Annex 10 Data Protection Policy

Venture Trust treats your privacy very seriously. The following statement explains our data protection policy in relation to any personal information that we hold about you. In particular:

• The information we hold about participants, candidates, donors and other stakeholders and what we do with it.
• The cases where information must be shared.
• The security measures we have in place to ensure personal data stays safe;
• Your rights of control over your personal data.

The main aim of this Privacy Notice is to be transparent about how we process your personal information, ensure that we are processing your data following the GDPR principles, and explain and respect your rights over your data.

In managing your data, we are committed to comply with our obligations as data controllers as request in the General Data Protection Regulation (GDPR), in particular we will comply with the following principles while processing your data:

1. Lawfulness, fairness and transparency. Personal data shall be processed lawfully, fairly and in a transparent manner;

2. Purpose limitation. Data shall only be obtained and processed for one or more specified, explicit and legitimate purposes;

3. Data minimisation. Data should be adequate, relevant and not excessive for those purposes;

4. Accuracy. Personal data shall be accurate and, where necessary, be kept up to date;

5. Store limitation. Data should not be kept for longer than is necessary for the original purpose for which it was obtained;

6. Integrity and confidentiality. Personal data shall be processed in a manner that ensures appropriate security including protection against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.

7. Accountability and compliance. We shall be able to demonstrate compliance.

Our commitment applies to information gathered through all formal interactions with data subjects.

This privacy notice tells you what to expect when Venture Trust collects and process your personal information. It applies to information we collect about individuals. This may be details such as your name, address, email address and/or telephone number, or some further and even sensitive data if you are an individual who takes part in Venture Trust’s personal development programmes.

Data Protection

Chief Executive is ultimately responsible for the implementation of the policy.

Head of Corporate Services is responsible for the day to day matters, in particular:

• Acknowledging, investigating and responding to formal data subject requests and data subject queries.
• Assisting and advising colleges in the application of this policy.

All staff are responsible for ensuring that any personal data is processed in a lawful and fair manner.

Venture Trust is registered as a data controller with the Information Commissioner’s Office (ICO), registration number Z5738786. The register provides details of the purposes for which personal information may be used; types of data subjects about whom personal information may be held or processed; types of personal information that may be processed; bodies to whom the Venture Trust may disclose information; and information about transfers of personal information.

Venture Trust stores data on:

• our participants, including their contact details, health, and personal development information;
• our candidates for recruitment, including receipt and storage of application and equal opportunities forms;
• our donors and funders, including contact details;
• our suppliers and partners including contact details;
• our newsletter subscribers;
• advisers and representatives of other organisations.
• visitors to our website.

Venture Trust will only request and store information for which there is a genuine business or legal need, and will not use or disclose it for any purpose other than that for which it was requested and provided. We will always make it clear why we are requesting or holding data.

There are two categories of information that we might need:

• general and personal information such as name, address, contact details, or your general queries;
• sensitive or special categories of data such as racial or ethnic origin, physical or mental health, political opinions; religious or similar beliefs; trade union membership; physical or mental health/conditions; sexual life; genetic and biometric data and information about criminal allegations, proceedings, convictions or related security measures.

Personal data can be collected through many different communication channels. The main ones are:

• through any form provided on Venture Trust’s website;
• by a direct email sent to info@venturetrust.org.uk or any member of staff’s email address;
• by telephone;
• face to face interview or meeting;
• by ordinary mail;
• during promotional events.

We need to collect, hold and process information about you in order to:

• confirm your identity and keep in touch with you by post, e-mail, telephone, or other method;
• understand your needs and provide you with the adequate information;
• be able to deliver our programmes to Venture Trust’s participants;
• share information with selected partners who work with us;
• meet our statutory obligations including those related to equality and diversity;
• process financial transactions related to the services you receive such as grants or payments;
• build a picture of how well we deliver our services and how we can improve in the future;
• fully evidence outcomes and/or demonstrate a clear and transparent audit.
• promote our activities and achievements.

We are transparent about how we process the personal data that we collect. We only collect personal data if we have a genuine business need and a legal ground for doing it, in particular:

For general data such as name, contact details and general queries from individuals.

When you provide us your personal data voluntarily through any form provided on the website, by e-mailing or phoning us, or by any other communication canal such as Facebook, twitter or external service providers, we will hold it in order to provide you with the particular services or information that you specified to us.

We will not use your information in a non-compatible way without informing you and ask for your express consent where required.

Please, visit the section “Using your contact details for keeping you informed about Venture Trust’s activities and achievements” of this policy if you require information about when and how we will process your contact details for direct marketing purposes.

