The RSPB holds personal data relating to current, former and prospective volunteers for a variety of business purposes. In this policy, “volunteers” includes those presently and formerly engaged in voluntary activity including volunteers that are involved in our local community groups, and those who have expressed a desire to volunteer their time and talents.
This policy sets out how and why RSPB uses personal data relating to its volunteers, and explains your legal rights as data subjects. All volunteers should be familiar with this policy, which should be read in conjunction with the publication ‘A little of your time goes a long way’ and any related guidance.
If you have any questions about the content of this policy or other comments you should contact the RSPB’s Data Protection Officer Diane Gore (firstname.lastname@example.org) or write to RSPB Data Protection Officer, Corporate Services, The Lodge, Sandy Bedfordshire SG19 2DL.
This policy applies to all volunteers of the Royal Society for the Protection of Birds (charity no. 207076 in England and SC037654 in Scotland with data controller number Z5794583) and RSPB Sales Limited (a private limited company with registration number 2693778 and data controller number Z5539068) (together referred to as “RSPB” or “we”, “us” or “our”).
The RSPB may supplement or amend this policy by additional policies and guidelines from time to time.
In this policy:
“personal data” means any information which relates to an identifiable individual. This includes (but is not limited to) name, address, contact details, financial information, likes and dislikes and interests. It also includes work/volunteering history and appraisals, expressions of opinion about someone and any indication of someone else’s intentions towards a person;
“sensitive personal data” means personal data about an individual’s racial or ethnic origin, political opinions, religious or similar beliefs, trade union membership (or non-membership), physical or mental health or condition, biometric or genetic information, information about sexual life, criminal offences or proceedings; and
“processing” means obtaining, recording, holding or doing anything with data, such as organising, using, altering, retrieving, disclosing or deleting it.
3. DATA PROTECTION PRINCIPLES
RSPB decides how and why it processes volunteer personal data and, for the purposes of data protection law, RSPB is the controller. We will only process personal data in accordance with data protection law (including the General Data Protection Regulation) and with respect for the rights of the individuals involved.
When processing personal data, we will ensure that we:
- do so fairly, lawfully and in a transparent manner;
- only process the data for specified purposes, and we will make sure the personal data are adequate, relevant and not excessive for that purpose;
- only collect and process personal data to the extent necessary;
- keep personal data accurate and up to date (where necessary);
- keep personal data for no longer than is necessary; and
- protect the security, confidentiality and integrity of personal data.
We will also record and document our processing, so we can account for these activities and demonstrate that we have complied with our obligations.
4. THE KIND OF INFORMATION WE HOLD ABOUT YOU
We will collect, store and use the following categories of personal data about you:
- Contact details such as: name, title, addresses, telephone numbers, mobile phone numbers and personal email addresses;
- Date of Birth;
- Next of kin and emergency contact information;
- Bank account details (when necessary) for example, to reimburse legitimately incurred expenses;
- Copy of driving licence, passports and visas (when necessary);
- Recruitment information (including references and any other information enclosed in a CV or disclosed in the application process);
- Performance information, training records, meeting minutes and appraisals;
- Disciplinary and grievance information;
- CCTV footage and other information obtained through electronic means (such as cash donation paying-in cards);
- Testimonies, quotes or opinions about volunteering with the RSPB;
- Information about your use of our information and communication systems;
- Photographs, video and audio footage; and
- Information gathered from social media sources in the public domain eg Facebook.
We may collect, store and use the following special categories of personal data about you:
- Information about your ethnicity, religious beliefs, sexual orientation and political opinions;
- Information about your health including any medical conditions or dietary requirements;
- Information about criminal convictions and offences
- Information required and related to DBS or PVG checks or any other background checks associated with vulnerable individuals.
5. HOW IS YOUR PERSONAL INFORMATION COLLECTED
We collect personal data about volunteers through the volunteer enquiry and recruitment process. We may sometimes collect additional information from third parties including former or current employers (e.g. referees or if you are a corporate volunteer your employer may supply your data, occupational health providers or background check agencies for example DBS (and Volunteer Scotland for PVG checks).
6. LEGAL BASIS FOR PROCESSING
We collect and process personal data about our volunteers in order to facilitate their volunteer role and for volunteer-related purposes (e.g. volunteer welfare, equal opportunities monitoring, administrative purposes, financial, regulatory, business development and for information strategy). These purposes are explained in more detail in this policy.
