Privacy Notice

Job applicants, current and former employees, contractors

How and when do we collect information about you?

You provide several pieces of data to us directly during the recruitment period and subsequently upon the start of your employment/contract with us. In some cases, we will collect data about you from third parties, such as employment agencies or former employers when gathering references.

What types of information is collected about you and who provides it?

We keep several categories of personal data on our employees and job applicants, in order to carry out effective and efficient processes. Specifically, we may process the following types of data:

1. personal details such as name, address, phone numbers
2. name and contact details of your next of kin
3. your photograph, your gender, marital status
4. photographs and footage of the organisation’s events where you may appear
5. information of any disability or other medical information you have disclosed
6. right to work documentation (e.g. copy of your passport or birth certificate)
7. information gathered via the recruitment process such as that included in a CV, cover letter or application form, references from former employers, details on your education and employment history, etc
8. National Insurance number, bank account details and tax codes
9. information relating to your employment with us (e.g. job title, job description, salary, terms and condition of the contract, annual leave records, appraisal and performance indication, formal and informal proceedings involving you such as letters of concern and disciplinary, disciplinary and grievance proceedings.
10. internal and external training undertaken, includes copies of certificates and reports
11. information on time off from work including sickness absence, family related leave, etc
12. IT equipment use including telephones and internet access
13. your opinions and views, as expressed during your work, in e-mails, letters, reports, etc.
14. copy of your driving licence

We may also process special category of data which include health information, sexual orientation, race, ethnic origin, political opinion, religion, trade union membership, genetic and biometric data. We may also process criminal records information if the role involves checks with the Disclosure and Barring Service.

How is the information used?

We are required to use your personal data for various legal and practical purposes for the administration of your contract without which we would be unable to employ you or work with you. Holding your personal data enables us to meet various administrative tasks, legal and contractual obligations. We process information in relation to checks with the Disclosure and Barring Service for our safe recruitment practices.

Lawful basis for processing

We mainly use ‘contractual obligation’ as a lawful basis for processing personal data for employees, job applicants and contractors. We may also have a legal obligation in order to process and share your data, for example we need to share salary information to HMRC or use some of your data to enrol you on a pension scheme.

We may rely on our legitimate interest for processing activity such as keeping supervision and appraisal records; using your image, biographical data and videos or pictures of the organisations’ events where you may appear on our website or marketing or fundraising materials to promote the charity.

Some special categories of personal data, such as information about health or medical conditions are processed in order to carry out employment law obligations (such as those in relation to colleagues with disabilities and for health and safety purposes). We may also process other special categories of personal data, such as information about ethnic origin, sexual orientation, health or religion or belief for the purposes of equal opportunities monitoring.

When processing criminal records (for example, in order to perform DBS check), the organisation relies on the lawful basis of legitimate interest. When processing special category of data and criminal records, we rely on additional conditions of the Data Protection Act 2018 and related legislation.

How long do we keep your data?

We only keep your data for as long as we need it for, which will be at least for the duration of your employment or contract with us though in some cases we will keep your data for a period of 6 full years after the year in which your employment or contract ended. If you’ve applied for a vacancy but your application hasn’t been successful, we will keep your data only for a maximum of 12 months, unless we have paid you any expenses to attend an interview of a similar role, in which case we may keep the records for 6 full years after the year in which the expenses were paid.

Some data retention periods are set by the law. Retention periods can vary depending on why we need your data. Please get in touch by contacting us using the details above if you want to know more about retention period.

Data is destroyed or deleted in a secure manner soon after the retention date has passed.

Confidentiality – who do we share your data with? :

Personal Data in relation to your earnings is shared with HMRC as part of our legal obligation. Personal Data may be shared with third parties for the following reasons: for the administration of payroll, pension, HR functions (for example the online holiday booking system) and administering any other employee benefits. Data may be accessible to our IT providers.  When sharing information with third parties, we have data sharing, processor agreements or contracts in place to ensure data is not compromised. Third parties must implement appropriate technical and organisational measures to ensure the security of your data.

How we collect information about you? 

We may collect the following information about you when you sign up for a membership with IWA or apply to become a volunteer: name, address, email address, telephone number, date of birth, bank details and health and disability information. We may also collect criminal records information.

If you offer to undertake voluntary work with us, we may collect:

1. name and contact details of your next of kin
2. your photograph, your gender, marital status
3. photographs and footage of the organisation’s events where you may appear
4. information of any disability or other medical information you have disclosed
5. information supplied you including a CV, details on your education and employment history, etc
6. bank account details if we need to pay you for any expenses
7. information relating to your voluntary work with us (e.g. job title, job description, terms and condition of the activities, any disciplinary and grievance proceedings.
8. internal and external training undertaken, includes copies of certificates and reports
9. IT equipment use including telephones and internet access
10. your opinions and views, as expressed during your work, in e-mails, letters, reports, etc.
11. copy of your driving licence.

How is your information used? 

We may use your personal information to

• Provide appropriate services and products;
• Carry out effective administration and operations;
• Provide reasonable adjustments;
• Share volunteering opportunities, projects, updates, and information on our work;
• Safeguarding;
• Protect yourself and the general public;
• Recording the Association’s work for publicity and for historical records;
• Ensure you are sufficiently trained and competent to undertake certain tasks.

