Privacy policy

Spurgeons works to support children, young people and their families towards a better present and a hopeful future. As a key part of this, the privacy, care and protection of our service users, employees and volunteers information is important in the work we do and the trust we share in working together.

This privacy notice will tell you about who we are, the information we collect, how we use that information and your rights around access to and decisions about that information. This notice is specifically to cover anybody who shares their data with us in order to use one of the services we deliver, whether that be directly through us or with one of our recognised partners. This service use may be a one-off visit or a longer programme of work.

We encourage you to read the notice carefully. If you need help with this, or have any questions or concerns about it, please speak with the Manager at your service, or contact Spurgeons on 01933 412412, or email.

Spurgeons delivers a wide range of services across England, often under contract with a funder or agency such as a Local Authority. The responsibility of your data may be shared between the data controller and the data processor, this is defined contractually by the commissioner.

Find out more about getting in touch with us at Spurgeons.

Address: 74 Wellingborough Road,
Rushden,
Northants,
NN10 9TY

Telephone: 01933 412412

If you have any questions about this Privacy Notice, please contact our Data Protection Lead, on 01933 412412.

3.0.1 Individuals who use our services
This section explains what information Spurgeons collects, keeps and stores about you and/or your family if you receive one of our services and your rights in regard to the data we keep about you. You may also be given information by your service about the information they keep about you and what happens to it.

3.0.2 What data do we collect?
Spurgeons will hold personal data about you which may include the following, depending on the support we are providing to you or your family:

• Name

• Demographic detail including date of birth, gender, ethnicity

• Contact details, including address

• Any relevant health needs e.g. pregnancy, disability or special educational needs, or wellbeing needs such as allergies

• Other agencies who might also be in contact with you, including where there is a support plan

• Attendance records

• Case notes (where we are providing a plan of work)

• Assessment records

• Measurement data identifying service impact or outcomes

• Other data specifically required of us as part of our contract or agreement with funders. We will notify you of these where they are not covered above.

• We may ask for feedback and comments around your experience of our service. These requests will be anonymous unless explicitly requested otherwise.

In many of our services there will be CCTV in operation. CCTV is used to keep Children, families and our staff safe. If you access one of those services where CCTV is in operation, notices will be displayed.

3.0.3 How do we collect data?
We will collect data through a combination of the following routes, depending on the service you are using:

• A referral form completed by another service or provider. This service should talk with you about this before sharing this data. This data will be limited to requesting a suitable service , an outline of what is needed, contact details and outline demographics including some sensitive data

• Service registers or signing-in sheets. Data from these relates to attendance and service usage

• Completion of a registration form with the service, or a self-referral

• Notes taken from conversations with you

• Information provided by other agencies (where relevant)

3.0.4 How do we use personal information?
We will only use your data for the reasons outlined below:

• Personalisation of service to enable us to best meed your needs

• To contact you and invite you to relevant meetings or services

• Internal monitoring and evaluation

• Legal obligations (e.g. safeguarding or children and / or vulnerable adults)

• Meeting internal audit and any monitoring requirements

3.0.5 Why do we collect information & the legal basis for processing your personal data?
To fulfil the delivery of the service being provided, Spurgeons may need to collect data about you that falls under special category data, this includes health related data, race & religion, ethnicity, sexual orientation, in such instances, Spurgeons will seek explicit consent from you during the initial collection and will process this data as contractually defined by the commissioning body . On occasion, we may have a legal basis under social protection laws, to hold your data where this is in the interest of protecting you or others from immediate harm.

3.0.6 When do we share personal data?
We may share your data with people who need to see it in order to provide you with a Service either within Spurgeons or to an external organisation, such as an agency for legal reasons i.e. court order for example. We will treat your personal data confidentially and will only disclose or share it when:

• Working in partnership with another organisations to provide you with the service. These organisations will be our data processors and will have agreements with us as to how we expect them to handle your data

• The local Authority who has commissioned Spurgeons to deliver its work

• You make a request to us to see the data we hold about you

• You or another person is at risk of immediate harm

• Another agency which may be able to provide more specific support to you. We will ask your prior consent to share your data if this arrangement is required.