We will only process personal data about our volunteers for the relevant purposes (when the law permits us to):
- if the processing is necessary for:
- the performance of the agreement we have entered with you (this does not amount to a contract of employment);
- our (or a third party’s) legitimate interests (provided these are not overridden by your fundamental rights and interests), in particular:
- to administer our relationship with you;
- to build a picture of your skills, experience and interests in order to assess your suitability for volunteering projects;
- the protection of your vital interests (e.g. in a ‘life or death’ scenario);
- compliance with a legal obligation, or
- with your consent
Where we process your personal data for our legitimate interests, we will make sure that we consider and balance any potential impact on you (both positive and negative), and your rights under data protection laws. Our legitimate interests do not automatically override your interests – we will not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required to or are permitted by law). You have the right to object to this processing if you wish, and if you wish to do so, then please contact us at email@example.com.
We will only use your personal data for the purposes we collected it unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and explain the legal basis which allows us to do so.
We may process your personal data without your knowledge or consent, in compliance with the above basis for processing, where this is required or permitted by law.
We may process sensitive personal data (also known as ‘special categories’ of personal data) about our volunteers from time to time. This can include (but is not limited to) data relating to your physical or mental health. Whenever we process sensitive personal data, we will take extra care to ensure your rights are protected and your information is kept safe.
We will only process special categories of personal data with your explicit consent, or if there are other grounds for doing so, including (but not limited to) the processing being:
- necessary to carry out obligations or exercise rights regarding volunteering (for example, processing medical or health information to assess your suitability for volunteering with us and for being involved on specific projects and in order to accommodate you in a voluntary role);
- necessary to protect your vital interests (or someone else’s interests);
- necessary to comply with a legal obligation (for example, to protect vulnerable individuals or for insurance purposes);
- in relation to personal data which you have made public; or
- necessary for bringing, defending or conducting a legal claim.
We process personal data because we need to do so to run the RSPB, to exercise our rights and obligations, and to comply with legal and regulatory duties we are under.
If you fail to provide certain information when requested, object to the processing of your personal data by us, or refuse to accept from us the communications specified in section 8, we may not be able to register you for or continue to make available to you volunteering opportunities or we may be prevented from meeting our obligations (such as to ensure your health and safety).
7. INFORMATION ABOUT CRIMINAL CONVICTIONS
This will usually be where such processing is necessary to carry out our obligations.
Less commonly, we may use information relating to criminal convictions where it is necessary in relation to legal claims; where it is necessary to protect your interests (or someone else’s interests) and you are not capable of giving your consent; or where you have already made the information public.
Where appropriate we will collect this information as part of the recruitment process or we may be notified of such information directly by you in the course of your voluntary work.
8. VOLUNTEER COMMUNICATIONS
There is certain information which the RSPB is required to send volunteers to support and facilitate their voluntary role and any related activities. Volunteers can expect to receive the following communications by email (and sometimes by post), to fulfil their voluntary work for the RSPB:
- Invitations to training events (both local and national);
- Notifications to take part in training;
- Sign up to volunteering requests;
- Invitations to take part in volunteering activities;
- Booking information (for example, if you are a residential volunteer); and
- Other communications to facilitate your voluntary work.
Volunteers are also obliged to receive several communications from the RSPB. These are a fundamental part of your volunteering, in order to support you, thank you, and disseminate information which is pertinent to your role (for example, a Local Group leader and/or committee member will receive News and Views which includes key guidance for the group). Volunteers can expect to receive the following by email or by post:
- National and Regional Involve;
- News and Views;
- Volunteering E-News;
- Reserve News and Bulletins;
- Regional Round Ups;
- Thank you Cards;
- Long Service Awards;
- Invitations to the Presidents Awards and other Thank You Events;
- Invitations to Regional/Country Meetings;
- the Volunteer Engagement Survey (VES) and other surveys; and
- we may also follow up with you to request testimonies (and associated photographs and/or videos) of your volunteer experience.
The RSPB sometimes works with other organisations (for example, another conservation charity) in partnership as part of a wider project (for example, Colour in the Margins or Back from the Brink). To keep you informed, the RSPB may send you communications which are relevant to the project, additionally, our partners may also send you communications of this nature.
If you are a volunteer and a member of the RSPB, this does not affect your data protection rights as a member or the marketing preferences that you provided in your capacity as a member. If you have chosen not to receive marketing communications, as a member, the RSPB will continue to respect your preferences in relation to non-volunteer related marketing.
9. WHO HAS ACCESS TO MY DATA?
Certain personal data about our volunteers will be made available to other RSPB employees, and volunteers which is limited to those who have access to volunteer information. We may publish limited personal data for example, testimonies/quotes and photographs which may be featured on our internal or external publications, e.g. our volunteer brochure.
Some content, including personal data, may also be held on the SharePoint Online site, the RSPB intranet or Dropbox which is also available to all RSPB employees and some volunteers. Where appropriate, access to sensitive information is restricted only to those who have a legitimate business reason to see it.
On occasion may be required to share your personal data with third parties. For more information please see section 10.
10. SHARING DATA WITH THIRD PARTIES
The RSPB may be required to share personal data (including, special categories of personal data) with third parties. For example, we may share information with:
- occupational health providers for undertaking necessary health checks;
- third party service providers (for example, those who carry out background checks for safeguarding purposes or driving licence checks);
- Governmental and regulatory bodies (including the police, DBS and Volunteer Scotland);
- Professional advisers (such as lawyers, accountants, auditors, health advisors and insurance brokers);
- Trusted suppliers and service providers who will process information on our behalf for administrative purposes, for example in arranging trips for local groups;
- Trusted partners or organisations when necessary, for example if you are volunteering for a joint project with another organisation, we may need to share your personal data with it.
We will only share personal data with third parties if adequate security measures are taken and your rights are respected. We will never sell your personal data to anyone.
11. IMPROVING THE RSPB
We use personal data to help us understand our volunteers, employees and organisation. One way in which we do this is through research (e.g. surveys) to gather data on, for example, volunteer satisfaction and identify areas that need improvement. Results may be aggregated or anonymised and used in reports (published internally and/or publicly) about the RSPB. From time to time these might flag up particular issues relating to the welfare or conduct of a particular person, and we may have to look into those situations in more detail.
Information from surveys may include sensitive personal data (e.g., if you complete an equal opportunities survey). We may also combine information from surveys with other information that we hold about our volunteers (which might include, or result in, sensitive personal data).
Certain survey results and information (including annual surveys) may be stored and archived for future use. We do this because compiling statistics over time provides a much more accurate picture of volunteer performance, wellbeing and satisfaction. We can then use this to inform our plans and strategies for the future.
12. IT MONITORING, CCTV AND TELEMATICS
The use of RSPB’s IT systems (including internet) emails and telephone is monitored to ensure all our workforce including volunteers use our systems properly and to the standards expected, to prevent or detect inappropriate behaviour and crime, and to ascertain compliance with various legal or regulatory requirements.
This information will be collected by the IT team who will report any issues to your line manager and, if necessary, any other senior employees.
If you have an RSPB email account or phone number, it may be necessary to access the email account or voicemail of a volunteer if they are absent to ensure that the RSPB responds properly to communications. The RSPB also reserves the right to inspect any RSPB email or other email or internet activity carried out using RSPB equipment (including RSPB laptops) at any time without notice.
Some of RSPB’s premises have CCTV, and you may be recorded on CCTV during the course of your volunteering with RSPB. CCTV is present for your protection and for the protection of RSPB. CCTV footage will only be viewed and used if it necessary to do so (e.g. to establish the facts surrounding an allegation of misconduct). CCTV surveillance is only stored temporarily and, unless it is flagged for review, tapes will be recorded over on a regular basis. RSPB complies with the CCTV Code of Practice published by the Information Commissioner’s Office and relevant RSPB guidance.
All our workforce, including volunteers, may be checked from time to time through ‘mystery shopping’ which is a research technique, whereby trained individuals experience and measure a volunteer by acting as a potential customer, and report back on their experiences. The objective of mystery shopping is to provide management with information on the process and/or quality of service in order to aid training plans, improve service, comply with our regulator’s requirements and increase customer satisfaction.
