Privacy Policy

 RWoB Privacy Policy V1. April 2021 0 Date for review: April 2024. 

Refugee Women of Bristol 

Information security and Confidentiality Policy 

Contents 

Information security and Confidentiality Policy
What and who this policy covers
How does RWoB collect information?
What data does RWoB collect?
Sensitive Personal Data
Why does RWoB collect data?
Privacy Notice
Legal basis
Consent
Communication
Individual wishes
How RWoB protect data
Responsibilities
Confidentiality
Who RWoB share data with
Links on the RWoB website
Transmitting information over the internet
How long does RWoB keep data?
How long does your consent last?
Rights to individual personal data
Changes to this policy
Cookies
Complaints or comments

10 RWoB Privacy Policy V1. April 2021 1

Date for review: April 2024. 

Information security and Confidentiality Policy Refugee Women of Bristol (RWoB) is committed to protecting personal information (data). RWoB want to be clear about why we hold personal details and how we use them. The aim of this policy is to be clear about how RWoB as a Data Controller collects, stores and uses data and manages it securely. 

This document should be read in conjunction with the other documents it refers to. By providing RWoB with personal information consent is given for the collection and use of any information provided in accordance with this policy. 

The key objectives of this policy are: 

• To explain the responsibilities that RWoB has in respect to data protection. 

• To provide an overview of how RWoB ensure data protection and confidentiality 

• To provide a clear procedure that will be implemented where information security and confidentiality issues arise, such as a data breach. 

This policy has been created using guidance from the Information Commissioner’s Office (ICO) and in line with General Data Protection Regulation. 

What and who this policy covers 

This policy applies to all the data RWoB collect from staff, volunteers, partner organisations, funders, supporters, donors and members. This includes the registration and ongoing support of members, staff and volunteer recruitment, social media platforms and our website and during RWoB activities such as our events. It also covers any financial data we may collect. 

This policy also covers the responsibilities of RWoB representatives (for example staff or volunteers) regarding the confidential nature of much of RWoB’s work. 

How do RWoB collect information? 

RWoB collect data through the registration of members, recruitment of staff and volunteers and during social activities and events. Data is also gathered through our outreach and community worker support either in person at a Drop-in centre or via the telephone or via partner organisations. 

RWoB also gather data via social media platforms and general non-identifying information when individuals use our website in order to improve it and the experience of its users (for information please see ‘cookies’ section below).

What data do RWoB collect? 

RWoB collects, holds and uses information that is both confidential and valuable to RWoB in providing services to its members, communicating its work and securing funding. 

RWoB collects: 

▪ Names and contact details of staff (including applicants), volunteers, members and partner organisations. 

▪ Some Special Category data including (but not limited to) age, gender, sexuality, race, country of origin, immigration status, religion, disability and health information. 

▪ Details about members existing support networks such as family and/or organisations a member may already be supported by. 

▪ The types of support needed/provided by RWoB staff and volunteers (e.g. translation work or ESOL classes). 

▪ Referrals made to partner organisations. 

▪ Videos or photographs taken during our events (specific consent will be obtained for this). 

▪ Any other information provided by individuals or organisations that is relevant to the relationship with RWoB. 

▪ Financial data 

▪ Non-identifying information about visits to our website, including technical information such IP addresses. 

Sensitive Personal Data 

Data Protection Law says that certain categories of data are more sensitive than others. These are known as special categories of personal data and can include information on health, racial or ethnic origin, sexual orientation, political opinions, religious beliefs, and from 25 May 2018 genetic and biometric data. 

The special category data is used to monitor our services and to report on the work we are doing to our Trustees, Bristol City Council and our funders. It will not ever be used in a way that can identify individuals. 

Why do RWoB collect data? 

Refugee Women of Bristol will use the data to provide its services to its members monitor our services and to report on the work we are doing to our Trustees, Bristol City Council and our funders. We also collect data to facilitate recruitment, manage our finances, manage communication preferences, comply with our legal obligations, policies and procedures and meet financial auditing requirements. 

RWoB will only use data in ways relevant to carrying out its legitimate purposes and functions as a charity, in a way that is not harmful to the interests of individuals or in breach of relevant legislation. 

Privacy Notice 

RWoB have written a summary of this policy, known as the RWoB Privacy Notice for staff, volunteers, and members. It is available in several community languages. Members, staff and volunteers are asked to read and sign this document (see consent below) upon registration or employment. A copy is available on our website. 

Legal basis and Legitimate Interests 

When RWoB collect, store and use personal information, we make sure we adhere to at least one of the legal grounds available to us under Data Protection Law. In most cases we will use ‘consent’ as the legal basis by which to collect, store and use personal information. 

