This Privacy Notice sets out how Kingston Voluntary Action (KVA) obtains, stores and uses personal data and information and complies with UK Data Protection laws.
Personal data includes any information which can be used to directly or indirectly identify an individual e.g. address or date of birth.
Last updated: June 2024
INFORMATION ABOUT YOU
KVA currently collects and processes personal data on our staff, trustees and volunteers, along with our service users – the staff, trustees and volunteers of organisations accessing our services or that we work in partnership with, as well as individuals in the community who are direct beneficiaries of our work.
We collect contact information which may include your name, title, email address, physical address, telephone numbers and job titles to enable us to provide our services. We sometime collect additional characteristics (including special category data such as your ethnic group, age or health condition) so we can ensure services are accessible and tailored to individual needs, and for which we will gain your explicit consent.
Depending on who you are, data collection may include, but is not limited to, information provided when you enquire about our activities, register as a member with us, subscribe to one of our services, attend our activities and events, receive advice or support from us, apply for a job or volunteering opportunity.
HOW WE PROCESS YOUR DATA
KVA will process your personal data in accordance with its Data protection and confidentiality policy, complying with UK Data Protection Law which includes the Data Protection Act 2018, The UK General Data Protection Regulation (UK GDPR) and the Privacy and Electronic Communications Regulation (PECR).
In accordance with these laws, KVA is a Data Controller and therefore responsible for the processing activities.
Such information must be processed in accordance with the principles of the UK GDPR which include;
- Processed fairly and lawfully
- Obtained and used only for specified purposes
- Relevant to the purposes for which it is processed
- Accurate and kept up to date
- Not kept for longer than is necessary
- Protected against unauthorised processing, accidental loss or damage
USE OF YOUR INFORMATION
Your personal data will only be processed by KVA where we comply with at least one of the six legal bases for processing data.
- Your consent. You are able to remove your consent at any time. You can do this by contacting admin@kva.org.uk
- We have a contractual obligation
- We have a legal obligation
- We have a vital interest
- We need it to perform a public task
- We have a legitimate interest
The majority of KVA’s data processing is carried out under Legitimate Interests. The purpose of our data processing in this instance may include, but is not limited to, responding to your requests, providing you with KVA’s services, providing you with information relating to KVA’s services and other services which we think you may be interested in, improving our services and general record-keeping for the proper and necessary administration of our organisation and funded programmes.
Where we collect special category data, for example in some of our community health programmes, we will additionally gain consent and take extra precautions to keep this data safe.
KVA will NOT share your personal data with its partners, funders and other organisations without your consent, unless it has a professional or legal obligation to do so.
Further information about the purposes for which we process your data and the range of online systems we use are outlined below. We carry out due diligence checks on any digital systems used and will provide links to their privacy policies and let you know when your data is stored outside of the EU, where adequacy conditions currently govern transfer of data from the UK.
E-BULLETINS
We use Mailchimp as our provider when sending out our e-bulletins and ask for your consent to be added to our mailing list. Personal data will be stored in the United States – you can find out more about Mailchimp’s privacy policy here. Messages you receive from us may be trackable at an individual level, allowing us to determine, for example, opens and link clicks. This information is generally used by us to help assess the effectiveness of our communications so that we can improve them and may occasionally be used to send relevant further communications in response to your actions (e.g. opening an email) or your inaction (e.g. not opening an email).
OTHER MAILINGS
If you access our services we may also send targeted relevant mailings via Microsoft Outlook or other systems we use (see CRM information below). We may also ask for consent to add you to specific mailing lists e.g. if you sign up to one of our networks. You will be given the option to ‘opt in’ for each individual mailing list and we shall be clear about what communication you will receive for this. You will always have the option to opt out in the future.
WEBSITES
Our websites (www.kva.org.uk; www.superhighways.org.uk and www.kingstoneco-op.org.uk) are built on the Voice platform. You can find out further information about Voice’s use of Cookies and their Privacy policy. We collect some general enquiries via a Voice web form, where submission data is securely emailed to us, and use this data to get back to you on your registrations or queries.
If cookies are used, they will only be used to assist the purposes set out in this Privacy Policy, but cookies will not be used if KVA does not consider them to be necessary.
