Trustee Privacy Notice

 

Data Controller: Harbour Drug and Alcohol Services, Hyde Park House, Mutley Plymouth, PL4 6LF

Governance Team: Harbour Drug and Alcohol Services, Hyde Park House, Mutley, Plymouth, Devon, PL4 6LF. Tel: 01752 434343 Email: thcpltd.dpo@nhs.net

Harbour Drug and Alcohol Services collects and processes personal data relating to its trustees to manage the trustee relationship. Harbour is committed to being transparent about how it collects and uses that data and to meeting its data protection obligations.

This Privacy Notice aims to provide you with a clear explanation of the personal data which Harbour holds and the purpose[s] for which it is held.

What information does Harbour collect?

Harbour collects and processes a range of information about you. This may include:

  • your name, address and contact details, including email address and telephone number;
  • your nationality and information about your qualification to be a trustee in the UK;
  • your date of birth;
  • a recent photograph of you;
  • information about your eligibility to be a trustee including:
    – information about your criminal record including any unspent convictions for an offence involving dishonesty or deception, if you are currently declared bankrupt (or are subject to bankruptcy restrictions or an interim order) of have an Individual Voluntary Agreement (IVA) with creditors
    – if you have previously been disqualified from being a Company Director/Trustee
    – if you have previously been removed as a Company Director/trustee due to misconduct or mismanagement;
  • the details of your start date;
  • details of your qualifications, skills, experience and current employment, including start date;
  • information about your marital or civil partnership status, next of kin, dependants and emergency contacts;
  • information about your criminal record where applicable;
  • details of conflict of interests;
  • details of your availability for undertaking trustee activities and attendance at meetings;
  • information regarding any training you receive; and
  • equal opportunities monitoring information, including information about your ethnic origin, sexual orientation, health and religion or belief

Harbour may collect this information in a variety of ways. For example, data might be collected through Trustee application form; obtained from your passport or other identity documents such as your driving licence; from forms completed by you at the start of or during your Trusteeship; from correspondence with you; or through interviews, meetings or other assessments.

In some cases, Harbour may collect personal data about you from third parties, such as references from previous employers and information from criminal records checks permitted by law.
Data will be stored in a range of different places, including in your trustee file and in other IT systems (including the organisation’s email system).

Why does Harbour process personal data?

Harbour needs to process data to ensure that it is complying with its legal obligations. For example to ensure you are eligible to undertake a trustee role in the UK, to file statutory and financial records and to comply with health and safety laws.

In other cases, Harbour has a legitimate interest in processing personal data before, during and after the end of the trustee relationship.
Processing trustee data allows Harbour to:

  • meet its legal obligations to file trustee information on the appropriate public registers;
  • to publish annual reports;
  • run trustee recruitment and appointment processes;
  • maintain accurate and up-to-date trustee records and contact details (including details of who to contact in the event of an emergency);
  • ensure that trustee’s are able to receive the information required for Board meetings;
  • obtain appropriate legal or HR advice, to ensure that it interprets and complies with duties in relation to legislation and its own policies, processes and procedures in a fair and reasonable manner;
  • deliver effective services to our clients or internal customers;
  • undertake business planning activities;
  • ensure effective general business administration;
  • respond to and defend against legal claims; and
  • maintain and promote equality in the workplace.

Some special categories of personal data, such as information about health or medical conditions, is processed to carry out legal obligations.

Where Harbour processes other special categories of personal data, such as information about ethnic origin, sexual orientation, health or religion or belief, this is done for the purposes of equal opportunities monitoring.

We do not need your consent if we use special categories of personal data in order to carry out our legal obligations. In some circumstances however we may ask for your consent to allow us to process certain particularly sensitive data. In these circumstances we will provide you with sufficient information about how your data will be used for you to make a choice about whether to provide your consent. You will have full control over your decision to give or withhold consent, and there will be no consequences where consent is withheld. Consent, once given, may be withdrawn at any time, with no consequences.

Who has access to your data?

Your data may be shared with employees and colleagues within Harbour where it is necessary for them to undertake their duties. This includes, for example, those with responsibility for arranging Board activities, the Chief Executive, Administration staff and IT Manager for maintaining records.

You should be aware that if you are appointed as a trustee of Harbour, some of your personal data may be filed on public and searchable registers, such as (but not necessarily limited to) Companies House and Charity Commission. Harbour will file such data to the extent required by law. Once entered on any register/s, Harbour ceases to be responsible for the protection or processing of such data, as this obligation transfers to the appropriate government body. However your right as a data subject to require Harbour to correct inaccuracies or update your data to the extent that it is able to do so continues to apply.

Harbour may publish personal data such as your name and photograph to our website or within an annual report to facilitate effective service delivery, to meet statutory requirements or to report on achievements.

Harbour shares your data with third parties in order to declare your Trustee eligibility, check there are no payments made to related parties, and obtain references.

Harbour may be required to share your data with third parties such as the local authority, police and statutory agencies to comply with legal obligations.

Save as explained above, Harbour will not share your data with third parties for any other purpose without your express consent.

Harbour will not transfer your data to countries outside the European Economic Area.

How does Harbour protect data?

Harbour takes the security of your data seriously. Harbour has internal policies and controls in place to try to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by our employees and/or senior officers in the performance of their duties.

Where Harbour engages third parties to process personal data on its behalf, they do so on the basis of written instructions, are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data.

For how long does Harbour keep data?

In line with data protection principles, we only keep your data for as long as we need it for, which will be at least for the duration of your Trustee relationship with us.

In some cases, we will keep your data for a period after your Trustee relationship has ended. Retention periods can vary depending on why we need your data. This may be determined by law.

The periods for which your data is held after the end of your Trusteeship will be set out in our Retention Policy.

Automated decision-making

Trusteeship decisions are not based on automated decision-making.

Your rights

As a data subject, you have a number of rights. These are:

  • The right to be informed. This means that we must tell you how we use your data, and this is the purpose of this privacy notice;
  • The right of access. You have the right to access the data that we hold on you and to receive a copy of your data and information about where it was sourced. To do so, you should make a subject access request. You can read more about this in our Data Protection Policy;
  • The right for any inaccuracies to be corrected. If any data that we hold about you is incomplete or inaccurate, you are able to require us to correct it;
  • The right to ask Harbour for your data to be erased, for example if you believe there is no longer any need for your data to be held for its original purpose, or if you decide to withdraw any consent that you have given for your data to be processed;
  • The right to restrict the processing of the data. For example, if you believe the data we hold is incorrect, we will stop processing the data (whilst still holding it) until we have ensured that the data is correct;
  • The right to portability. You may transfer the data that we hold on you to another organisation for your own purposes;
  • You may have the right to object to the way we use your data if you do not agree that we are using it for our legitimate interests; and
  • The right to regulate any automated decision-making and profiling of personal data. You have a right not to be subject to automated decision making in way that adversely affects your legal rights.

Where you have provided consent to our use of your data, you also have the unrestricted right to withdraw that consent at any time. Withdrawing your consent means that we will stop processing the data that you had previously given us consent to use. There will be no consequences for withdrawing your consent. However, in some cases, we may continue to use the data where so permitted by having a legitimate reason for doing so.

If you would like to exercise any of these rights, please contact the HR Officer within Harbour Drug and Alcohol Services, Hyde Park House, Mutley, Plymouth, Devon, PL4 6LF, 01752 434343.

If you believe that Harbour has not complied with your data protection rights, you can complain to the Information Commissioner. Their contact details can be found on their website (www.ico.org.uk).