1. Your personal data – what is it?

2. Who are we?

3. How do we process your personal data?

Community Impact Bucks complies with its obligations under the “GDPR” by keeping personal data up to date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data. All personal data is kept on central IT systems and is not stored or transported on portable electronic devices.

We use your personal data for the following purposes:

• To enable us to provide a voluntary service for the benefit of the public and of charities and community groups in a particular geographical area as specified in our constitution;
• To administer membership records;
• To fundraise and promote the interests of the charity;
• To manage our employees and volunteers;
• To maintain our own accounts and records (including the processing of gift aid applications);
• To inform you of news, events, activities and services, and to survey your views on matters relevant to the charitable and voluntary sector;
• To fulfil specific requirements of service delivery contracts with government agencies, local government, other charities and private providers;
• To operate commercially in trading.

4. What is the legal basis for processing your personal data?

• Explicit consent of the data subject as part of our the Community Impact Bucks membership scheme so that we can keep you informed about news, events, activities and services and process your gift aid donations and keep you informed about events, training and other matters relevant to the charitable sector. Under the contract with our software provider for the Bucks Funding Search, data is shared between the two parties to ensure access to the relevant electronic systems is maintained, but only anonymised data is used for reporting and monitoring.
• Processing is necessary for carrying out obligations under employment, health and safety, social security or social protection law, or a collective agreement. Such protection and justification for processing applies to personal data relating to volunteers at Community Impact Bucks.
• Where personal data is collected relating to attendance at a Community Impact Bucks event or training, unless specific consent is given, that data will only be used in communications around the administration, running and follow-up for that event under legitimate interest.
• Where personal data is collected under our Community Buildings subscription, that data will only be used for matters relating to that subscription or its administration, under legitimate interest.
• Where personal data is collected relating to calls to our Community Transport Hub, personal data is only collected to enable service delivery and for reporting purposes (with the exception of contact information which may be used to call back if messages are left). All such personal data is deleted at the end of each quarterly reporting period, leaving only anonymised statistical data for reporting to the commissioner under the contract.
• Where personal data is collected relating to the Gardening or Handy Helpers service, only information required for service delivery or for prioritisation is collected, and all sensitive personal data (whether electronic or hard copy) is securely stored and access restricted only to staff who need it. For reasons of continuity of service delivery, and to ensure that relevant information about repeat clients or volunteers is available, data is retained for longer than the period stated in (6) below. Only data necessary to direct service delivery is shared with, for example, an employee volunteer group or delivering third party. Any personal data shared with the commissioner is either anonymised, or specific consent is sought to enable this sharing.
• Where personal data is collected relating to trading activity (including but not limited to the Oil Buying scheme), only necessary data is collected, and any sensitive information is securely stored and access restricted only to staff who need it.
• Where personal data is collected relating to any other short term project, only data that is needed will be collected, and the other considerations made clear elsewhere in this policy will apply.

5. Sharing your personal data

Your personal data will be treated as strictly confidential and will not be shared except where specifically required by contractual agreements. We will only share your data with third parties outside of Community Impact Bucks and its subsidiaries with your explicit consent. Any such cases where partnership working agreements require data sharing, specific consent will be obtained.

6. How long do we keep your personal data?

We keep data in accordance with the GDPR, and our board has decided that in relation to membership data (i.e. consent data), the appropriate duration for data retention should be three years. Such personal data is timestamped in our database, and we have automated systems in place to ensure that personal data is not retained indefinitely without the relevant consent or another relevant legal basis for processing. Non-membership data may be retained for shorter (see above under point 4 for detail about the Community Transport data) or longer (see above under point 4 for detail about Gardening service data) periods as appropriate.

7. Your rights and your personal data

Unless subject to an exemption under the GDPR, you have the following rights with respect to your personal data:

• The right to request a copy of your personal data which Community Impact Bucks holds about you;
• The right to request that Community Impact Bucks corrects any personal data if it is found to be inaccurate or out of date;
• The right to request your personal data is erased where it is no longer necessary for the Community Impact Bucks to retain such data;
• The right to withdraw your consent to the processing at any time;
• The right to request that the data controller provide the data subject with his/her personal data and where possible, to transmit that data directly to another data controller, (known as the right to data portability)¹.
• The right, where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction is placed on further processing;
• The right to object to the processing of personal data;²
• The right to lodge a complaint with the Information Commissioners Office.

8. Further processing

If we wish to use your personal data for a new purpose, not covered by this Data Protection Notice, then we will publish a new notice explaining this new use prior to commencing the processing and setting out the relevant purposes and processing conditions. Where and whenever necessary, we will seek your prior consent to the new processing.

9. How do we use cookies?

10. Contact details

To exercise all relevant rights, queries or complaints please in the first instance contact the Head of Programme Management at Community Impact Bucks.

You can contact the Information Commissioners Office on 0303 123 1113 or via email or at the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire. SK9 5AF.

¹ Only applies where the processing is based on consent or is necessary for the performance of a contract with the data subject and in either case the data controller processes the data by automated means.
² Only applies where processing is based on legitimate interests (or the performance of a task in the public interest/exercise of official authority); direct marketing and processing for the purposes of scientific/historical research and statistics