Consent 

Consent requires a positive opt-in. It must be clear and concise and be clear how to opt out should someone wish to. When an individual joins RWoB consent is obtained via the membership form, volunteer application form or staff consent form. In addition, individuals may also agree to be included in specific contact groups, via services such as WhatsApp. In this instance the individual will be made aware of the purposes of the group and the sharing of their contact details for this specific purpose. Consent will be recorded (either written or verbal). 

Consent may be withdrawn at any time however this may result in RWoB no longer being able to provide a service to a member, work with a partner organisation or volunteer or to employ an individual. 

Communication 

Being able to communicate with members, staff, volunteers and partners is essential to RWoB. We use the data given in line with the above legal grounds to contact individuals. 

The majority of communication is carried out electronically, therefore where provided, RWoB will use email to contact individuals, however, RWoB may also communicate via post or telephone.

In the majority of cases RWoB will provide updates on its work via social media and our website. We do not maintain a list of supporters or store their data in any way, other than through third party donation websites such as JustGiving, where consent is obtained via the service provider. 

RWoB does not engage in direct marketing. 

Individual wishes 

RWoB will always endeavor to communicate with individuals according to their wishes. In order to opt out of communications individuals should remove themselves from RWoB social media and/or contact the RWoB administrator via [email protected] for advice. RWoB will record any ‘opt-out’ notifications. 

Individuals can also register their details with the Fundraising Preference Service (FPS). An individual can also inform RWoB through the Fundraising Regulator that they wish not to be contacted by us. They can be contacted online, or by telephoning 0300 3033 517. 

Requests can take up to 28 days to be actioned, though RWoB would aim to action any request as quickly as possible. 

How RWoB protect data 

RWoB make every effort to keep data safe and not accessible to third party individuals or organisations, other than for the purposes as outlined in this policy. RWoB provide data security by password protecting any equipment and documents containing personal data, including images, keeping computers and laptops safe and using an external file storage platform (e.g Dropbox) for file storage and sharing. 

All data access is restricted to only those authorised to do so. This includes electronic and hard copy data. 

Financial data is managed through the external accounting software QuickBooks. 

As we use external storage platforms it is possible data may be transferred or stored across borders. Personal data will only be transferred out of the UK or European Economic Area to countries which are considered acceptable under the EU Data Protection Directive, in the case the organisation subscribes to a verifiable certification scheme (e.g. EU-U.S. Privacy Shield Framework), or under contract, subject to EU model contract clauses for personal data transfer. Any external registration or storage platform used by RWoB will adhere to such a certified scheme. RWoB Privacy Policy V1. April 2021 5 Date for review: April 2024. 

Responsibilities 

Each staff member and volunteer is expected to comply with the security measures for the use of computer and paper data storage systems and the protection of data held within. Staff and volunteers must report any breaches of data protection/security to the Development Manager or Chair of Trustees. Decisions will then be taken under advice from the Information Commissioner’s Office (ICO). 

The Development Manager/Chair is responsible for ensuring that this policy and standards are understood and observed by all staff, volunteers and trustees for example through specific training or induction sessions; developing and maintaining information security procedures appropriate to the information systems in use (identified through risk assessment) and ensuring that access to or distribution of unsuitable material results in disciplinary action. 

Confidentiality 

RWoB offers a confidential service to the people it works with. It is therefore very important that all volunteers, staff and trustees are aware of their responsibilities with regards to confidentiality and how this can impact on their role. Having a confidential service means that no information regarding a member can be given directly (i.e. discussing a members personal details with another person) or indirectly (i.e. being overheard when discussing a service user’s personal information when in a public place) to any third party external to RWoB staff without the members consent to disclose such information. RWoB commits to ensuring staff, volunteers and members are aware of individual responsibilities in line with this Policy. Staff and volunteers agree to ensure confidentiality is maintained at all times, including meeting members outside of the normal RWoB environment. 

Therefore RWoB commit to ensuring wherever possible; 

• • No information about a member will be given, directly or indirectly, to anyone outside RWoB, without the user’s explicit consent. 
• • The fact that an individual has approached RWoB is itself confidential and will not be disclosed to anyone outside the agency without the individual’s consent. 
• • Everyone working in RWoB has a responsibility to ensure that information remains confidential. 
• • The contract of confidentiality is between the member and RWoB, not between the member and the individual worker. This enables volunteers and staff to discuss members cases on a ‘need-to-know-basis’ in the support process. 
• • If information disclosed by a member to a volunteer or staff member indicates that they are experiencing harm or harming others, the volunteer must disclose this information to the Development Manager immediately; in these circumstances the Development Manager has a legal obligation to breach confidentiality with a member. 

Any requests (informal or otherwise) for information about a member of staff, volunteer or member should be directed to [email protected] 

Who RWoB share data with 

We do not sell or share personal details to third parties for either fundraising or marketing purposes. 

