GDPR Policy

GDPR Policy

Policy, scope and objectives

The Board of Trustees and management of Woodside Animal Centre (RSPCA Leicestershire, Peterborough & Rutland Branch) located at 190 Scudamore Road, Leicester, are committed to compliance with all relevant UK and EU laws in respect of personal data, and to protecting the “rights and freedoms” of individuals whose information is collected in accordance with the General Data Protection Regulation (GDPR).

The policy applies to all employees and clients of Woodside Animal Centre such as outsourced suppliers. Any breach of the GDPR will be dealt with under Woodside Animal Centre Disciplinary Policy and could be deemed to be a criminal offence, in which case the matter will be reported as soon as possible to the appropriate authorities.

Partners and any third parties working with or for Woodside Animal Centre and who have or may have access to personal information, will be expected to have read, understood and to comply with this policy. No third party may access personal data held by Woodside Animal Centre without having first entered into a data sharing agreement which imposes on the third-party obligations no less onerous than those to which Woodside Animal Centre is committed, and which gives Woodside Animal Centre the right to audit compliance with the agreement.

Responsibilities under the General Data Protection Regulation

Woodside Animal Centre is a data controller under the GDPR. Top Management and all those in managerial or supervisory roles throughout Woodside Animal Centre are responsible for developing and encouraging good information handling practices within the organisation. The senior management team are accountable for the management of personal information within Woodside Animal Centre and for ensuring that compliance with data protection legislation and good practice can be demonstrated.

Data subjects’ rights

• Data subjects have the following rights regarding data processing, and the data that is recorded about them:
• To make Subject Access Requests (SAR) regarding the nature of information held and to whom it has been disclosed.
• To prevent processing likely to cause damage or distress.
• To sue for compensation if they suffer damage by any contravention of the GDPR.
• To take action to rectify, block, erase, including the right to be forgotten, or destroy inaccurate data.
• To request the ICO to assess whether any provision of the GDPR has been contravened.

Consent

Woodside Animal Centre understands ‘consent’ to mean that it has been explicitly and freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she by statement, or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her. The consent of the data subject can be withdrawn at any time.

Woodside Animal Centre understands ‘consent’ to mean that the data subject has been fully informed of the intended processing and has signified their agreement, while in a fit state of mind to do so and without pressure being exerted upon them. Consent obtained under duress or on the basis of misleading information will not be a valid basis for processing. There must be some active communication between the parties which demonstrate active consent. Consent cannot be inferred from non-response to a communication.

Consent also means that supporters, donors and the general public can register with the fundraising Preference Service to stop communications from charity marketing.
The Fundraising Regulator runs the Fundraising Preference Service so that people can request to stop direct marketing communications from charities registered in England, Wales and Northern Ireland.

If a charity gets a notification informing them that a person has made an FPS request, they should act to respect their wishes.

Data protection law gives a person the right to object at any time to use of their personal data for marketing purposes. This right is also reflected in the Code of Fundraising Practice, which sets the standards for UK fundraising.

If a charity does not take action to stop sending direct marketing communications within 21 days of receiving an FPS request, they are in breach of the FPS terms and conditions.
If they fail to act further, within 28 days of receiving an FPS request, the Fundraising Regulator consider them in breach of section 3.2.5 of the code and they will take regulatory action.

The FPS send notifications weekly. Employees are responsible for ensuring that if a notification is received the appropriate action is taken

Security of data

All Employees/Volunteers are responsible for ensuring that any personal data which Woodside Animal Centre holds and for which they are responsible, is kept securely and is not under any conditions disclosed to any third party unless that third party has been specifically authorised by Woodside Animal Centre to receive that information and has entered into an information sharing and confidentiality agreement. All personal data should be accessible only to those who need to use it, and must be kept:

• in a lockable room with controlled access; and/or in a locked drawer or filing cabinet; and/or
• if computerised, password protected
• stored on (removable) computer media which are encrypted

Care must be taken to ensure that PC screens and terminals are not visible except to authorised Employees/Volunteers.

