Volunteer privacy notice: collecting and processing personal data
The Fairtrade Foundation is committed to protecting the privacy and security of your personal information. Throughout your volunteering, we collect your personal data and are a “data controller”.
This volunteer privacy notice is to help you understand what personal information we collect about you, why we collect it and what we do with it.
By providing us with your personal information, you consent to the use of it in accordance with the conditions of this notice. In keeping with data protection legislation, we will not hold your personal information for longer than is necessary.
We may update this notice from time to time. If we make any significant changes, we will either get in touch to let you know (if we have your permission to contact you) or highlight the changes on our website and on this page.
If you have any questions about this privacy notice, please email us at help.gdpr@fairtrade.org.uk
1 Personal information we collect and hold about you
We collect, store, and use the personal information about you in relation to your volunteering with us.
It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your volunteering relationship with us.
2 How is your personal information collected?
We collect personal information about volunteers as listed in Schedule 1 of this privacy notice.
This information is either (a) provided by you, (b) created by us in the course of volunteer-related activities during your volunteering with us, or (c) obtained from third parties, normally through the application and recruitment process.
In particular, data may be obtained from the following third parties: former employers, or other background check agencies. If you fail to provide certain information when requested, we may not be able to perform certain duties in relation to your volunteering with the organisation or we may be prevented from complying with our legal obligations (such as to ensure the health and safety of our volunteers).
3 How we use personal information
We may use the information collected from/about you:
3.1 where it is necessary for the performance of your volunteering;
3.2 where we need to comply with a legal obligation; or
3.3 where it is necessary for the legitimate interests (or those of a third party) set out in Schedule 2 providing that our legitimate interest is not overridden by your interests or rights which require protection of your data.
We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
4 How we use special category personal information
Some personal information is treated as falling into a special category. This information is listed in Schedule 1 and used to be known as sensitive personal information. We may process this information in the following circumstances:
4.1 In limited circumstances, with your explicit written consent.
4.2 Where we need to do so to carry out our legal obligations (e.g. in the context of health and safety requirements) and in line with our data protection policies.
4.3 Where it is needed in the public interest, such as for equal opportunities monitoring, and in line with our data protection policies.
4.4 Where it is needed to assess your volunteering capacity on health grounds, subject to appropriate confidentiality safeguards.
Less commonly, we may process this type of information where it is needed in relation to legal claims or where it is needed to protect your interests (or someone else’s interests) and you are not capable of giving your consent, or where you have already made the information public. We may also process such information about former volunteers in the course of our legitimate business activities with the appropriate safeguards.
We will use your special category personal information in the following ways:
- We will use information about your physical or mental health, or disability status, to ensure your health and safety in the workplace and to assess your fitness to volunteer, to provide appropriate workplace adjustments,
- We will use information about your race or national or ethnic origin, religious, philosophical or moral beliefs, or your sexual life or sexual orientation, to ensure meaningful equal opportunity monitoring and reporting.
5 Information about criminal convictions
We may hold information about criminal convictions.
We will only collect information about criminal convictions if it is appropriate given the nature of the role and where we are legally able to do so. Where appropriate, we will collect information about criminal convictions as part of the recruitment process or we may be notified of such information directly by you. In addition, where it is appropriate in relation to certain roles, we will also check criminal convictions periodically.
We will use information about criminal convictions and offences in the following ways:
- assessing suitability for a regulated role;
- where it is necessary to protect your interests, our interests and those of other volunteers or employees or to protect clients and other third parties from theft, fraud and similar risks; and
- where it is necessary in relation to legal claims.
We are allowed to use your personal information in this way where you have already made the information public or it is necessary to carry out our organisational rights and obligations, for example to comply with Financial Conduct Authority regulation, and in accordance with our data protection policies.
6 Recipients of your personal data
We may disclose your personal information to third parties where required by law, where it is necessary to administer the relationship with you or where we have another legitimate interest in doing so. “Third parties” includes third-party service providers (including contractors and designated agents) and other entities within our group.