TRAINING AND EVENT ADMINISTRATION
We use Eventbrite and AIDE CRM (see below) to administer bookings for our events and training sessions. Find the Eventbrite Privacy policy here. We also use Microsoft 365 Forms and Airtable for sign ups to specific projects and events.
PHOTOS, AUDIO AND VIDEO
We may take photos at public networks, forums and training sessions and use to post on social media or in our other communications including our e-bulletins, website and annual reviews. We will ask for verbal consent before doing so. We will display clear signage explaining that we are capturing the event with photo/video/audio and explain how to opt out of this and who to speak to.
We also sometimes take audio or videos from beneficiary organisations or individuals to showcase our own impact or raise awareness of specific campaigns. In these cases we have a media consent form which we will ask individuals to agree to and sign.
MONITORING AND EVALUATION
KVA maintains two membership and support databases: Simply Connect and AIDE CRM. These store some basic contact information along with services accessed and support provided to organisations and individuals. For further information see AIDE CRM’s privacy policy.
We also use online forms and survey tools (currently Survey Monkey or Microsoft 365 Forms) to collect feedback about our services or to provide evidence of need. These are usually completed anonymously, but we sometimes ask for an email address so we can contact those who have requested follow-ups including further support or training. Read more about Survey Monkey’s privacy & security policies.
When sharing back with funders, we usually anonymise data unless we have gained consent from you in advance.
EMPLOYEE AND VOLUNTEER SYSTEMS
If you are a KVA employee or volunteer, we will process your data in additional ways e.g. to pay your salary, report to HMRC and to perform a DBS check. See your Employment contract, Volunteer agreement and the KVA Data protection and confidentiality policy for further details.
DATA RETENTION
We endeavour to keep all information up-to-date and accurate, but can always use help. If you move job or change your email address, please let us know.
We keep your personal data for as long as necessary for the purpose we collected it for. We will dispose of any personal data by either shredding and secure disposal (paper records) and full deletion / disk wiping (electronic records held in online systems or on KVA devices).
DATA SECURITY
KVA takes preventative measures to the best of our ability and in line with best practice to keep your data safe – preventing the loss, misuse or alteration of information you give us.
We have policies and procedures to ensure that only those with authorised access have the permissions and ability to access the personal data that we hold.
We will never sell your details to a third party and shall only share your information with other organisations if you give us your consent. For example, if everyone who is part of a specific network wishes to share their details with other group members, and gives their consent for this.
YOUR RIGHTS
Data Subject Rights
All individuals have data subject information rights which include:
- The right to be informed about the processing activities. We will endeavour where we are obliged to do so, to inform you of our intended processing activities that concern your personal data, accept where we have a legal obligation to process your data
- The right to access your personal data in certain circumstances. All requests to access data will be dealt with in accordance with the Information Commissioners Office (ICO) guidance.
- The right to ask us to rectify your personal data if you think it is inaccurate or incomplete
- The right to object to the processing of your data e.g. in certain circumstances you may ask us to restrict the processing of your data, for example if you believe there is an inaccuracy.
- The right to ask us to transfer your data to yourself or another organisation in a portable format
- The right to question solely automated decisions made about you although KVA does not currently undertake such processing.
- The right to ask us to erase your personal data. We may not be able to erase certain categories of data processed where we have a legal obligation and if we delete your personal data we may no longer be able to provide you with our services.
You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.
Please contact us at admin@kva.org.uk to make a request if you would like KVA to correct or update any information, or if you would like to access the information we hold on you or be deleted from KVA’s records.
HOW TO COMPLAIN
If you have any concerns about our use of your personal information, you can make a complaint to us at:
Kingston Voluntary Action
Siddeley House
50 Canbury Park Road
Kingston upon Thames
KT2 6LX
Email: admin@kva.org.uk
Tel: 020 8255 3335
Web: www.kva.org.uk
Charitable Incorporated Organisation No: 1160403
You can also complain to the Information Commissioner’s Office if you are unhappy with how we have used your data.
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
ICO website: https://ico.org.uk/make-a-complaint
You can download a PDF version of this Privacy Notice, here.