There may be occasions when we will ask you for consent to use your data, for example; to help us inform the public about our work. If this is the case, we will explain to you exactly what your data will be used for. You can withdraw your consent at any time, and wherever possible, any of your data that has been used for publicity purposes will be deleted.

3.0.7 Who is responsible for your data?
Both the data controller and data processor have a responsibility to ensure the data we store on you is handled and processed with care. Depending on the contractual arrangements in providing the service, the responsibility may be shared between us and the commissioning body. For more information about data controllers and data processors, please refer to the ICO information sheet.

3.0.8 Where do we store, process and secure personal data?
The data you share with us will be held and processed within the United Kingdom and European Union. Any electronic systems where your data will be stored is secured through various mechanisms. We will assess the risk of any new method we apply and keep a documented record of this. Where data is of a sensitive nature we will apply encryption technology to avoid risks to your data and will adhere to the requirements as defined in the General Data Protection Regulation 2018.

3.0.9 How long do we keep your personal data for?
Spurgeons is required to keep your data for a specified period of time once we have finished working with you. Depending on the nature of the service and our legal obligations this will be a minimum of 6 years but can extend to 100 years for certain types of work. For a copy of our data retention policy schedule, please contact the Data Protection Lead for Spurgeons.

Once your data is no longer needed by Spurgeons it will be deleted from electronic systems, and any paper based materials securely shredded.

3.0.10 How can you access your data?
You may request a copy of the information that Spurgeons holds about you (see ‘The Right to access your personal information section’). There are times when the data we use about you is held by the Commissioner, such as a Local Authority, in this instance they may be responsible for providing you with the data they hold about you. This will be explained to you upon making request.

There may be some circumstances where your rights may be more limited. This would be in the instance that your request would expose the data of another person or where we are asked to delete data that is required to be kept for legal reasons.

Donating to Spurgeons

We value all our supporters and are grateful for the support they give to Spurgeons and in turn the families we support. We are members of the Fundraising Regulator’s scheme and align to its promise to be honest, respectful, fair, and accountable in all our fundraising. You can find more details about the full Fundraising Regulator Promise.

As a valued supporter of the work we do at Spurgeons, we will collect information about you. The information we collect is securely stored on our supporter database and is used for the purposes of processing, marketing and communications.  Information we may collect can include:

• Your name, postal address, email address and telephone number
• Financial data e.g. bank account
• A historic record of any donations that you have made including your tax status for Gift Aid purposes
• Details of any interest you have shown about our activities and your preferences in how Spurgeons is to communicate with you

For how we collect and process data through our website please see our website privacy notice.

We are committed to protecting your privacy and putting you in control of the data we hold about you. If you wish to change any of your marketing preferences, including, if you no longer wish to be contacted for marketing purposes; please email supportercare@spurgeons.org or telephone 01933 412412. Alternatively, you can write to us:

Engagement Team
Spurgeons
74 Wellingborough Road
Rushden
NN10 9TY

Building Profiles & Personalisation

As a charity organisation, fundraising is an important aspect of the activities we do. There will be times where we may analyse the data we hold about you for research purposes, such as your interests and preferences to help us tailor relevant communications about the areas of our work that are of most interest to you, such as the services we provide, events, potential fundraising campaigns and volunteering opportunities.

To achieve this we may also from time to time use profiling techniques by engaging with external parties, such as wealth screening organisations to provide us with general information about you, which you have volunteered and is available publicly through sources such as, Companies House, Electoral Register, public websites and social media platforms.

Ultimately this will help ensure we have a better understanding about you and the relationship you want with us. By doing so it could help us reduce our marketing and communication costs, meaning those savings can be redirected to support our work with children and families across the UK.

Your choice

You can opt-out of your data being used in this way. If you wish to opt-out, please contact our Engagement team on 01933 412412 or email us at supportercare@spurgeons.org. You can also write to us:

Engagement Team
Spurgeons
74 Wellingborough Road
Rushden
NN10 9TY

Please be assured, we will never pass on your personal information to other organisations for them to use for their own marketing purposes.

For further information on how we handle and process supporter data, please download our Fundraising Promise. To request a copy or have you have any queries please contact our Supporter Care Team on 01933 412412.

