Our Privacy Promise
We take our duties when processing your personal data very seriously. We promise that we will tell you what data we are collecting and why. We will make every reasonable effort to collect, process, store and share your data safely and securely. We will also make sure that our trusted partners do the same. We also promise that we will be open and clear with you about our use of your personal information and that you will be able to control your personal information with ease.
In order to provide services to you, during and after your employment with us, we need to collect and keep a little data about you, like your name, contact details, health details where appropriate, banking details and employment and salary records. Some of this information we may need to share with our trusted partners, such as specialist service providers and professional advisors. This is to provide you with the support and services you require from us.
We use your data for employee services
We use the information you provide to fulfil your contract of employment and the legitimate interests we have in providing employer’s support such as pay, pensions, performance review, learning and development, absence management and holidays, security screening, information about the charity and to support your employment.
You are in control
If you would like to make any changes to the way we are processing your data, if you believe it is inaccurate or incomplete, or you have any concerns regarding how it is being processed you can discuss your preferences with your Line Manager or a People Services representative (or the Payroll and Pension administration office with regard to the St Dunstan’s Retirement Benefits Plan (1973)). If you have comments, questions or a complaint regarding your personal data and how we are processing it, you can contact the Data Protection Officer directly using the contact details in Section 9 of this policy “How to Contact Us”.
Changes to this Policy
We may change this document from time to time to reflect the latest views of what we do with your information and legal and regulatory changes. Please check back frequently. You will be able to see changes have been made by the date it was last updated.
1. Who we are
Since 1915, Blind Veterans UK has held to the belief that no-one who has served our country should battle blindness alone. That's why we're here to help with lifelong practical and emotional support for blind veterans, regardless of when they served or how they lost their sight. We help veterans recover their independence and discover a life beyond sight loss.
References to "Blind Veterans UK", ‘the charity’, “our’, ‘us’ and "we" mean Blind Veterans UK registered charity 216227 in England and Wales and SCO39411 in Scotland.
This also includes: our wholly owned subsidiary charitable trading company, Blind Veterans UK Trading Limited (registered company in England & Wales No. 06446944) which trades on our behalf to raise funds; Four Seasons NWMC Housing Limited (registered company No. 01882050); and the St Dunstan’s Retirement Benefits Plan (1973).
2. What personal data we collect and why
What we need to collect
The term ‘personal information’ (or ‘data’) means information that relates to you or another individual that means you can be identified, either directly or in combination with other information that we may hold. We need personal information about our current and former employees and pensioners to allow us to provide you with employment and pension services and support.
As an employee and subsequently as a pensioner, we will process personal data about you in order to set up and maintain your contract of employment while also meeting our legal obligations and pursuing our legitimate interests as your employer including administering the payment of pensions under the St Dunstan’s Retirement Benefits Plan (1973). This information may include:
- Postal address, telephone number, email address.
- Your national insurance number.
- Driving licence and or passport details and where necessary valid visa documentation.
- Bank account details, salary, tax, pension status, pension entitlement and expenses details.
- Learning, development and performance details.
- Photos and biographic details. (where necessary)
If as an employee your role will include care duties/functions and or other direct engagement with our members it is necessary for us to complete a Criminal Records Check (Disclosure and Baring Service or Disclosure Scotland) to assist us with the making of safer employee recruitment decisions. In addition to the above personal data the following may also be processed.
- DBS / DS Reference number, type of disclosure, date of issue1
- Place of birth
- Your national insurance number, passport details and where necessary valid visa documentation.
- Profession and Job title.
We will be very clear with you that we wish to collect such information, our reason for collecting such information and we will only do so when we have a lawful basis for processing the information.
Data protection law and regulation recognises certain information as ‘special category’ data and as being particularly sensitive. This includes: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic data, certain biometric data, data concerning health or a person's sex life or sexual orientation. Sometimes we may need to collect or may indirectly obtain such data. For example:
- Health details (e.g. pre-existing health conditions, occupational health or ill health early retirement), where we need to make reasonable adjustments for your safe and productive employment or appropriate pension payments.
- Race or ethnic origin, for the purpose of, for example, equal opportunities monitoring or when confirming eligibility to work in the UK.
- You may reveal some of this information if you share photos or personal information in our Review magazine, on our website or social media channels.
