- About this policy
- Why we collect your data
- Information we collect
- Using your personal data
- Applying for a job or voluntary position with Wanstead and Woodford Migrant Support
- Our legal basis for processing personal data
- Disclosure of your personal data
- Security of your personal data
- Transfer of data outside of the EEA
- Retention of your data
- Your rights
- Contact us
About this policy
Wanstead & Woodford Migrant Support provides advice and support to migrants with immigration, housing and other support needs.
When doing this, we process personal data about people who receive advice, guidance or support services from us – or provide us with support through donations or volunteering. We are committed to protecting your privacy and take this responsibility very seriously. We therefore take care to safeguard it. This notice outlines what data we collect, how we may use it, how we protect your data and your rights, and how you can exercise those rights.
References to ‘we’ or ‘us’ are to:
Wanstead and Woodford Migrant Support, registered charity number 1172757, based at Broadmead Baptist Church, 357 Chigwell Road, Woodford Green, IG8 8PE.
- We regularly check this notice to ensure we provide you with the most up-to-date information regarding our data processing activities. We strongly advise you to read this page from time to time to ensure you are happy with any changes that might be made.
If you have any questions about this policy, please contact us using the contact details at the end of this notice.
Why we collect your data
We collect personal data for many reasons, including to provide you with services, communicate with you and send you information you have requested, and administer donations. Depending on how you interact with us, we may process data for the following reasons:
- to provide you with advice, support or legal services that you have requested or been referred to
- to administer services WWMS is providing to you
- to communicate with you regarding our work and fundraising activities
- to process donations and administer Gift Aid information for any donation you make to WWMS
- to provide you with information about and to administer events
- to administer and send you information about our legacy programme
- for our own internal administrative purposes, and to keep a record of your relationship with us
- to manage your communication preferences
- to process job applications or volunteer placements
- to conduct surveys, research and gather feedback
- to obtain information to improve our services and user experiences
- to address and resolve complaints about WWMS and our services
- to carry out research to find out more information about our supporters’ and prospective supporters’ backgrounds and interests
- to comply with applicable laws and regulations, and requests from statutory agencies
- to comply with our contractual obligations to our funders
Information we collect
We collect the following personal information:
- your full name and date of birth
- contact details – including your postal address, telephone number(s), and email address
- details of your case when providing you with immigration or housing advice or services
- your bank details
- records of your correspondence and engagement with us
- donation history and Gift Aid details
- information you may enter on the WWMS website
- other information you share with us. This information may be collected via:
- any paper forms you complete
- telephone, webchat or email conversations, or face-to-face interactions
- digital forms completed via our website, or online surveys
- third-party companies and websites such as Just Giving
- publicly available sources
- communication via social media
We sometimes also collect sensitive, personal data about individuals. This includes information about health, religion, sexuality, ethnicity, political and philosophical beliefs, and criminal records. We will normally only record this data where we have your explicit consent, unless we are permitted to do so in other circumstances under data protection law. For example, we may make a record that a person is in a vulnerable circumstance to comply with requirements under charity law and the Code of Fundraising Practice, to ensure that we do not send fundraising communications to them.
Where we are providing you with advice or support services, we may record your sensitive personal data if this is necessary for the establishment, exercise or defence of legal claims, or if it is in the substantial public interest because we would not be able to provide our services without doing so.
Using your personal data
If you are receiving advice or support from us, or if someone else has referred you to us for such a service, we will need to process your data because of your specific relationship with us.
We will keep all your relevant personal information – including notes, letters, emails and information given to us about you – in a confidential record that is specific to you. We use electronic and paper records to support our advice and support services. This means that we can keep the information you provide us, so we are able to see the history and relevant details of your case(s). This ensures that we provide appropriate and accurate advice or support. We take information security very seriously. No one is allowed access to our system or files unless they need this to provide the service to you, or for one of the other purposes discussed in this notice.
We may need to disclose and discuss your personal information to third party individuals or organisations if this is necessary to help resolve your issue. Examples include:
- The Home Office
- The Immigration and Asylum Chamber
- Your local council
- your GP or medical professionals
- legal representatives or advisers
- social services
We will discuss this with you as we go along, and will only act with your express consent unless one of the other legal bases in data protection legislation applies.