Lawful basis for processing 

If you are registered with us as a member, we rely on ‘contractual obligation’ as our lawful basis for processing your personal data. If you have signed up as a volunteer with us, we rely on legitimate interest for processing your data. When we process special category of data and criminal records, the lawful basis is substantial public interest read with conditions from the Data Protection Legislation.

To process information on any allergies or other medical information, we rely on consent. To ensure provision of reasonable adjustments, we rely on substantial public interest read with support for individuals with a particular disability or medical condition.

How long do we keep your data for? 

We only keep your data for as long as we need it for.  Where any financial transactions have occurred, we will keep your data for a period of 6 full years after the year in which the financial transaction was made.  Otherwise, we will securely destroy your personal data when either you tell us to or when it becomes apparent to us that you no longer wish to receive communications or information from us.

If you have attended a work party or other event where there is a risk of an insurance claim, we may keep your information for up to three full years after the year in which the event took place, of if anyone under the age of 21 was in attendance, until that person attains the age of 21, if that period is longer.

Some data retention periods are set by the law. Retention periods can vary depending on why we need your data. Please get in touch by contacting us using the details above if you want to know more about retention period.

Data is destroyed or deleted in a secure manner soon after the retention date has passed.

Confidentiality, data sharing and safeguarding  

• We may share your data with subcontractors or suppliers involved in providing support, such as mailing houses. These organisations act as data processors and process such data on our behalf.  Data may be accessible to our IT providers.
• We may partner with other organisations for example to jointly host events.  On such occasions, where we need to share information we will seek your consent at the time of your application to attend the event.
• When processing information regarding attendance at any IWA activity, we will rely on legitimate interest.
• To comply with our duty of care and safeguarding, we may need to pass some information raising safeguarding concern with the authorities. In such circumstances, we apply vital interest and legitimate interest as our lawful basis. Data subjects’ rights and other data protection provisions may be restricted when concerning personal data processed in these circumstances. Exceptions and exemptions are applied on a case-by-case basis.

Information we collect:

When you make a donation or support us

We may collect information provided by you via a form on our website, via telephone calls, letters of forms submitted to us, social media and other sources. The information gathered may include: name, email address, phone number, Gift Aid sign up, donation details, how you heard about the organisation, postal address.

This information allows us to process your donation, and deal with any potential enquiry. We rely on legitimate interest to process this data.  If you agree that we can claim Gift Aid on your donations, we are legally required to keep a record of the claim and your Gift Aid declaration.  If you are donating using a third party, please also refer to the privacy notice published on their website.

When you sign up to attend our events

Information is mainly provided by you via event registration forms or in person during the events by paper forms. The information gathered may include: name, email address, donation/payment details, bank account details, reasons to engage, postal address, email address contact preference, health information.

If you are attending a festival, boat rally or similar event, other information that we collect may include details of your family and pets, boats, caravans, tents or other possessions and accommodation you may be residing in, along with dietary information, next of kin, names of friends you may wish to stay near to, disability and mobility information and your preferences and views.

This information allows us to administer your sign up, process payments, and deal with any potential enquiry. We rely on the legitimate interest to process this data.

During these types of events, we may also take photographs and video recording of people attending where you may be included. This information allows us to showcase our work and have an effective external communication. We rely on our legitimate interest to process this data.  If you are signing up to an event using a third party, please also refer to the privacy notice published on their websites.

For processing information on your family and accommodation, we rely on legitimate interest. To process information on any allergies or other dietary or medical information, we rely on consent. To ensure provision of reasonable adjustments, we rely on substantial public interest read with support for individuals with a particular disability or medical condition.

When you apply for a membership with Club 500

Information is provided by you when you sign up for Club 500 with the Club Application form, such as: name, address, bank/building society details, subscription details. For processing this information, we rely on consent.

When you show interest in supporting us (e.g. through a gift in your will or a pledge) and you decide to contact us

Information is provided mainly by yourself, via online forms or phone and email conversation with us. The information gathered may include: occupation, title, details of any correspondence had with ourselves, date of birth, fundraising appeals responses, event participations with us, details of your reasons to engage with us. This information allows us deal with your enquiry and show you how to get engaged. We rely on our legitimate interest to process this data.

Marketing Communications and Newsletters

Your contact details may be used to provide you with information about our services or our fundraising opportunities via email, text, phone or post. Additionally, you may sign up to our newsletter through our website or through your membership with IWA. We will only send you fundraising and marketing communications by email and text if you have provided your consent, or if you have been involved in a commercial transaction with us. For processing your information to send you our newsletter, we rely on consent. You may opt-out of our fundraising and marketing communications at any time by clicking the unsubscribe link at the end of our e-marketing communication. Alternatively, you can let us know by using any of the contact details listed at the top of this notice.

How long do we keep your data?

We only keep your data for as long as we need it for.  Where any financial transactions have occurred, we will keep your data for a period of 6 full years after the year in which the financial transaction was made.  Otherwise, we will securely destroy your personal data when either you tell us to or when it becomes apparent to us that you no longer wish to receive communications or information from us.

Some data retention periods are set by the law. Retention periods can vary depending on why we need your data. Please get in touch by contacting us using the details above if you want to know more about retention period.

Data is destroyed or deleted in a secure manner soon after the retention date has passed.