Personal information may be disclosed to the following categories of recipient:
- Other employees where appropriate;
- Future and prospective employers;
- Regulators;
- Third party service providers carrying out processing on our behalf such as (a) IT administrators, (b) training providers, (c) auditors, (d) building security providers, (e) consultants and other professional advisers; and
- Competent authorities (e.g. tax authorities), courts and otherwise as required by law.
All our third-party service providers and other entities in the group are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.
We will share your personal information with other entities in our group as part of our regular reporting activities on company performance, in the context of a business reorganisation or group restructuring exercise, for system maintenance support and hosting of data.
We may share your personal information with other third parties, for example in the context of the possible sale or restructuring of the business. We may also need to share your personal information with a regulator or to otherwise comply with the law.
7 Data security
We have put in place measures to protect the security of your information. Details of these measures are available upon request.
8 Data retention
We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements.
In general terms this means that we will retain your personal information for the duration of your volunteering with us and for the length of any applicable limitation period for claims which might be brought against us later. There are also certain types of information, such as volunteer expenses, which require to be retained for a certain period by law.
In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.
We retain speculative volunteer applications for one year from receipt of your application. For volunteers, we retain personal information for 6 years from the end date of volunteering for purposes such as reference requests.
9 Your rights
You have a number of rights in relation to our handling of your data. These include the following:
- Access: you are entitled to request access to your personal information (commonly known as a “data subject access request“). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
- Correction: you are entitled to request that any incomplete or inaccurate personal information we hold about you is corrected.
- Erasure: you are entitled to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
- Objection: where we are processing your personal information based on a legitimate interest (or those of a third party) you may object to processing on this ground. However we may be entitled to continue processing your information based on the legitimate interests.
- Restriction: you are entitled to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
- Transfer: you may request the transfer of your personal information to another party.
If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact Data Protection Leads in writing via data.protection@fairtrade.org.uk
10 Questions or complaints
10.1 Data protection officer
If you have any questions about this privacy notice or how we handle your personal information, or any complaints please contact the data.protection@fairtrade.org.uk
10.2 Supervisory authority
You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.
11 Changes to this privacy notice
We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.
Schedule 1
Personal information[1]
- Personal contact details such as, title, addresses, telephone numbers, and personal email addresses.
- Gender
- Start date.
- Location of volunteering.
- Recruitment information (including copies of, references and other information included in a CV or cover letter or as part of the application process).
- Volunteering records (including role titles, volunteering history, volunteering hours, training records and professional memberships).
- Performance information.
- Disciplinary and grievance information.
- Photographs.
Information relating to your family
- Marital status and dependants.
- Next of kin and emergency contact information.
Information relating to your use of our information and communications systems
- Information about your use of our information and communications systems.
- Information obtained through electronic means such as swipecard records.
Information about criminal convictions
- Information about criminal convictions and offences.
Special categories of personal data
We may also collect, store and use the following “special categories” of more sensitive personal information:
- Information about your race or ethnicity, religious beliefs, sexual orientation and political opinions.
Information about your health, including any medical condition, health and sickness records.
Schedule 2
Legitimate interest
- Making a decision about your recruitment or appointment.
- Assessing suitability for regulated roles (including criminal record checks)
- Business management and planning, including accounting and auditing.
- Conducting performance reviews, managing performance and determining performance requirements.
- Gathering evidence for possible grievance or disciplinary meetings.
- Making decisions about your continued engagement.
- Making arrangements for the termination of our volunteering relationship.
- Education, training and development requirements.
- Dealing with legal disputes involving you, or other employees, workers and contractors, including accidents at work.
- Ascertaining your fitness to volunteer.
- Complying with health and safety obligations.
- To prevent fraud.
- To monitor your use of our information and communication systems to ensure compliance with our IT policies.
- To ensure network and information security, including preventing unauthorised access to our computer and electronic communications systems and preventing malicious software distribution.
- To conduct data analytics studies to review and better understand volunteering rates.
- Equal opportunities monitoring.