Files may be checked by the Office of the Immigration Services Commissioner, which regulates the provision of immigration advice, for audit purposes.
Files may also be checked by external auditors if the work we do is funded by another organisation. All auditors are bound by confidentiality policies.
Where our funders require it as part of a funding agreement, we may use your data in reports to them. Typically, this is so that they can monitor the outcomes of the help we have provided to you, to ensure we are meeting the terms of our funding agreement.
We may use your data for general statistical reports. These statistics will not include any information that could be used to identify any individual.
We would like to keep supporters up to date with our fundraising activities.
We may contact our supporters via our website, face-to-face, direct mail, text message, email, and telephone.
We will obtain your consent to contact you by email and text message for fundraising purposes.
We may send the following marketing materials:
- updates about our work
- appeals and fundraising activities
We will never share or sell your personal data to a third-party organisation for its marketing, fundraising or campaigning purposes.
You can withdraw your consent, unsubscribe from or update your marketing preferences at any point using the contact details below.
Any electronic communications, such as emails, will have a link to unsubscribe from future electronic communications, so you can manage your own communication preferences.
If you make any changes to your consent, we will update your record without undue delay and at the latest within one month of receipt.
Administrative communications to supporters
In addition to the fundraising and marketing communications that you receive from WWMS, we will also communicate with you by post, telephone, and email in relation to administrative and transactional matters. For example, we will call you after you have set up a Direct Debit to confirm your details, and upon cancellation. There may also be other occasions where we need to contact you about your donation – for example, if there is a problem with a payment or in relation to your gift aid declaration.
On occasion, we will also contact you about an event that you have signed up to participate in, to – for example – to check that fundraising pages have been set up and to provide any other necessary information.
We may still need to communicate with you for administrative purposes even where you have opted out of marketing communications from us.
Applying for a job or voluntary position with Wanstead & Woodford Migrant Support
When you apply for a job or voluntary position with us, your personal data will be collated to monitor the progression of your application. Where we need to share your data – such as for gathering references or obtaining a Disclosure and Barring Services clearance – you will be informed beforehand, unless the disclosure is required by law. These checks are only done after a position has been offered only to the successful candidate. On the application form, you are asked to complete the referee details, and can tick permission to contact referee. If tick yes, once offered a role, we will automatically send out reference requests. If you tick no, we will contact successful candidates for permission first.
Personal data about unsuccessful applicants are held for 12 months after the recruitment exercise is complete for that vacancy. You, as an applicant, can ask us to remove your data before this time if you do not want us to hold it.
Once you have taken up employment with WWMS, we will compile a file relating to your employment. The information contained in this will be kept secure and will only be used for purposes directly relevant to your employment. Once your employment with us has ended, we will retain the file in accordance with the requirements of our retention schedule and then delete it from our files.
Our legal basis for processing personal data
We need a lawful basis to collect and use your personal data under data protection law. The law allows for six ways to process personal data (and additional ways for sensitive personal data). Three of these are relevant to the types of processing that we carry out. This includes information that is processed on the basis of:
- a person’s consent (for example, to contact you directly by email or SMS)
- processing that is necessary for compliance with a legal obligation (for example to process a Gift Aid declaration, and carrying out due diligence on large donations)
- Our legitimate interests (please see below for more information)
Personal data may be legally collected and used if it is necessary for a legitimate interest of the organisation using the data, if its use is fair and does not adversely impact the rights of the individual concerned.
When we use your personal information, we will always consider if it is fair and balanced to do so and if it is within your reasonable expectations. We will balance your rights and our legitimate interests to ensure that we use your personal information in ways that are not unduly intrusive or unfair. Our legitimate interests include:
- Charity Governance: including delivery of our charitable purposes, statutory and financial reporting and other regulatory compliance purposes
- Administration and operational management: including responding to solicited enquires, providing information and services, research, events management, the administration of volunteers and employment, and recruitment requirements
- Fundraising: including administering donations and sending thank you letters
If you would like more information on our uses of legitimate interests, or to change our use of your personal data in this manner, please get in touch with us using the contact details below.
Disclosure of your personal data
We will not share any of your personal data with any third party – except where:
- we are required to do so by law, for example to law enforcement or regulatory bodies where this is required or allowed under the relevant legislation
- we are required to do so because it is a condition of our funding or service provision that we share certain information with the funder or with partnership organisations. We will tell you if this is the case.
- it is necessary to protect the vital interests of an individual
- we have obtained your consent
We will never share or sell your personal data to a third-party organisation for marketing or fundraising.
Security of your personal data
We use appropriate technical and organisational measures and precautions to protect your personal data and to prevent the loss, misuse or alteration of your personal data.
Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our website. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.
Transfers of data outside of the European Economic Area
We use Microsoft Office 365, which is a multi-tenant cloud service, for our internal office use. This means that internal documents and information generated by us are stored in a cloud service hosted within the European Economic Area (EEA).
However, in some limited cases, we may use data processors that process and/or store data outside of the EEA.
In these cases, we will take reasonable steps to ensure that the recipient implements appropriate measures to protect your information.
Retention of your data
Whatever your relationship with us, we will only store your information for a specified amount of time.
The length of time that data will be kept may depend on the reasons for which we are processing the data and on the law or regulations that the information falls under, such as financial regulations, Limitations Act, Health and Safety regulation etc., or any contractual obligation we might have.
Subject to the above, we will typically store data relating to donors for seven years after their last donation or interaction, and people to whom we provide services to for seven years after completion of those services. Personal data about unsuccessful applicants are held for 12 months after the recruitment exercise is complete for that vacancy.
Once the retention period has expired, the information will be confidentially disposed or permanently deleted, or anonymised.
If you request to receive no further contact from us, we will keep some basic information about you on our suppression list to avoid sending you unwanted materials in the future.
You have many rights under data protection legislation. These include:
Right of Access
You have the right to know what information we hold about you and to ask, in writing, to see your records.
We will supply any information you ask for that we hold about you as soon as possible, but this may take up to once calendar month. We will not charge you for this other than in exceptional circumstances. You will be asked for proof of identity as the person dealing with your request may not be the staff member you have met before. We need to be sure we are only releasing your personal data to you.
This is called a data subject access, and can be done by:
- emailing email@example.com
- writing to the Data Protection Officer, Wanstead and Woodford Migrant Support, Broadmead Baptist Church, Chigwell Road, Woodford Green, IG8 8PE
Right to be informed
You have the right to be informed how your personal data will be used. This policy, as well as any additional information or notice that is provided to you either at the time you provided your details, or otherwise, is intended to provide you with this information.
Right to withdraw consent
Where we process your data based on your consent (for example, to contact you directly via text or email), you can withdraw that consent at any time. To do this, or to discuss this right further with us, please contact us using the contact details below.
Right to object
You also have a right to object to us processing data where we are relying on it being within our legitimate interests to do so. To do this, or to discuss this right further with us, please contact us using the contact details below.
Right to restrict processing
In certain situations, you have the right to ask for processing of your personal data to be restricted because there is some disagreement about its accuracy or legitimate usage.
Right of erasure
In some cases, you have the right to be forgotten (i.e. to have your personal data deleted from our records). Where you have requested that we do not send you marketing materials, we will need to keep some limited information to ensure that you are not contacted in the future.
Right of rectification
If you believe our records are inaccurate, you have the right to ask for those records concerning you to be updated. To update your records, please get in touch with us using the contact details below.
Right to data portability
Where we are processing your personal data because you have given us your consent to do so, you have the right to request that the data is transferred from one service provider to another.
If you have any complaints about the way in which we have used your data, please get in touch with us using the contact details below. We would be happy to help and discuss your concerns.
You are also entitled to make a complaint to the Information Commissioner’s Office and the Fundraising Regulator, and, where we have provided you with immigration advice, the Office of the Immigration Services Commissioner.
If you have any questions about this policy, would like more information, or want to exercise any of the rights set out in section 11 above, you can get in touch with us in the following ways:
- emailing firstname.lastname@example.org
- writing to the Data Protection Officer, Wanstead and Woodford Migrant Support, Broadmead Baptist Church, Chigwell Road, Woodford Green, IG8 8PE