Subject Access Requests

Data subjects have the right to access any personal data (i.e. data about them) which is held by Woodside Animal Centre in electronic format and manual records which form part of a relevant filing system. This includes the right to inspect confidential personal references received by Woodside Animal Centre and information obtained from third-party organisations about that person.

Disclosure of data

Woodside Animal Centre must ensure that personal data is not disclosed to unauthorised third parties which includes family members, friends, government bodies and, in certain circumstances, the Police. All Employees should exercise caution when asked to disclose personal data held on another individual to a third party and will be briefed on how to deal with such an instance. It is important to bear in mind whether or not disclosure of the information is relevant to, and necessary for, the conduct of Woodside Animal Centre’s business.

Retention and destruction of data

Personal data may not be retained for longer than it is required, and must be disposed of in a way that protects the “rights and freedoms” of data subjects (e.g. shredding, disposal as confidential waste in consoles provided or secure electronic deletion).

• Paper Records should be retained for the following periods at the end of which they should be shredded (by a GDPR compliant cross-cut shredder):
• Adoptees Records – 6 years after the adoption of an animal.
• Animal records – 6 years after leaving the Animal Centre.
• Unsuccessful intake applications – 3 month after application date.
• Successful intake applications – Will be removed immediately. The data will be removed from the computer system, however, the customer details would be left on the intake form, in case of any claims or prosecution regarding the animal.
• Staff records – 6 years after ceasing to be a member of staff.
• Unsuccessful staff application forms – 1 month after vacancy closing date.
• Volunteer records – 6 years after ceasing to be a volunteer.
• Timesheets and other financial documents – 7 years.
• Employer’s liability insurance – 40 years.
• Emails, all non relevant emails in (inbox, sent items, draft and deleted items) are to be deleted on the first of each month. All relevant items are to be kept in line with the above guidelines.
• Wunderlist entries, all completed tasks, must be deleted on the 1st of every month, this must be done by the owner of the individual list.

All data will be deleted from our computer systems or placed into confidential waste 1st of every month for monthly deletions.

Other documentation should be destroyed as soon as it is no longer needed for the task in hand.

Computerised records should follow the same timeframes and should be deleted from all systems at the destruction date. Computerised records should be stored securely with limited access and appropriate password protection.

Policy renewal

This policy will be reviewed annually and will be amended and re-issued if required.

Information Sharing Agreement (TEMPLATE)

This individual Agreement is made between:Woodside Animal Centre (RSPCA Leicestershire, Peterborough & Rutland Branch) and <Details of Organisation>

Introduction

Purpose for the sharing

Statement explaining why the sharing is necessary, objectives and benefits you hope to achieve.

Length of agreement

This agreement will commence at midnight on XX/XX/XXXX. This agreement will remain in place for XX (days/months/years/indefinitely) and will end on XX/XX/XXXX or until terminated by either party.

Key Contacts

Insert the names, roles and contact details (including telephone number and email address) of those who are involved in the sharing of the information.

Information Sharing

Type of information that may be shared

List in broad category terms the types of information that may need to be shared i.e. Basic personal data = name, address, date of birth etc.
Sensitive personal data = ethnic origin, health, criminal offences etc. Relationship data = next of kin, doctor etc.

How the information will be shared

The agencies should detail how and when the physical transfer of the data will take place including the necessary security measures in place. It is the responsibility of the sender to ensure that the method is secure and that they have the correct contact details for the receiver.

Recipients and other organisations that the information may be shared with

All organisations that will be involved in the sharing should be detailed, If the provider agency of the personal information wishes to place any additional restriction on the use of the information, these should be indicated here.

Retention and destruction

Detail any relevant retention periods and whether the information should be returned to the supplying partner or destroyed.

Data Security

Detail what security measures will be in place for the data, including both organisational and technical.

Review of Agreement

The agencies should detail how long the agreement is valid for and, if it is a rolling agreement, there should be a date to review its ongoing effectiveness. This agreement will remain in force irrespective of whether the agreement has been officially reviewed until a notice of termination is served.

Signatures

Name:
Position:
Charity Name: Woodside Animal Centre
RSPCA Leicestershire, Peterborough & Rutland Branch
Date:
Name:
Position:
Businss/Charity/Individual Name:
Date: