Who are we?

Lincolnshire YMCA Ltd is a Lincolnshire based charity (registered charity number 243017) that enables people to develop to their full potential in mind, body, and spirit.

Our registered address is: YMCA Lincolnshire, St Rumbold’s Street, Lincoln, LN2 5AR. You can contact us by calling 01522 508 360 or by emailing admin@lincsymca.co.uk.

If you have any questions about this policy, or about how we look after your data generally, please contact Human Resources on 01522 508 383 or email hr@theshowroom.org.uk.

Introduction

Lincolnshire YMCA Ltd (‘we’ or ‘us’ etc), is a ‘data controller’. This means that, under General Data Protection Regulation (GDPR), we may control and process your personal data and, in certain circumstances, special categories of data (previously known as sensitive data).

We take privacy very seriously. We are committed to keeping your data secure and processing it fairly and lawfully. We ask that you read this policy very carefully because it contains important information about how we process your personal data.

This policy is aimed at our clients, service users, staff, volunteers, and any other third parties interacting with us.

Personal data we may collect about you

We may collect and store information about you whenever you interact with us. For example, when you make a donation, submit an enquiry, apply for a job or volunteering opportunity, or otherwise provide us with any of your personal information.

Personal information means any information about you from which you can be identified, but it does not include information where your identity has been removed (anonymous data).

As the ‘controller’ of personal information, we are responsible for how that data is managed. The General Data Protection Regulation (“GDPR”), which applies in the United Kingdom and across the European Union, sets out our obligations to you and your rights in respect of how we manage your personal information.

As the ‘controller’ of your personal information, we will ensure that the personal information we hold about you is:

1. used lawfully, fairly and in a transparent way;

2. collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes;

3. relevant to the purposes we have told you about and limited only to those purposes;

4. accurate and kept up to date;

5. kept only as long as necessary for the purposes we have told you about;

6. kept securely.

Information collected by us

The types of information we might collect from you include, but are not limited to, your name, contact details, next of kin, and information of a medical and sensitive nature.

When you enquire or interact with one or more of our services, we collect some or all of the following personal information when you provide it to us:

• your name, home address, date of birth, and contact details (including your telephone number and email address) and emergency contacts (i.e. name, relationship and home and mobile numbers);

• your health and social care information, including allergies and any medical, physical or mental health conditions and medications;

• credit or direct debit details (if you donate or pay for some or all of our services using one of these methods);

• photographs and video material of you as part of providing you with suitable care, but always with your specific consent;

• photographs and video material on our premises through the usage of CCTV for the safety and protection of everyone using our facilities.

We collect information from you in the following ways:

When you interact with us directly: This could be if you ask us about our services, register with us for training or an event, make a donation to us, apply for a job or volunteering opportunity, or otherwise provide us with your personal information. This includes when you phone us, visit our website, make a purchase from our shops, and get in touch through the post or in person.

When you interact with us through partners or suppliers: This could be if you access a service such as Lincolnshire Employment Accommodation Project (LEAP) which is delivered through a trusted organisation working alongside us to reach a common goal.

When you interact with us through third parties: This could be if you provide a donation through a third party such as Just Giving and provide your consent for your personal information to be shared with us.

When you visit our website: We gather general information which might include which pages you visit most often and which services, events, or information is of most interest to you. We also use "cookies" to help our site run effectively. There are more details below – see 'Cookies'.

We use this information to personalise the way our website is presented when you visit, to make improvements and to ensure we provide the best service and experience for you. Wherever possible we use anonymous information which does not identify individual visitors to our website.

How we use your personal data

We use your personal information to:

• To process your donations or other payments, to claim Gift Aid on your donations, and verify any financial transactions;

• To provide the services or goods that you have requested;

• To update you with important administrative messages about your donation, an event, or services or goods you have requested;

• To keep a record of your relationship with us;

• Where you volunteer with us, to administer the volunteering arrangement;

• To contact you about our work and how you can support YMCA Lincolnshire (see the 'Marketing and Opting Out' section below for further information);

• To communicate with you, your representatives, and any appropriate external social or health care professionals about your individual needs and personalise the service delivered to you;

• To invoice you for support services in accordance with our terms and conditions;

• To invoice you for training services in accordance with our terms and conditions;

• To inform you of course details or update you with course materials;

• To inform you of offers, discounts and further courses that may support your learning;

• To comply with the Charities (Protection and Social Investment) Act 2016 and follow the recommendations of the official regulator of charities, the Charity Commission, which require us to identify and verify the identity of supporters who make major gifts so we can assess any risks associated with accepting their donations;

• To carry out quality assurance procedures, review our service, and improve our customer experience (please note that feedback can also be provided anonymously);

• As part of our legal and safeguarding obligations we may share information with regulatory bodies.