The accuracy of your personal information is really important to us. If you wish to update or correct any information we hold, please contact your Line Manager, an HR representative or the Payroll and Pension administration office using the contact details in Section 9 of this policy.
Why we need it
We need your personal information in order to perform functions such as:
- To comply with the law. To comply with the law as a data controller and employer there are data processing purposes which must be completed. These include but are not limited to company, charity, employment, social security and social protection law. Personal information collected specifically for this purpose cannot be further processed.
- Manage your contract of employment. As part of the recruitment process and to confirm your security vetting and references and to administer other pre-contractual requirements. To administer your working hours, holidays and absences, pay, pension and tax. To administer benefits under the St Dunstan’s Retirement Benefits Plan (1973).
- Provide performance review, learning and development. To develop your skills and knowledge within your chosen profession and career path. To manage your job performance and to promote and improve employee effectiveness.
- Communicate with you. To communicate with you about employment and pension matters in an appropriate way and to provide you with specific services, updates, newsletters, feedback and information. To assist with technical problems related to our services.
- To improve our services and administration. To ensure the most efficient and appropriate use of the resources we have.
3. How we collect your personal data
We collect information about you in a variety of ways. We may collect information you provide directly to us as well as information indirectly available from other sources, such as referees or HMRC.
Direct from you
You will give us personal data directly yourself: during the recruitment process and subsequently when establishing and enabling your contract of employment; for personal development and training; for routine personal management purposes; if you use our websites or apps; sign up for an event; or communicate with us.
Indirectly from other sources
We may obtain your personal data indirectly when you give permission to others to share it or where it is publicly available:
- Third party organisations or individuals. We may obtain information from third parties if you have agreed that they can approach us or we can approach them, for example a recruitment agency, a referee, professional body or qualifying organisation or the Disclosure and Barring Service. We will also obtain information about you from official sources as part of enabling your employment services, such as HMRC for tax purposes or for the purpose of paying appropriate pensions under the St Dunstan’s Retirement Benefits Plan (1973) using the scheme Actuary’s data. Like all companies, through our website and mobile apps, we may collect information about what browser you are using, your IP address and computer operating system and may use this information to improve the services we offer.
- Social media. Depending on your settings or the privacy policies for social media and messaging services like LinkedIn, Facebook or Twitter, you might give us permission to access information from those accounts or services.
- Publicly available sources. Public information may include information from places such as Companies House, the electoral register and information that has been published in articles / newspapers / social media, e.g. LinkedIn. Additionally, the Post Office’s National Change of Address database allows us to keep your information up to date
4. The lawful basis for processing
Data protection law and regulation require us to have a lawful basis for processing your personal information. These include:
- Where you have given explicit consent to do so for notified purpose(s). This may include sending you marketing e-mails / texts / material or to provide you with a service or information that you have requested or require. Where we need your consent, it will be clearly identifiable as a consent for a specific purpose.
- To comply with a legal obligation. For example, where we are required to do so by a court, regulatory authority the police or security services. Where UK legislation requires us. such as to comply with employment, social security or social protection law, such as Health and Safety, a criminal records check, pension regulations and HMRC tax regulations.
- In performance of a contract. To fulfil the requirements of the contract of employment we have with you. This might include confirming your eligibility and suitability for employment through checks such as references and qualifications, DBS, eligibility to work in the UK or driving licences; tracking work hours, leave and absences; administering pay and charity assets such as cars; compliance with policies and procedures and health and safety; occupational health assessment.
- Where we as a charity have a legitimate interest. Where we have a legitimate interest, we must ensure that we are not harming any of your interests or rights and only use it in a manner that you would reasonably expect us to. For example, we need to administer your pension scheme; be able to contact you for employment purposes; track our assets such as mobile information systems and data; and understand any health issues (such as disability) to make reasonable adjustments for your employment under Equality law.
- Special category. Where we process ‘special category’ personal information (such as health) we will ensure we do so in accordance with a lawful basis under Art. 6 and the additional “exception” condition for processing special category data under Art. 9 of GDPR. An example is, where the personal data is being processed for the purposes of “employment and social security and social protection law”.
- To protect the vital interests of yourself or another person. If we believe that the vital interests of you or a third party is at risk, we have a duty to protect.
5. Protecting and sharing your information
How we protect your personal data.
We ensure that there are reasonable and appropriate technical and organisational controls in place to protect your personal details against unauthorised or unlawful processing and against accidental loss, destruction or damage. For example, our computers, online
systems and our network are protected and routinely monitored. We have policies and procedures in place which staff and volunteers are expected to comply with and for which they receive training.
- Password security. Where we have given you (or where you have chosen) a password which enables you to access certain parts of our information systems and sites, you are responsible for keeping the password confidential. You agree not to share that password with anyone else.
You should be aware that the use of the Internet is not entirely secure and although we will do our best to protect your personal data we cannot guarantee the security or integrity of any personal information which is transferred from you or to you via the Internet. Any transmission is at your own risk.
Managing access and sharing of your personal data
We undertake reviews of who has access to information that we hold to ensure that your information is accessible only by the necessary and appropriately trained staff and trusted third parties. Where we share your data with a third-party or require you to share your personal data directly with a third party processor on our behalf, we require that they have appropriate technical and organisational measures in place to protect your information.
However, we may be compelled by law or agree to disclose your personal data to third-parties, such as law enforcement agencies, courts, government bodies or regulators. Examples include, where we believe a crime has been committed or to assist with the apprehension of an offender or when required by company, charity and social welfare law, e.g. The Charity Commission, the Information Commissioner’s Office, the Health and Safety Executive, the Care Quality Commission. We have limited control over how it is
processed by these parties, we therefore recommend that you consult their own privacy policies.
We may in certain circumstances share your personal data without your consent for the purpose of fulfilling our safeguarding responsibilities. This doesn’t happen often, but we may share your personal data:
- If we believe there is a serious risk to the public, beneficiaries, our staff or to other professionals;
- To protect a vulnerable person, (child or adult) who we believe may be at risk, for example if they are frail, confused or cannot understand what is happening to them.
Occasions, other than by law, when we may share your data include:
· If you have agreed that we may do so.
When we use external service providers to collect or process personal data on our behalf, for example:
o Providing training services; (iLearn)
o Providing HR, and payroll services (CoreHR) and
o Pension services (Aviva) including the St Dunstan’s Retirement Benefits Plan (1973);
o To conduct a DBS Criminal records check (Disclosure Services)
o Eligibility to drive charity vehicles, (Fleetcheck)
o Your volunteering activities with us (Assemble)
o The appointed charity, Accounting firm, financial / credit organisation(s), bank, actuary and auditor.
- To our subsidiaries (i.e. the companies owned by Blind Veterans UK).
- If we receive a complaint about any inappropriate content you have posted or transmitted to or from one of our sites, forums, social media pages or apps we may share your personal data with your internet provider or law enforcement agencies.
- To enforce or apply the terms of your contract or other agreements or if we believe that we need to protect the rights, property or personal safety of Blind Veterans UK, our supporters, members, visitors or websites and for other lawful purposes.
- We may disclose aggregate statistics about our employees and pensioners to describe our charity to prospective supporters, partners, advertisers and other reputable third parties and for other lawful purposes, but these statistics won’t include any personally identifying information without explicit consent.
- If we run an event in partnership with other named organisations your details may need to be shared. We will be very clear what will happen to your data when you register.
- If we merge with another organisation to form a new entity, information may be transferred to the new entity.
We will never rent or sell your personal information. We will not share or swap it with other organisations for their own purposes or to make money out of your data without your consent.
Where we store your information
The information that you provide to us will be held in our systems and servers, which are located in our premises or those of a trusted third-party who processes data on our behalf.
We may need to use the services or provide access and processing to service providers and other organisations located outside of the European Economic Area (EEA). This may mean your data is transferred, processed and stored outside of the EEA. However, we will put in place appropriate safeguards to protect your data and rights, such as asking for your explicit consent, using appropriate contractual clauses and / or Privacy Shield (for the US) with our third-party supplier and / or by using encryption. With the appropriate safeguards in place, by submitting your personal information, you agree to this transfer, storing or processing at a location outside the EEA. In cases when we use external websites provided by other organisations such as Twitter or Facebook, then we would ask you to consult their privacy policies too.
6. Retaining your information
We hold your information for only as long as is necessary to fulfil the purposes for which the data was collected and our legitimate interests or in order to comply with legal or regulatory rules and requirements.
The Data Protection Act 2018 prohibits a data controller from processing and retaining an individual’s criminal record data. However, an exception applies allowing a controller to process criminal record data for the purposes of employee and volunteer recruitment. Once a recruitment process has been completed a controller cannot retain a copy of the DBS /DS report or any of the personal information from within the report. The only information which may be retained is:
- The date of issue of a disclosure
- The name of the subject
- The type of disclosure requested
- The position for which the disclosure was requested
- The unique reference number of the disclosure
- The details of the recruitment decision taken
While processing criminal record data for this purpose, Blind Veterans UK will retain received disclosure information separately and securely. It will not be kept on an applicant's personnel file and access is strictly controlled and limited to only staff entitled to see it as part of their recruitment duties. DBS/DS content information will be securely destroyed after a period of six months (This period allows resolution of any related disputes or complaints) ensuring the information is retained for only as long as is necessary.
When your employment with Blind Veterans UK ends or is terminated, we will retain some basic information in order to record your employment with us to meet any legal or regulatory requirements or to protect our legitimate or legal interests, for example in the event of an employment dispute, confirmation of employment for referees or to process any ongoing requirements such as a pension.
Where we have contracted with a 3rd party provider to process your personal data on our behalf these organisations will also retain some basic information in order to meet their own legal requirements, e.g. records of financial transactions, it will only be retained for as long as is necessary but you may want to consult their privacy policies too.
CoreHR (Blind Veterans UK’s HR and Payroll provider) maintains a transactional backup archive of the HR and payroll system. This is for the purposes of data recovery in the event of data corruption or data loss. The archive will include staff personal data which is refreshed daily to keep it up to date. The back-up data is retained for a period of sixty nine days. If your employment ends or is terminated, your personal data will remain within this archive for a period of sixty nine days.
As a CoreHR managed archive, Blind Veterans UK staff do not have access to this data. Access restrictions are in place to allow only CoreHR technical staff to process this personal data for the purpose of data recovery requirements if necessary to do so.
7. Your details on the internet and website
Like most organisations, our website and apps use “cookies” and other tracking software to help us make our site and the way you use it better and more relevant to you. We will not be able to personally identify you from the information gathered but it may help us improve our online services.
- Cookies mean that a website will remember you. They’re small text files that are transferred to your computer (or phone or tablet). They make interacting with a website faster and easier, for example by automatically filling your name and address in text fields. Please read our cookies policy for more information. You can change your cookie preferences whenever you wish.
- When visiting our website or apps we may collect information about the type of device you’re using to access them and the settings on that device. This might also include the IP address and your operating system and certain device settings as well as diagnostic information.
8. What are your rights?
The new General Data Protection Regulations (GDPR), effective from 25 May 2018, gives everyone a number of very important rights. In abbreviated form these are:
- The right of access. Request information that we hold about you.
- The right of rectification. Update or amend the information we hold about you if it is incomplete or inaccurate.
- The right to erase or ‘right to be forgotten'. Ask us to remove your personal information from our records where there is no compelling reason for its continued processing.
- The right to restrict processing. Ask us to supress the processing of your information.
- The right to data portability. Obtain and reuse your personal data for your own purposes.
- The right to object. Object to the processing of your information for certain purposes (such as marketing, research, statistics or our legitimate interests).
- Rights in relation to automated decision making and profiling.
If you would like to know more about your rights under the data protection law see the Information Commissioner’s Office (ICO) website which also explains how to contact them.
Remember, you can exercise your rights in relation to your personal information at any time by contacting your Line Manager, a People Services representative or through the contact details set out in the ‘How to contact us’ section of this policy.
If you are not satisfied with our response or believe we are not processing your personal data in accordance with the law and your rights, you can complain directly to the Information Commissioner’s Office.
9. How to contact us
Post: People Services, Blind Veterans UK, 12-14 Harcourt Street, London, W1H 4HD
Phone: via on-line directory
Email: via on-line directory
St Dunstan’s Retirement Benefits Plan (1973) (deferred or current pensions)
Post: Payroll & Pension Administration Office, St Dunstan’s Retirement Benefits Plan (1973), Blind Veterans UK, Greenways, Ovingdean, Brighton, BN2 7BS
Phone: 01273 391442
If you wish to enquire further about your rights, ask for information to be provided, or to raise a complaint, please contact our Data Protection Officer.
Post: Data Protection Officer Blind Veterans UK, 12-14 Harcourt Street, London, W1H 4HD