stored in organised and secure systems.

 

Samye Foundation Wales operates a clear desk policy at all times.

 

4.1.5    Use of Photographs

Where practicable, Samye Foundation Wales will seek consent from individuals before displaying photographs in which they appear.  See the Media Release consent form in Appendix 1. This policy also applies to photographs published on the organisation website or in the Newsletter.

 

4.2       External data records

4.2.1        Purposes

Samye Foundation Wales obtains personal data (such as names, address, and phone numbers) from members/clients.  This data is obtained, stored and processed solely to assist staff and volunteers in the efficient running of services.  Personal details supplied are only used to send material that is potentially useful.  Most of this information is stored on the organisation’s database.

 

Samye Foundation Wales obtains personal data and information from clients and members in order to provide services.  This data is stored and processed only for the purposes outlined in the agreement and service specification signed by the client/member.

 

4.2.2        Consent

Personal data is collected over the phone and using other methods such as e-mail.  During this initial contact, the data owner is given an explanation of how this information will be used.  Written consent is not requested as it is assumed that the consent has been granted when an individual freely gives their own details.

 

Personal data will not be passed on to anyone outside the organisation without explicit consent from the data owner unless there is a legal duty of disclosure under the legislation, in which case the Director will discuss and agree disclosure with the Chair/ Vice Chair.  Contact details held on the organisation’s database may be made available to groups/individuals outside of the organisation.  Individuals are made aware of when their details are being collected for the database and their verbal or written consent is requested.

4.2.3        Access

Only the organisation’s staff, volunteers and trustees will normally have access to personal data.  All staff, volunteers and trustees are made aware of the Data Protection Policy and their obligation not to disclose personal data to anyone who is not supposed to have it.

 

Information supplied is kept in a secure filing, paper and electronic system and is only accessed by those individuals involved in the delivery of the service.

 

Information will not be passed on to anyone outside the organisation without their explicit consent, excluding statutory bodies e.g. the Inland Revenue.

 

Individuals will be supplied with a copy of any of their personal data held by the organisation if a request is made.

 

All confidential post must be opened by the addressee only.

 

4.2.4        Accuracy

Samye Foundation Wales will take reasonable steps to keep personal data up to date and accurate.  Personal data will be stored for as long as the data owner /client/member uses our services and normally longer.  Where an individual ceases to use our services and is not deemed appropriate to keep their records, their records will be destroyed according to the schedule in Appendix B.  However, unless we are specifically asked by an individual to destroy their details, we will normally keep them on file for future reference.

 

If a request is received from an organisation/individual to destroy their records, we will remove their details from the database and request that all staff holding paper or electronic details for the organisation destroy them.  This work will be carried out by the information Officer.

 

This procedure applies if Samye Foundation Wales is informed that an organisation ceases to exist.

 

4.2.5        Storage

Personal data may be kept in paper-based systems and on a password-

protected computer system.  Paper-based data are stored in organised and secure systems.

 

Samye Foundation Wales operates a clear desk policy at all times.

 

5.     Criminal Records Bureau

Samye Foundation Wales will act in accordance with the CRB’s code of practice.

Copies of disclosures are kept for no longer than 6 months in accordance with the CRB Code of Practice.  There may be circumstances where it is deemed appropriate to exceed this limit e.g. in the case of disputes.

 

6.     Responsibilities of staff, volunteers, and trustees

During the course of their duties with Samye Foundation Wales, staff, volunteers, and trustees will be dealing with information such as names/addresses/phone numbers/email addresses of members/clients/volunteers.  They may be told or overhear sensitive information while working for Samye Foundation Wales.  The Data Protection Act (2018) gives specific guidance on how this information should be dealt with in short to comply with the law; personal information must be collected and used fairly, stored safely and not disclosed to any other person unlawfully.  Staff paid or unpaid must abide by this policy.

 

To help staff, volunteers, trustees meet the terms of the Data Protection Act; the attached Data Protection/Confidentiality statement has been produced.  Staff, Volunteers, and trustees are asked to read and sign this statement to say that they have understood their responsibilities as part of the programme.

 

7.     Compliance

Compliance with the Act is the responsibility of all staff, paid or unpaid.  Samye Foundation Wales will regard any unlawful breach of any provision of the Act by any staff, paid or unpaid, as a serious matter which will result in disciplinary procedure which may result in dismissal for gross misconduct.  Any such breach could also lead to criminal prosecution.

 

Any questions or concerns about the interpretation or operation of this policy statement should in the first instance be referred to the line manager.

 

8.     Retention of Data

No documents will be stored for longer than is necessary.  For guidelines on retention periods see the Privacy Policy.