VICTORIA CONVALESCENT TRUST
(Charity no. 1064585)
This policy reflects the requirements of the General Data Protection Regulation (GDPR), which came into force on 25 May 2018.
Your personal information is collected by the Victoria Convalescent Trust (“VCT”, “we”/“us”/”our”), which acts as the data controller of your information. If you have any questions or complaints in relation to the use of your personal information or this policy, you can contact the Grants Co-ordinator via e-mail or telephone (contact details are at section 12 below).
2. Policy Statement
The VCT takes the privacy of individuals, including its beneficiaries, very seriously and is committed to protecting and processing their personal information securely. The implementation of this policy is set out in more detail below.
3. Data protection principles
The VCT is committed to complying with the following data protection principles:
• We will process personal information lawfully, fairly and in a transparent manner;
• We will only collect personal information for specified, explicit and legitimate purposes, and will not process in a way which is not compatible with these purposes;
• We will only process personal information which is adequate, relevant and necessary for the purpose for which it was first given;
• We will keep accurate and up to date personal information and take reasonable steps to ensure that inaccurate personal information is deleted or corrected without delay;
• We will keep personal information in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the information is processed; and
• We will take appropriate measures to ensure that personal information is kept secure and protected against unauthorised or unlawful processing, and against accidental loss, destruction or damage.
4. Lawful basis
The VCT will only process personal information where an appropriate legal basis for its processing has been identified and communicated. Of the lawful bases for the processing of personal information the following two are applicable for the VCT:
• Legitimate interest: where the processing is necessary for the legitimate interests of the data processor or that of a third party, unless those interests, rights and freedoms are overridden by the rights of the individual. The VCT’s objective is to provide grants to fund short breaks for those in need of convalescence, recuperative care or respite care. It also makes grants for the provision of essential goods and services. It therefore needs information to enable it to assess whether or not the applicant is eligible for a grant. We process information about applicants and their dependants on this basis. This does not include special categories of information such as medical data.
• Consent: where consent has been given by the applicant. We ask all applicants to confirm their consent to our processing their sensitive information, such as medical data. They may withdraw their consent at any time, but, if they do, we shall not be able to consider their application.
5. The personal information we collect and sources of information
Applications for grants must be submitted on the Trust’s online application form by a health or social care professional or by an organisation specified on our website. The form requests information about the applicant’s circumstances as follows:
• Date of birth
• Telephone number (if goods or services have been requested)
• If applicable, carer’s details, ie name, date of birth, address, medical conditions
• If applicable, names and dates of birth of all others residing in the household
• Type of accommodation, eg house, flat, bedsit, supported living
• Whether the applicant is an asylum seeker
• Information about how the applicant’s ill health or disability impacts upon activities of daily living
• Reasons why the applicant is in need of a short break or goods or services
• Details of support provided by the statutory services, ie care package, personal budget or direct payments
• Details of support provided by health and social care professionals
• Financial statement of all income and expenditure
6. How we use the information
The personal information we collect from applicants is taken into account by the Grants Co-ordinator in assessing whether or not the applicant qualifies for a grant and, if so, the amount of the grant.
If we are not provided with certain information when requested, we may not be able to perform our legal obligations or carry out all activities regarding your application.
It is important that the personal information we hold about you is accurate and up to date. Please keep the organisation through which you have submitted your application (eg your health or social care worker or organisation) informed if your personal information changes during your application or relationship with us.
7. Protecting personal information
All grant application forms are seen only by the Grants Co-ordinator. They are stored on a password protected database at the Grant Co-ordinator’s office. We ensure that there are relevant controls on our website and all our online records are protected by encryption.
The Grants Co-ordinator prepares regular reports for the trustees on grants made. To protect the applicants’ privacy, these reports and other statistics do not include their names.
Where personal information cannot be stored securely on an electronic device, it will be stored in paper format. Such paper records will be kept securely.
8. Retention of data
At the end of each calendar year, when all applications have been processed, any paper records are stored at a secure location operated by a third party. They are retained for six years and then shredded as confidential waste by the storage company.
Electronic records of personal information will also be retained for six years and then deleted.
9. Sharing of information
If we award a grant, we need to give the applicant’s details to the organisation providing short break accommodation or supplying essential goods or services. Only the minimum essential information will be disclosed.
We will not normally be required to share information with other agencies or organisations. If this does become necessary, we shall only share it:
(a) Where permission has been given by the person whose information it is; or
(b) Where the information is to be shared with the police or other agencies and we have concerns about that person or someone else, at risk children and adults or where we are required to share the information under a Court order or other regulation or legislation.
The information shared will be restricted to the minimum required.
We shall never use or share personal information for marketing purposes.
Data is also held by RPG Crouch Chapman LLP, the accountants who prepare financial information for the trustees and the VCT’s annual accounts. Confidential information is recorded on systems separate from the accounting records and the processing is operated independently.
10. Data breaches
A data breach under the GDPR is a failure pertaining to personal information and data that does not meet the requirements of the GDPR and other supporting legislation. This can include unlawful disclosure of personal information, the recording or sharing of inaccurate personal information and the unlawful processing of personal information.
The VCT has a clear process in place to respond and notify all parties where a data protection breach has been identified.
11. The rights of the individual
The GDPR provides the following rights for individuals:
• The right to be informed about the collection and processing of their personal information;
• The right of access to their personal information;
• The right of rectification of inaccurate or incomplete information;
• The right of erasure of their record;
• The right to restrict processing;
• The right to data portability;
• The right to object to the processing of their data; and
• The right to challenge automated decisions.
If you want to exercise any of these rights, please contact the Grants Co-ordinator by e-mail or telephone (contact details are at section 12 below). The information requested will be provided free of charge within the time limits required by law.
The Trust may be contacted as follows:
– by e-mail: email@example.com
– via our website: victoriaconvalescenttrust.org.uk
– by telephone: 020 8502 9339
– by letter: The Grants Co-ordinator
Victoria Convalescent Trust
62 Wilson Street
London EC2A 2BU
An applicant who is dissatisfied with the way the Trust has handled his or her personal information may contact:
The Information Commissioner’s Office
Telephone: 0303 123 1113