For further information on how we handle and process your data for Marketing purposes, please see our website privacy and cookie notice. To request a copy, or if you have any queries, please contact the Supporter Care Team on 01933 412412.

6.0.1 What data do we collect?
We will collect a range of information about you, which may include:

• Your name, address and contact details, including email address and telephone number;

• Details of your qualifications, skills, experience and employment history

• Information about your current salary;

• Whether or not you have a disability for which we need to make reasonable adjustments during the recruitment process;

• Information about your right to work in the UK

• Equal opportunities monitoring information, including information about your ethnic origin, sexual orientation, health, and religion or belief.

We will only collect this sensitive information with your explicit consent, which can be withdrawn at any time.

6.0.2 How do we collect data?
We collect data in a variety of ways, this can include a completed application form, or submitted CV. You will also be asked to provide a number of forms of identification, such as a passport details where a copy will be taken and evidence of your right to work in the UK

We may also collect information about you from third parties, such as references supplied by former employers. Spurgeons will only seek information about you from third parties once we have made you an offer.

6.0.3 Where will your data be stored?
Any personal information from your application will be stored, securely in our HR management system. Any paper based copies of information, is securely locked away and only accessible to appropriate individuals in the HR team.

6.0.4 Why do we collect information & the legal basis for processing your personal data?
We need to process your data in order to enter into a working agreement with you. In some cases we need to process your data to ensure we are complying with our legal obligations, such as checking an individual’s right to work in the UK.

Spurgeons has a requirement toprocess your personal data during the recruitment process and for keeping a record of progress. It allows us to manage that process, assess and confirm your suitability for the role and if an offer is to be made. We may also need to process data from job applicants to respond to any legal claims.

Spurgeons is relying on your explicit consent for processing such data.

We process health information if we need to make a reasonable adjustment to the recruitment process for the candidates who have a disability. This is to carry out our obligations and exercise specific rights in relation to employment.

Spurgeons is legally obliged to seek information about criminal convictions and offences – this is mandatory for paid employees, volunteers and Trustees. This is necessary to carry out our obligations for employment with Spurgeons.

6.0.5 How long do we keep your personal data for?
Personal information about unsuccessful candidates, and any associated interview notes, will be held for 6 months after the recruitment process has been completed. After the 6 month period, the data will be destroyed. Your consent is requested on the application form you complete.

For successful candidates, personal data gathered during the recruitment process will be transferred to a personnel file, and will be retained in accordance with our Retention Policy.

6.0.6 Who has access to your personal data?
To fulfil the requirements of the recruitment process your information will be shared internally with appropriate teams, including HR, recruiting managers and members of the interview panel.
As part of the recruitment process we may need to share your data with third parties in order to conduct any necessary background checks and vetting, such as contacting previous employers to obtain a reference; and/or the Disclosure and Barring Service to conduct criminal record checks. You will be informed which checks will be required, and at what stage of the process.

6.0.7 What if you do not provide personal data?
You are under no statutory or contractual obligation to provide data to us during the recruitment process. However, if you do not provide Spurgeons with the information requested, we may not be able to process your application.

You are under no obligation to provide information for equal opportunities monitoring purposes and there are no consequences to your application if you choose not to provide such information.

6.0.8 Automated decision making
Spurgeons does not use any automated decision making services in our recruitment processes.

Spurgeons collects and processes personal data relating to its staff, volunteers and Trustees.

7.0.1 What information do we collect?
Spurgeons collects and processes a range of information about you that is appropriate to the role you perform. This will vary depending on whether you are an employed member of staff, casual worker, volunteer, contractor, agency worker or student and may include:

• Your name, address and contact details, including email address and telephone number, date of birth and gender;

• Your image if you work in an office or service where CCTV is operation; or displayed on notice boards to provide information to service users. Where staff photos, including name and role is displayed on a notice board, the service will seek consent

• The terms and conditions relating to your employment contract

• Details of your qualifications, skills, experience and employment history, including start and end dates with previous employers

• Information about your salary, including entitlement to benefits such as pensions or death in service insurance cover;

• Details of your bank account and national insurance number;

• Information about your marital status, next of kin, dependents and emergency contacts;

