This policy sets out how and why RSPB uses personal data relating to its volunteers, and explains your legal rights as data subjects.
The RSPB holds personal data relating to current, former and prospective volunteers fora variety of business purposes. In this policy, “volunteers” includes those presently and formerly engaged in voluntary activity including volunteers that are involved in our local community groups,and those who have expressed a desire to volunteertheir time and talents.
This policy sets out how and why RSPB uses personal data relating to its volunteers, and explains your legal rights as data subjects. All volunteers should be familiar with this policy, which should be read in conjunction with the publication ‘A little of your time goes a long way’ and any related guidance.
If you have any questions about the content of this policy or other comments you should contact the RSPB’s Data Protection Officer Donna Tebbutt (dpofficer@rspb.org.uk) or write to RSPB Data Protection Officer, Corporate Governance and Risk, The Lodge, Sandy Bedfordshire SG19 2DL.
1.1.
This policy applies to all volunteers of the Royal Society for the Protection of Birds (charity no. 207076 in England and SC037654 in Scotland with data controller number Z5794583) and RSPB Sales Limited (a private limited company with registration number 2693778 and data controller number Z5539068) (together referred to as “RSPB” or “we”, “us” or “our”).
1.2.
This policy is to be read alongside the information in the publication ‘A little of your time goes a long way’, the Staff Privacy Policy and its public Privacy Policy which sets out how RSPB collects and uses the personal data of customers, other supporters and staff.
1.3.
The RSPB may supplement or amend this policy by additional policies and guidelines from time to time.
2.1.
In this policy:
“personal data” means any information which relates to an identifiable individual. This includes (but is not limited to) name, address, contact details, financial information, likes and dislikes and interests. It also includes work/volunteering history and appraisals, expressions of opinion about someone and any indication of someone else’s intentions towards a person;
“sensitive personal data” means personal data about an individual’s racial or ethnic origin, political opinions, religious or similar beliefs, trade union membership (or non-membership), physical or mental health or condition, biometric or genetic information, information about sexual life, criminal offences or proceedings; and
“processing” means obtaining, recording, holding or doing anything with data, such as organising, using, altering, retrieving, disclosing or deleting it.
3.1.
RSPB decides how and why it processes volunteer personal data and, for the purposes of data protection law, RSPB is the controller. We will only process personal data in accordance with data protection law (including the General Data Protection Regulation) and with respect for the rights of the individuals involved.
3.2.
When processing personal data, we will ensure that we:
3.3.
We will also record and document our processing, so we can account for these activities and demonstrate that we have complied with our obligations.
4.1.
We will collect, store and use the following categories of personal data about you:
4.2.
We may collect, store and use the following special categories of personal data about you:
5.1
We collect personal data about volunteers through the volunteer enquiry and recruitment process. We may sometimes collect additional information from third parties including former or current employers (e.g. referees or if you are a corporate volunteer your employer may supply your data, occupational health providers or background check agencies for example DBS (and Volunteer Scotland for PVG checks).
6.1.
We collect and process personal data about our volunteers in order to facilitate their volunteer role and for volunteer-related purposes (e.g. volunteer welfare, equal opportunities monitoring, administrative purposes, financial, regulatory, business development and for information strategy). These purposes are explained in more detail in this policy.
6.2.
We will only process personal data about our volunteers for the relevant purposes (when the law permits us to):
if the processing is necessary for:
6.3.
Where we process your personal data for our legitimate interests, we will make sure that we consider and balance any potential impact on you (both positive and negative), and your rights under data protection laws. Our legitimate interests do not automatically override your interests – we will not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required to or are permitted by law). You have the right to object to this processing if you wish, and if you wish to do so, then please contact us at dpofficer@rspb.org.uk.
6.4.
We will only use your personal data for the purposes we collected it unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and explain the legal basis which allows us to do so.
6.5.
We may process your personal data without your knowledge or consent, in compliance with the above basis for processing, where this is required or permitted by law.
6.6.
We may process sensitive personal data (also known as ‘special categories’ of personal data) about our volunteers from time to time. This can include (but is not limited to) data relating to your physical or mental health. Whenever we process sensitive personal data, we will take extra care to ensure your rights are protected and your information is kept safe.
6.7.
We will only process special categories of personal data with your explicit consent, or if there are other grounds for doing so, including (but not limited to) the processing being:
6.8.
We process personal data because we need to do so to run the RSPB, to exercise our rights and obligations, and to comply with legal and regulatory duties we are under.
6.9.
If you fail to provide certain information when requested, object to the processing of your personal data by us, or refuse to accept from us the communications specified in section 8, we may not be able to register you for or continue to make available to you volunteering opportunities or we may be prevented from meeting our obligations (such as to ensure your health and safety).