In addition, we may use your personal data for the following circumstances:

• Where we consider it necessary to be in your vital interests;

• Where we are legally required to do so, such as because of a contractual obligation owed to a third party, such as a commissioning body;

• For the purposes of assessing your application for services;

• Administration;

• Research, statistical analysis, and behavioural analysis;

• Direct marketing (where you have specifically consented);

• Fraud prevention and detection;

• Taking and processing payments;

• Customising our website and its content to your particular preferences;

• To notify you of any changes to our website or to our services which may affect you;

• Security vetting;

• Improving our services.

Service users

We may also share your personal information, including medical information, with appropriate external social or health care professionals and any individuals you have nominated as your representative. This data sharing enables us to establish the type of care and support you need. It also allows us to design the right care package to suit your individual circumstances, including if (in future) you decide to receive care from an alternative provider.

Marketing and opting out

As a registered charity we rely heavily on the ability to communicate with our supporters.

With that in mind, we would like to send you information that may be of interest to you and may help to further our charitable aims. By communicating with you in this way we aim to keep you up to date about how we spend your donations, provide you with news, updates, and/or information about our latest developments.

We will only contact you about our work and how you can support YMCA Lincolnshire by phone, email. or text message, if you have specifically agreed for us to contact you in this way.

If you have provided us with your postal address we may send you information about our work and how you can support YMCA Lincolnshire by mail, unless you have told us that you would prefer not to hear from us in that way.

You can opt-out to receiving communications from us at any time with no hassle. To do this, click ‘unsubscribe’ at the bottom of the relevant communication, or get in touch via email hr@theshowroom.org.uk or phone 01522 508 383.

Alternatively, you can write to us at the following postal address:

Marketing,
YMCA Lincolnshire,
The Showroom,
Tritton Road,
Lincoln,
LN6 7QY

Who has access to your personal information?

We will not sell or rent your information to third parties and we will not share your information with third parties for marketing purposes.

Third Party Service Providers working on our behalf: We may pass your information to our third party service providers, agents, subcontractors, and other associated organisations for the purposes of completing tasks and providing services to you on our behalf. They include, but are not limited to, SCS Technology Solutions, Sage 200, and Salesforce International.

When we use third party service providers, we disclose only the personal information that is necessary to deliver the service and we have a contract in place that requires them to keep your information secure and not to use it for their own direct marketing purposes.

Please be reassured that we will not release your information to third parties for them to use for their own direct marketing purposes, unless you have requested us to do so, or we are required to do so by law. For example, by a court order or for the purposes of prevention of fraud or other crime.

We may transfer your personal information to a third party as part of a sale of some or all of our business and assets to any third party or as part of any business restructuring or reorganisation. We may also transfer your personal information to a third party if we’re under a duty to disclose or share your personal data in order to comply with any legal obligation, or to enforce or apply our terms of use or to protect the rights, property, or safety of our supporters and customers. However, we will take steps with the aim of ensuring that your privacy rights continue to be protected.

If you would like to view our Supplier’s Data Agreement or a list of third party service providers YMCA Lincolnshire uses, please get in touch via email or post.

Keeping your data secure

We will use technical and organisational measures to safeguard your personal data, for example:

• Access to our systems is controlled by password and username which are unique to the user;

• We store your electronic personal data on secure servers;

• We store your paper records in locked storage rooms fitted with fire doors;

• We train our staff in good records management;

• Payment details are encrypted

Non-sensitive details (your contact details and preferences for example) are transmitted normally over the Internet, and this can never be guaranteed to be 100% secure. As a result, while we strive to protect your personal information, we cannot guarantee the security of any information you transmit to us, and you do so at your own risk.

Once we receive your information, we make our best effort to ensure its security on our systems. Where we have given (or where you have chosen) a password which enables you to access certain parts of our websites, you are responsible for keeping this password confidential. We ask you not to share your password with anyone.