• Information about your nationality and entitlement to work in the UK;

• Information regarding any criminal record;

• Relevant information if you drive a hire car, provided a company vehicle or your own vehicle for business purposes;

• Details of your schedule (days of work and working hours) and attendance;

• Details of periods of leave taken by you, including holiday, sickness absence, family leave and extended leave, and the reasons for any leave;

• Details of any disciplinary or grievance procedures in which you have been involved, including any warnings issued to you;

• Assessments of your performance, including appraisals, performance reviews, training you have participated in, performance improvement plans and any correspondence sent to you;

• Information about medical or health conditions, including whether or not you have a disability for which the organisation needs to make reasonable adjustments;

• Equal opportunities monitoring information, including information about your ethnic origin, sexual orientation, health and religion or belief;

7.02 How do we collect personal data?
Your personal information is collected in a variety of ways. This includes;

• An application form or CV;

• Passport details or other identity documents from forms completed by you during the recruitment process;

• Through interviews, meetings or other assessments and feedback questionnaires;

We may also collect information about you from third parties, such as recruitment agencies, references supplied by former employers, and information provided from any criminal records checks as permitted by law.

7.0.3 Where will your data be stored?
Any personal information that is held is securely stored. You information can be stored in:

• A personnel file (hard copy or electronic staff file);

• HR management systems and in other systems (including Spurgeons internal network and email system);

7.0.4 Why do we need your personal data?
Spurgeons needs to process your data to enter into a working relationship with you, and to meet our contractual obligations of employment. For example, if you are an employee we need to process your data to provide you with an employment contract, to pay you and administer any benefits.

In some cases, Spurgeons needs to process data to ensure that we are complying with our legal obligations. For example, it is required to check a worker’s right to work in the UK, to deduct tax, to comply with health and safety laws and to enable employees to take periods of leave to which they are entitled. It is also necessary to carry out criminal records checks in accordance to Spurgeons employment terms.

For legal and contractual employment purposes, Spurgeons will be required to process personal data before, during and after the end of the working relationship. Processing staff data will ensure Spurgeons can:

• Run its recruitment processes;

• Ensure effective general HR administration;

• Maintain and promote equality, diversity and inclusion in the workplace;

• Maintain accurate and up-to-date staff records and contact details (including details of who to contact in the event of an emergency), and records of contractual and statutory rights;

• Operate and keep a record of disciplinary and grievance processes, to ensure acceptable conduct within the workplace;

• Operate and keep a record of employee performance and related processes;

• Operate and keep a record of absences to allow effective management of the our workforce, and to ensure that employees are receiving the pay and other benefits to which they are entitled;

• Obtain occupational health advice to ensure compliance with duties in relation to individuals with disabilities in meeting our obligations under health and safety law by ensuring employees are receiving the sick pay or other benefits to which they are entitled;

• Operate and keep a record of other types of leave (including maternity, paternity, adoption, parental and shared parental leave); allowing effective management of the workforce, ensuring staff are receiving pay or other benefits to which they are entitled;

• Provide references on request for current or former employees;

• To respond to and defend against legal claims;

• To comply with our statutory and regulatory obligations

Some special categories of personal data, such as information about health or medical conditions, are processed in order to meet employment law obligations (such as those in relation to employees with disabilities and for health and safety purposes).

Where we process special categories of personal data, such as information about ethnic origin, sexual orientation, health or religion or belief, this is done for the purposes of employment, social security and social protection.

7.0.5 Who has access to your the data?
To ensure certain organisational process can be completed, certain information about you will need to be shared internally with teams, such as HR, Payroll, Facilities, relevant line manager(s) and other staff where it is necessary to comply in delivering organisational processes.

In order to obtain the necessary pre-employment checks and references, Spurgeons will share your data with relevant third parties, where applicable.

Spurgeons will also share personal data with third parties that have been instructed to process data on our behalf to provide services, such as Pensions and HMRC.

7.0.6 How long will your data be stored?
Spurgeons will hold your personal data for the duration of your employment with us. Due to the nature of the work that Spurgeons undertakes, and in order to meet our safeguarding obligations as defined by our insurers, some of your data may be held for up to 50 years.

To help support some of the key critical business systems, third-party suppliers are used. There may be times when a supplier will have access to some of your personal data that is stored on certain systems – however, this is only for the purposes of providing support to our key business systems. This arrangement is governed by our contractual agreements with those suppliers.
Third Parties are required to respect the security of your personal information and to treat it in accordance with the law. We do not allow our third-party providers to use your personal information for their own purposes, and only permit them to process your personal information for specified purposes agreed by Spurgeons.

We will not share any personal or financial information without your specific consent, unless required to do so by law.

We may be required to share your personal information with the following services or conditions:

• Insurers, solicitors, brokers, and loss adjusters

• Benefits providers

• Commissioners

• Other service providers to fulfil TUPE obligations

• HMRC

• Pension providers

• Those that process a Criminal Records Check

• Where we are duty bound to disclose or share your personal information in order to comply with any legal obligations, or to protect the rights, property, or safety of Spurgeons, our donors, beneficiaries or others. This could include exchanging information with other organisations for the purposes of fraud protection.

• Any potential organisational merger where assets, which will also include personal data, is required to be transferred
  We will keep your personal information confidential, and where we provide it to other third parties we will only do so under contract, on conditions of confidentiality and security, and only for the purposes for which you have provided your information to us.

Spurgeons places a high importance on keep your personal information safe. Internal policies, strict controls and appropriate technology solutions are in place to ensure personal data is safely stored and handled. These controls employed by Spurgeons are there to reduce the risk of data being lost, misused, destroyed or disclosed.

Our IT platforms which may store your data is located in a G-Cloud approved Data Centre/Cloud Provider that complies to ISO 27001 standards. We work closely with our technical partners to ensure that all your personal information remains secure.

Some platforms, such as our website and social media may contain links. We cannot guarantee the security of any personal data you post to any public area of the website or social media platforms. Posting to these areas can result in information can be read, collected or used by others. Spurgeons will not be held responsible for any breach of data individuals post to these areas.

Under the General Data Protection Regulation 2018, you have the following rights:
a. The right to be informed
b. The right of access
c. The right to rectification
d. The right to erasure
e. The right to restrict processing
f. The right to data portability
g. The right to object
h. Rights in relation to automated decision making and profiling.

If you wish to exercise your rights, please contact us, providing as much information as possible about the nature of your contact with us to help us locate your records. Any changes you have requested may take 30 days before they take effect.

10.0.1 Right to access your Personal Information
You have a right to access your personal data. By making a subject access request (SAR) to Spurgeons, you can find out what personal data we hold about you, why we hold it and who we disclose it to. You must make a subject access request in writing, and include proof of your identity.

Email: gdpr@spurgeons.org
Or write to:
Ray Mirkovic
Head of IT & Systems
Spurgeons
74 Wellingborough Road
Rushden
Northants
NN10 9TY

Once we have received your request, and verified your identity, we will respond to you within 30 days.

10.0.2 The Right to edit and update your personal information.
You can edit your personal information such as your address and contact details at any time.

10.0.3 The right to have your personal information deleted.
You have the right to request the deletion of your personal data.

10.0.4 The right to restrict processing of your personal data.
You have the right to place a hold on the processing of your personal data. Please note – your data will still be stored but will no longer process it.

10.0.5 The right to object
You have the right to object to your personal information being processed for marketing (including profiling) and for research purposes. From the very first communication from us and every marketing communication we send after you will have the right to object to marketing. Alternatively, you can exercise this right by contacting the Supporter Relations Team below. Please address requests to

Email: gdpr@spurgeons.org
Or write to:
Ray Mirkovic
Head of IT & Systems
Spurgeons
74 Wellingborough Road
Rushden
Northants
NN10 9TY

If we process your personal information for legal reasons, or we can demonstrate compelling grounds that override your rights and freedoms we may not be able to fulfil your request. However, we will contact you to discuss further.

10.0.6 Your right to lodge a complaint with supervisory authority
If you wish to lodge a complaint or seek advice from a supervisory authority you can contact the Office of the Information Commissioner (ICO) on their helpdesk number 0303 123 1113, or by post:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Website: www.ico.org.uk