7.1.
This will usually be where such processing is necessary to carry out our obligations.
7.2.
Less commonly, we may use information relating to criminal convictions where it is necessary in relation to legal claims; where it is necessary to protect your interests (or someone else’s interests) and you are not capable of giving your consent; or where you have already made the information public.
7.3.
Where appropriate we will collect this information as part of the recruitment process or we may be notified of such information directly by you in the course of your voluntary work.
8.1.
There is certain information which the RSPB is required to send volunteers to support and facilitate their voluntary role and any related activities. Volunteers can expect to receive the following communications by email (and sometimes by post), to fulfil their voluntary work for the RSPB:
8.2.
Volunteers are also obliged to receive several communications from the RSPB. These are a fundamental part of your volunteering, in order to support you, thank you, and disseminate information which is pertinent to your role (for example, a Local Group leader and/or committee member will receive News and Views which includes key guidance for the group). Volunteers can expect to receive the following by email or by post:
8.3
The RSPB sometimes works with other organisations (for example, another conservation charity) in partnership as part of a wider project (for example, Colour in the Margins or Back from the Brink). To keep you informed, the RSPB may send you communications which are relevant to the project, additionally, our partners may also send you communications of this nature.
8.4
If you are a volunteer and a member of the RSPB, this does not affect your data protection rights as a member or the marketing preferences that you provided in your capacity as a member. If you have chosen not to receive marketing communications, as a member, the RSPB will continue to respect your preferences in relation to non-volunteer related marketing.
9.1.
Certain personal data about our volunteers will be made available to other RSPB employees, and volunteers which is limited to those who have access to volunteer information. We may publish limited personal data for example, testimonies/quotes and photographs which may be featured on our internal or external publications, e.g. our volunteer brochure.
9.2.
Some content, including personal data, may also be held onother systems. Where appropriate, access to sensitive information is restricted only to those who have a legitimate business reason to see it.
9.3.
On occasion may be required to share your personal data with third parties. For more information please see section 10.
10.1.
The RSPB may be required to share personal data (including, special categories of personal data) with third parties. For example, we may share information with:
10.2.
We will only share personal data with third parties if adequate security measures are taken and your rights are respected. We will never sell your personal data to anyone.
10.3.
If you use a personal computer or electronic device (such as tablet or mobile phone) for your voluntary work purposes (e.g. to access ROBINS if you are a pin badge volunteer), then information about you and your device may be collected. This may be done by a third party, e.g. if you access your email via an application on your mobile phone the app provider may collect details of your device, phone number and IP address. RSPB will have no control over (or responsibility for) the collection or processing of personal data by third parties arising from the use of a personal device for work purposes and you should read the privacy policy of an application or website you use.
11.1.
We use personal data to help us understand our volunteers, employees and organisation. One way in which we do this is through research (e.g. surveys) to gather data on, for example, volunteer satisfaction and identify areas that need improvement. Results may be aggregated or anonymised and used in reports (published internally and/or publicly) about the RSPB. From time to time these might flag up particular issues relating to the welfare or conduct of a particular person, and we may have to look into those situations in more detail.
11.2.
Information from surveys may include sensitive personal data (e.g., if you complete an equal opportunities survey). We may also combine information from surveys with other information that we hold about our volunteers (which might include, or result in, sensitive personal data).
11.3.
Certain survey results and information (including annual surveys) may be stored and archived for future use. We do this because compiling statistics over time provides a much more accurate picture of volunteer performance, wellbeing and satisfaction. We can then use this to inform our plans and strategies for the future.
12.1.
The use of RSPB’s IT systems (including internet) emails and telephone is monitored to ensure all our workforce including volunteers use our systems properly and to the standards expected, to prevent or detect inappropriate behaviour and crime, and to ascertain compliance with various legal or regulatory requirements.
12.2.
This information will be collected by the IT team who will report any issues to your line manager and, if necessary, any other senior employees.
12.3.
If you have an RSPB email account or phone number, it may be necessary to access the email account or voicemail of a volunteer if they are absent to ensure that the RSPB responds properly to communications. The RSPB also reserves the right to inspect any RSPB email or other email or internet activity carried out using RSPB equipment (including RSPB laptops) at any time without notice.
12.4.
Some of RSPB’s premises have CCTV, and you may be recorded on CCTV during the course of your volunteering with RSPB. CCTV is present for your protection and for the protection of RSPB. CCTV footage will only be viewed and used if it necessary to do so (e.g. to establish the facts surrounding an allegation of misconduct). CCTV surveillance is only stored temporarily and, unless it is flagged for review, tapes will be recorded over on a regular basis. RSPB complies with the CCTV Code of Practice published by the Information Commissioner’s Office and relevant RSPB guidance.
12.5.
All our workforce, including volunteers, may be checked from time to time through ‘mystery shopping’ which is a research technique, whereby trained individuals experience and measure a volunteer by acting as a potential customer, and report back on their experiences. The objective of mystery shopping is to provide management with information on the process and/or quality of service in order to aid training plans, improve service, comply with our regulator’s requirements and increase customer satisfaction.
12.6.
Please note: RSPB vehicles (including company cars), may be fitted with telematics systems (i.e. devices which monitor how a car is driven and record locational and/or other information). This information will be shared with insurers to reduce our insurance costs. We will notify you in advance if the vehicle you drive is fitted with a telematics device.
13.1.
To prevent unauthorised access, use or disclosure of personal data we take all reasonable steps to employ a variety of physical and technical measures to keep your personal data safe. Where possible, electronic data and databases are stored on secure computer systems and we control who has access to personal data (using both physical and electronic means).
13.2.
Personal data may be held locally by those who manage volunteers, for example local group leaders or members of the committee, in which case it is the responsibility of those individuals to ensure all reasonable and appropriate security measures are in place.
14.1.
We only store information within the European Economic Area (EEA). If our trusted service providers (e.g. software providers like Microsoft) transfer any data outside of the EEA we will take steps to make sure adequate levels of privacy protection, in line with The General Data Protection Regulation and associated legislation, are in place.
14.2.
We will only retain your personal data for as long as necessary to fulfil the purpose we collected it for, including the purposes of satisfying any legal, accounting or reporting requirements.
14.3.
We will process personal data on volunteers for the duration of their voluntary work with RSPB. When a volunteer leaves RSPB, we will continue to retain data for as long as is necessary to:
14.4.
We continually review what information we hold and delete what we no longer required. Certain special categories of personal data on volunteers will be retained, and in some cases this personal data may be kept for very long periods of time. For example, we may retain information relating to health (e.g. if you have an accident whilst volunteering, in case of a future insurance claim).
14.5.
If you are suspected or convicted of a criminal offence, we may retain information from our own records, and also other publicly available sources. We do this because it is necessary to do so:
14.6.
Certain volunteers are required to undergo criminal record checks. The results of these checks will be stored by the RSPB for the purposes set out above.
15.1.
We want to ensure you remain in control of your personal data. Part of this is making sure you understand your legal rights, which are as follows:
15.2.
Please keep in mind that there are exceptions to some of the rights above and, though we will always try to respond to your satisfaction, there may be situations where we are unable to do so. If you are not happy with our response, or you believe that your data protection or privacy rights have been infringed, you should contact the UK Information Commissioner’s Office which data protection law in the UK. Details ofhow to do this can be found at www.ico.org.uk.
15.3.
Any volunteers who would like request information that the RSPB holds relating to them should contact our Data Protection Officer, Donna Tebbutt (dpofficer@rspb.org.uk) or write to RSPB Data Protection Officer, Corporate Governance and Risk, TheLodge, Sandy Bedfordshire SG19 2DL.
15.4.
The RSPB will not charge a fee for you to access your personal data, or to exercise any of the above rights, however, we may charge a reasonable fee if your request is unfounded or excessive. We may refuse to comply with the request in such circumstances.
15.5.
We may request information from you to help us confirm your identity and ensure your personal data is not disclosed to anyone who has no right to receive it.
If you are not satisfied with our response, or you believe that your data protection or privacy rights have been infringed, you should contact the UK Information Commissioner’s Office which enforces data protection law in the UK. Details of how to do this can be found at www.ico.org.uk
Volunteers with any questions or concerns about anything in this policy or how their personal data is used by RSPB should not hesitate to discuss these with the RSPB’s Data Protection Officer.
15.6.
We have appointed EU Business Partners as our representatives in the EU for the purposes of Article 27 of the General Data Protection Regulation. You may contact our EU representative, as well as us directly, with any query that you may have in relation to your personal data. The contact details of our EU representative are as follows:
EUBusiness Partners
10 Ashe street
Clonakilty
Co. Cork
P85 e403
Ireland
Point of contact: Flor McCarthy
Email: info@eubusinesspartners.com
16.1.
Any changes in personal circumstances should be notified to your line manager, who will ensure that our records are updated. Such changes would include address, telephone number, etc.
17.1.
We will amend this Volunteer Privacy Policy from time to time to ensure it remains up-to-date and accurately reflect how and why we use your personal data. The current version of our Volunteer Privacy Policy will always be posted on Assemble, the website and the Intranet.
Last updated 24.11.2021