For processing sensitive data or special data collected for entering into one of our personal development programmes.

Legitimate referral agencies (social workers, criminal justice partners etc.) will provide the candidate’s personal information to us through any forms provided on the website, personally handed over, or in a face to face meeting. This information can also be provided directly by the candidate.

We can lawfully process these personal details in order to assess the candidate’s eligibility to participate in our programmes, and for the particular purpose of providing our personal development programmes, counselling, advice and support to participants.

In addition, we may need to collect some information about the candidate’s racial or ethnic origin. This is because we are legally obliged to obtain this information for the purpose of identifying the absence of equal opportunities.

In every case, we will always strive to only collect data that is adequate, relevant and not excessive in order to enable us to provide our personal development programmes and comply with our legal obligations. During the enrolment process we will provide further information to the participant about how their data will be used and how it may be shared with legitimate partners and authorities.

For processing job applications, including receipt and storage of application and equal opportunities forms.

All of the information you provide during the process will only be used for the purpose of progressing your application, or to fulfil legal or regulatory requirements if necessary.

We will ask you for your some personal information including name and contact details. We will also ask you about your previous experience, education, referees and for answers to questions relevant to the role you have applied for. Our recruitment team will have access to all of this information.

We will not share any of the information you provide during the recruitment process with any third parties with a different purpose. The information you provide will be held securely by us and/or our data processors whether the information is in electronic or physical format.

You will also be asked to provide equal opportunities information. This is not mandatory information and if you don’t provide it, it will not affect your application. This information will not be made available to any staff outside of our recruitment team, including hiring managers, in a way which can identify you. Any information you do provide, will be used only to produce and monitor equal opportunities statistics.

We will only share your personal information when there is compatible purpose in doing so.

Sharing participants’ data.

We may need to share participants’ data with relevant and appropriate referral agencies, authorities, and funding bodies. All of them are obliged to keep your information secure, and to use the information only to fulfil specific and agreed purposes, ie to comply with their legal obligations and perform their activities in the public interest. A list of our partners can be found on our website for each programme. Not all of the partners listed require the same amount of information.

Venture Trust has adopted appropriate security measures for the protection of personal information, and has installed all technical and organisational measures at its disposal to prevent the loss, misuse, alteration, unauthorised access and theft of personal information.

Every effort is made to ensure that staff are fully aware of these measures and the associated guidance in relation to your personal information. Only those staff members who are authorised to access the data subject’s information, and/or are required to do so as part of their regular duties, will have access to it.

Personal data will be stored only for as long as there is a genuine business need. The exact period of time depends on the type of information and the statutory provisions affecting our activity. When required, the exact period of time will be informed at the time of collecting your personal information. Thereafter, it will be disposed of safely and securely.

The GDPR provides you with a different rights to keep you in control over your data. This section provides an overview of these rights.

You have a right to be given information about how your data is being processed and why. We provide you with this information by:

• Having a detailed Privacy Notice published on our Website.
• Providing additional detailed notices during the participants’ enrolment process. When the information that you provide to us can be categorised as sensitive or special, we will provide you with a further and detailed notice to ensure that you understand how your data will be processed.
• Providing further information when required. If you find any missing information about how your data is going to be processed, please let us know. We will be happy to resolve your queries.

You have the right to access the information held about you, in particular to:

• Be told whether any personal data is being processed.
• Have access to your personal data.
• Obtain other supplementary information, such as:

- the categories of the personal data, and the reason for being processed

- whether it will be given to any other organisation; in particular recipients in third countries or international organisations

- for how long the data will be retained

- your rights over your data

- your right to lodge a complaint.

Where you would like to access this information you must submit a request in writing to info@venturetrust.org.uk. You will be provided with the information you have requested without delay and within one month unless it is very complex, in which case it will be provided within 2 months[1].

In certain limited circumstances, in order to supply you with the information you must provide Venture Trust with:

• Proof of identity. Information reasonably required to establish the identity of the person making the request;
• Other information required to locate the data being sought.

Be aware that Venture Trust has the right to withhold any information where providing it to you would allow the identification of other individuals, make it more difficult to detect crime, or where we are required by law to withhold it. For example, where information you are requesting is related to group work, you will have the right to access part of our records but not personal information about other participants.

[1] Article 12 GDPR.

We will delete or amend any personal data that are found to be incorrect or out of date. If you are aware of any changes that must be made, please update our information by contacting us at info@venturetrust.org.uk.

You can ask us to restrict our processing, for example, permitting its storage but no further processing. Furthermore, individuals may have a right to have personal data erased and to prevent processing in specific circumstances. We will consider if these circumstances apply in a case by case basis.

Without prejudice to any other administrative or judicial remedy, every data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes the Data Protection Regulation.

If we are processing your data using your consent, you can withdraw consent and request that we stop processing your personal information at any time.

We promote our activities primarily through our newsletter, annual reviews and social media. You have the right to ask us not to process your personal data for marketing purposes at any time.

In the next section, we will explain in which cases you may receive Venture Trust’s news, how we will use your contact details, for how long we will keep them and how to stop receiving information about our activities.

We promote our activities primarily through our newsletter (every three months), annual reviews and social media. You have the right to ask us not to process your personal data for marketing purposes at any time. In this section, we will explain in which cases you may receive Venture Trust’s news, how we will use your contact details, for how long we will keep them, and how to stop receiving information about our activities.

a) Why are you receiving news from Venture Trust?

1. Because you expressly asked us to send it.

In the majority of the cases, we will be sending our newsletter to you because you expressly asked us to do so by ticking the subscription box while navigating on our website. Importantly, you can cancel your subscription at any time as explained in section b).

In some situations, your information may be shared with us by independent event organisers; for example fundraising sites like Just Giving or Virgin Money Giving. These independent third parties will only do so when you have indicated that you wish to support Venture Trust and with your consent. You should check their Privacy Policy when you provide your information to understand fully how they will process your data.

2. Because we have a legitimate interest to do it.

We promote Venture Trust activities in order to reach more people that can be beneficiaries of our personal development programmes. This is our legitimate interest and in certain circumstances we may assume that you are expecting us to inform you due to your professional activities or your previous relationship with Venture Trust. This maybe the case when:

• you have collaborated with us in the past;
• you have given us your business or personal card;
• you have attended one or more of our promotional events.

In these situations, we believe that Venture Trust has a legitimate interest in sending you information about our activities, nonetheless if we were wrong about your expectations of receiving our news, or you just want to stop receiving them, please let us know as explained below, and we will stop contacting you for this purpose.

b) How can you stop receiving Venture Trust’s news?

You can stop receiving our news at any time by ticking the unsubscribe box included in each newsletter, this is automatic and will not require any further action. You can also exercise this right by contacting us at info@venturetrust.org.uk or just phoning Venture Trust.

c) How do we use your information? We will only use your contact details for sending you the newsletter and updates, we will not use your details in any other way. Expressly, we will not share your details with anybody else without your explicit and express consent.

d) For how long? We understand that you are happy to receive our news until you tell us not to do it in any of the ways explained above.

Please be aware that this policy’s aim is to protect the personal data of individuals, so corporate details are not included in this statement. In particular, the previous rules on consent for direct marketing do not apply to corporate bodies. However, we recognise a right for them to opt out if they do not wish to receive Venture Trust information, such as annual reviews, newsletters and updates of our programs. In such a case, they can simply ask us not to be contacted for this purpose and we will take note of their request.

We use third party providers Mailchimp and eTapestry to deliver our e-newsletters and promotional emails. We gather statistics around email opening and clicks using industry standard technologies including clear gifs to help us monitor and improve our e-newsletter.

We may collect information about your computer, including where available your IP address, operating system and browser type, for system administration and to report aggregate information to our advertisers. This is statistical data about our users’ browsing actions and patterns, and does not identify any individual.

Cookies provide information regarding the computer used by a visitor. We may use cookies where appropriate to gather information about your computer in order to assist us in improving our website.

We may gather information about your general internet use by using cookies. Where used, these cookies are downloaded to your computer and stored on the computer’s hard drive. Such information will not identify you personally. It is statistical data. This statistical data does not identify any personal details whatsoever.

You can adjust the settings on your computer to decline any cookies if you wish. This can easily be done by activating the reject cookies setting on your computer.

This privacy notice does not cover the links within this site linking to other websites. We encourage you to read the privacy statements on the other websites you visit. The website may, from time to time, contain links to and from the websites of our partner networks, advertisers, and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites.

If you are sending personal information to us via the internet, please be aware that the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of data transmitted to us via email if you are not using an encrypted mail system.

Any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to prevent unauthorised access.

By using our website, products or services or by interacting with us in the ways described in this Privacy Notice, you consent to the transfer of your information outside the EEA in the circumstances set out in this Privacy Notice. If you do not want your information to be transferred outside the EEA, contact us directly and we will find an alternative way to provide the service without using this providers.

Any changes we make to our policy will be put on our website. Please check for updates from time to time, so you are always fully aware of what information is collected and how it is used.