RWoB will only share data with other organisations if given permission and will only do so if it is necessary in order to provide a service. The other organisations we may share information with include Bristol City Council, Bristol Refugee Rights, Borderlands, Ashley Housing, Red Cross, Bristol Hospitality Network (BHM) and Forward. 

The special category data provided will be used to monitor services and to report on the work RWoB are doing to our Trustees, Bristol City Council and other funders. It will not ever be used in a way that can identify individuals. 

Refugee Women of Bristol will not let other people see data without consent (written or verbal), unless we are required to by law or if there is a risk of serious harm or threat to life (see exceptions below). 

On occasion RWoB use third party suppliers to perform some services on our behalf (e.g Eventbrite or our payroll provider). In these circumstances we do not give these organisations any rights to use your information except to provide services to us in accordance with our instructions and any agreements we have in place. We take care to ensure that our third-party suppliers have appropriate policies and procedures in place to safely manage your data whilst working on our behalf. 

Refugee Women of Bristol will not keep information for longer than is necessary to provide its services. This will include keeping information if an individual stops using our services – this may be for things like providing references or for reporting to our funders. 

Exceptions 

The following are exceptions: 

• • Where it is considered that a disclosure must be made in accordance with our Safeguarding Polices 
• • In the course of dealing with a matter it becomes apparent that we need to communicate with an external organisation regarding a member. Express written permission will normally be sought from the member before doing so. If the member is to be present during the communication it may not be necessary to obtain written consent prior to contacting an external organisation however it is good practice to obtain consent and for it to be retained on file. 
• • Where it is considered that a disclosure is required by the Prevent Duty. 
• • Divulging information to relevant authorities which are investigating a criminal matter on receipt of a court order. 

Staff and volunteers are strongly encouraged not to share their own personal data, including contact details, with members. If any issues arise where a person, having given out personal information, does not feel comfortable they should inform the RWoB Development Manager. 

Links on our website 

The RWoB website may contain links to third party websites. These websites are responsible for their own data and privacy policies so individuals are asked to make themselves aware of their privacy policies before submitting any of personal information as RWoB do not accept any responsibility or liability for the privacy policies or data handling processes of others. 

Transmitting information over the internet 

Despite all precautions to protect the RWoB website and network no data transmission over the internet can be guaranteed to be 100% secure. So, whilst RWoB strive to protect personal information, we cannot guarantee the security of any of the information disclosed online and wish to draw attention that individuals do so at their own risk. RWoB Privacy Policy V1. April 2021 8 Date for review: April 2024. 

How long do RWoB keep data? 

RWoB store information for only as long as is necessary and/or legally required for the relevant activity. When information is no longer needed, it will be destroyed confidentially. 

If an individual requests that RWoB stop contacting them, a record of contact details and appropriate information will be stored to enable RWoB to comply with the request. 

How long does consent last? 

Consent remains valid for as long as an individual continues to receive a service from RWoB, remain employed or continues to volunteer or partner with us. Consent will be recorded. 

Rights to individual personal data 

Individuals have the right to request a copy of all the personal information that RWoB hold about them. If an individual would like a copy of some or all of their data they should submit a Subject Access Request (SAR) via email to [email protected], or write to Refugee Women of Bristol, Unit 35 Easton Business Centre, Felix Rd, Bristol BS5 0HE or alternatively speak to a member of staff. More information on this can be found on the ICO website. 

In order to provide a copy of all personal information held by RWoB an individual may be asked to prove their identity by providing two pieces of approved identification such as a copy of a passport, driving license or ID card. 

Individuals can ask RWoB to change anything that is wrong and can ask that RWoB delete some or all of their information at any time (although this may prevent RWoB from providing our services). 

Please send all initial requests via [email protected]. RWoB will respond within 40 days from receipt of your request and ID. We reserve the right to charge a fee of £10 for this process. 

Changes to this policy 

This policy was last updated in April 2021. RWoB may update the terms of this policy at any time. Individuals will be notified about any significant changes in the way we treat personal information by the main communication method provided to us by them or by placing a prominent notice on the RWoB website.  

This policy is scheduled for review in 3 years and this will be the responsibility of a representative nominated by the Trustees with the support of relevant staff. This policy will then be reviewed three yearly by the Trustees to ensure that it remains relevant and up-to-date. 

Cookies 

If an individual visits and uses our website, RWoB also collects information about how they use the site via an embedded visitor statistics package that comes with the hosting of our site. By using the site, an individual agrees to the use of these cookies. Please note that these cookie files and IP addresses will never identify an individual. 

Complaints or comments 

If you have any questions or concerns about this policy and our data protection practices or if you wish to file a complaint, please contact RWoB via [email protected] 

You also have the right to complain to the Information Commissioners Office (ICO) if you believe your personal data has been collected and used in a way that is not compliant with the GDPR. You can do so by calling the ICO helpline on 0303 123 1113 or using their website: https://ico.org.uk/make-a-complaint/