Please note: RSPB vehicles (including company cars), may be fitted with telematics systems (i.e. devices which monitor how a car is driven and record locational and/or other information). This information will be shared with insurers to reduce our insurance costs. We will notify you in advance if the vehicle you drive is fitted with a telematics device.
To prevent unauthorised access, use or disclosure of personal data we take all reasonable steps to employ a variety of physical and technical measures to keep your personal data safe. Where possible, electronic data and databases are stored on secure computer systems and we control who has access to personal data (using both physical and electronic means).
Personal data may be held locally by those who manage volunteers, for example local group leaders or members of the committee, in which case it is the responsibility of those individuals to ensure all reasonable and appropriate security measures are in place.
14. STORAGE AND RETENTION OF PERSONAL DATA
We only store information within the European Economic Area (EEA). If our trusted service providers (e.g. software providers like Microsoft) transfer any data outside of the EEA we will take steps to make sure adequate levels of privacy protection, in line with The General Data Protection Regulation and associated legislation, are in place.
We will only retain your personal data for as long as necessary to fulfil the purpose we collected it for, including the purposes of satisfying any legal, accounting or reporting requirements.
We will process personal data on volunteers for the duration of their voluntary work with RSPB. When a volunteer leaves RSPB, we will continue to retain data for as long as is necessary to:
- exercise any remaining rights or fulfil any remaining responsibilities required in relation to your voluntary work which still remain (e.g. processing further payments);
- comply with our legal obligations;
- for record-keeping and administrative purposes which are in our legitimate interests and which are not overridden by your rights or interests; and
- for health and safety purposes.
We continually review what information we hold and delete what we no longer required. Certain special categories of personal data on volunteers will be retained, and in some cases this personal data may be kept for very long periods of time. For example, we may retain information relating to health (e.g. if you have an accident whilst volunteering, in case of a future insurance claim).
If you are suspected or convicted of a criminal offence, we may retain information from our own records, and also other publicly available sources. We do this because it is necessary to do so:
- in case it is required to bring, defend or conduct a legal claim;
- to assist in the detection or prevention of crime; and
- to protect the interests of the general public.
Certain volunteers are required to undergo criminal record checks. The results of these checks will be stored by the RSPB for the purposes set out above.
15. YOUR RIGHTS
We want to ensure you remain in control of your personal data. Part of this is making sure you understand your legal rights, which are as follows:
- the right to obtain a copy of the personal data we hold (this is known as subject access request) within 30 days;
- the right to have your personal data erased (though this will not apply where it is necessary for us to continue to use the data for a lawful reason for example, your data will need to be retained for legal or insurance purposes);
- the right to have inaccurate personal data rectified;
- the right to object to your personal data being used for marketing (though this will not apply where it is necessary for us to continue to send you communications, as explained in section 7, as part of your volunteering role, this does not affect your rights in relation to non-volunteer related communications);
- the right to object to your personal data being used for profiling; and
Please keep in mind that there are exceptions to some of the rights above and, though we will always try to respond to your satisfaction, there may be situations where we are unable to do so. If you are not happy with our response, or you believe that your data protection or privacy rights have been infringed, you should contact the UK Information Commissioner’s Office which data protection law in the UK. Details of how to do this can be found at www.ico.org.uk.
Any volunteers who would like request information that the RSPB holds relating to them should contact our Data Protection Officer, Diane Gore (firstname.lastname@example.org) or write to RSPB Data Protection Officer, Corporate Services, The Lodge, Sandy Bedfordshire SG19 2DL.
The RSPB will not charge a fee for you to access your personal data, or to exercise any of the above rights, however, we may charge a reasonable fee if your request is unfounded or excessive. We may refuse to comply with the request in such circumstances.
We may request information from you to help us confirm your identity and ensure your personal data is not disclosed to anyone who has no right to receive it.
- If you are not satisfied with our response, or you believe that your data protection or privacy rights have been infringed, you should contact the UK Information Commissioner’s Office which enforces data protection law in the UK. Details of how to do this can be found at www.ico.org.uk
- Volunteers with any questions or concerns about anything in this policy or how their personal data is used by RSPB should not hesitate to discuss these with the RSPB’s Data Protection Officer.
16. CHANGES TO YOUR DETAILS
Any changes in personal circumstances should be notified to your line manager, who will ensure that our records are updated. Such changes would include address, telephone number, etc.
Last updated 24.05.2018