Transferring your information outside of Europe

We may store your data temporarily on our cloud service operated by Microsoft. This may include limited special categories of data. We have taken appropriate steps to satisfy ourselves that your data will be secure during this process; we have a contractual relationship with Microsoft that underpins this.

As part of that security, Microsoft may store your data in one or more or its international data centres, meaning that your data may be stored temporarily outside of the European Economic Area. If you have any concerns about this, please contact us using the details in the “Your Rights” section below.

Information about other individuals

If you give us information on behalf of someone else, you confirm that the other person has appointed you to act on his/her behalf and has agreed that you can:

• Give consent on his/her behalf to the processing of his/her personal data

• Receive on his/her behalf any data protection notices

How long do we keep your data for?

We will not keep your data for any longer than is necessary to complete tasks or provide you with services.

We have a separate policy setting out retention periods for specific types of data, for example information relating to safeguarding.

You can ask to see this policy by writing to us using the contact details under the “Your Rights” section below. You also have the right to ask us to delete your data (sometimes known as ‘the right to be forgotten’.)

Cookies

A cookie is a small text file which is placed onto your computer (or other electronic device) when you access our website. If you use our website, we may use cookies to:

• Track your use of the site;

• Recognise you whenever you visit this website (this speeds up your access to the site as you do not have to log on each time);

• Obtain information about your preferences, online movements, and use of the internet;

• Carry out research and statistical analysis to help improve our content, products, and services and to help us better understand our visitor/customer requirements and interests;

• Target our marketing and advertising campaigns more effectively;

• Make your online experience more efficient and enjoyable.

If you do not want to accept cookies, you can change your browser settings so that cookies are not accepted. If you do this, please be aware that you may lose some of the functionality of our website. For further information about cookies and how to disable them please go to: www.aboutcookies.org or www.allaboutcookies.org.

If you visit our website when your browser is set to accept cookies, we will interpret this as an indication that you consent to the use of cookies. This includes cookies that are essential in order to enable you to move around the site and use its features, as well as cookies that are not essential but gather information about your use of the site.

If you want detailed information from Get Safe Online on how to protect your information and your computers and devices against fraud, identity theft, viruses and many other online problems, please visit www.getsafeonline.org. Get Safe Online is supported by HM Government and leading businesses.

Your rights

You have various rights under GDPR, including the following:

• Right to object: If we are using your data because we deem it necessary for our legitimate interests to do so, and you do not agree, you have the right to object. We will respond to your request within 30 days (although we may be allowed to extend this period in certain cases). Generally, we will only disagree with you if certain limited conditions apply.

• Right to withdraw consent: Where we have obtained your consent to process your personal data for certain activities (for example, providing you with services), or consent to market to you, you may withdraw your consent at any time.

• Data Subject Access Requests (DSAR): You have the right to ask us to confirm what information we hold about you at any time, and you may ask us to modify, update, or delete such information.

• Right to erasure: In certain situations (for example, where we have processed your data unlawfully), you have the right to request us to "erase" your personal data. We will respond to your request within 30 days (although we may be allowed to extend this period in certain cases) and will only disagree with you if certain limited conditions apply.

• Right of data portability: If you wish, you have the right to transfer your data from us to another data controller. We will help with this, either by directly transferring your data for you, or by providing you with a copy in a commonly used machine-readable format.

• Right to lodge a complaint with a supervisory authority: You also have the right to lodge a complaint with your local supervisory authority, details of which can be found below.

To exercise any of your rights concerning your information, please send an email to the following address: hr@theshowroom.org.uk

Or write to us at the following postal address:

Human Resources,
YMCA Lincolnshire,
The Showroom,
Tritton Road,
Lincoln,
LN6 7QY

We may ask you to provide us with proof or your identity. Please do not be offended. This may occur even if we know you. It is a requirement of the GDPR in some cases.

Review

This Policy was last reviewed on 25th May 2018.

We may change this privacy policy from time to time. You should check this policy occasionally to ensure you are aware of the most recent version which will apply each time you access our website.

The information commissioner’s office

More information about privacy laws can be found at www.ico.org.uk.

Details of your local supervisory authority: The Information Commissioner's Office. You can contact them in the following ways:

• Phone: 0303 123 1113

• Email: casework@ico.org.uk

• Live chat: via the ICO website

• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF