CONFIDENTIALITY AND DATA PROTECTION (PRIVACY) POLICY

River Thames Boat Project (“we”, “us” or “our” in this policy) respects your privacy and is committed to protecting your personal data.

River Thames Boat Project is the controller and responsible for your personal data.

Our policies are reviewed annually by our trustees who may change this and other policies from time to time. Changes may be made without prior notice but will not be made retrospectively. Policies are available to view on demand by writing to the office at info@thamesboatproject.org.

This policy describes how we collect and process personal data, or personal information, that you supply to us.

Contact Details
If you have any questions about this privacy policy or our privacy practices, please contact us in the following ways:
Full name of legal entity: River Thames Boat Project
Email address: info@thamesboatproject.org
Postal address: Trowlock Way, Teddington, TW11 9QY, Attention: Pippa Butterfield
You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.
What information we collect

You may supply us with personal information, both about you and others. This may include a name, address, telephone number and email information for you, a service user for whom you are responsible, or an emergency contact. We may also have your date of birth, gender information, bank payment information (but not payer bank details), information about special skills and volunteer preferences and information on your use of our charitable facilities, activities and other services.

This information may be given to us in person, by post, or through our website or you may make an enquiry through one of our forms (printed or web-based). We will store and collect this information.
We do not collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.

What we do with your personal information

We use your personal information for one or more of the following purposes, and for those purposes alone may share your personal information with other third parties acting on our behalf:

● To provide you with information about our activities and services or to respond to any enquiry or complaint you may make to us;
● For our own administrative purpose, including training our staff and volunteers and conducting internal audits;
● For collecting outcomes data or for market research purposes, where we may contact you to ask for your feedback on what we do;
● For legal and regulatory compliance purposes; and
● To prevent or detect abuses of our website or information systems.

We will get your express opt-in consent before we share your personal data with any third party for marketing purposes. If, at any time after you have consented to our using your personal information for marketing purposes, you wish us to stop using your information for these purposes, please email us info@thamesboatproject.org or write to us at the address given in Contact Details.

No personal data about trustees, staff, volunteers and clients may be disclosed to third parties except as required by law or with the specific consent of the relevant individual or organisation.

However, anyone within our trustee, staff and volunteer network may freely share, for the purposes of our work only, names, mobile numbers and email addresses between themselves.

Grounds for processing your personal information

To process your personal information lawfully we need to rely on one or more valid legal grounds. For example:

● our legitimate interests as an organisation (except where your interests or fundamental rights override these). For example, it is within our legitimate interests to use your personal information to prevent or detect fraud or abuses of our website;
● the need to use the information in connection with your booking of one or more of our activities, your volunteering, your subscription to our Friends scheme, or your rights as a Member of the Charity;
● to comply with contractual requirements, for example in relation to our insurance policies;
● for our compliance with a legal obligation to which we are subject, for example in reporting to our regulators or any relevant authorities (such as HMRC); and
● with your consent to our using your personal information for our marketing purposes, such as using your photos or videos on our website and social media pages and informing others (such as potential service users, volunteers or Friends) about what we offer.

Storage and retention of personal information

Trustee, staff, volunteer and client personal data are kept confidential in the office, on our password-protected office systems. Personal data is only accessible by members of staff and specific named trustees for the purposes listed above.

Your personal information will be retained for as long as it is necessary to carry out the purposes set out in the policy, unless longer retention is required by law, but not beyond this period. The retention of your personal information will also be subject to periodic review. If we decide that we are no longer entitled to do so, we will stop processing your personal data except that we may retain it in an archived form in order to be able to comply with future legal obligations, such as compliance with tax requirements and exemptions, and in connection with legal claims. We may keep an anonymised form of your personal information, which will no longer refer to you, for statistical purposes without time limits, to the extent that we have a legitimate and lawful interest in doing so.

Photographs and video recordings

Clients are asked whether or not they grant consent for photographs or recordings to be used by us on the booking form they submit with their payment.

Photographs or recordings of staff and volunteers may be used for marketing, PR, on social media or for other publicity purposes by us with the consent of the relevant individual (a general consent for these purposes may be given, for example, by a volunteer in writing when they are engaged by us but such consent may be withdrawn at any time by notice in writing to us).

Photographs or recordings are held in accordance with our storage and retention policy described above.

Legal rights

Data protection law provides individuals with certain rights, including the right to: access, rectify, withdraw consent, erase, restrict, transport and object to the processing of their personal information. Individuals also have the right to lodge a complaint with the relevant information protection authority if they believe that their personal information is not being processed in accordance with the law. Further information about individual rights is available at https:/ico/org.uk.

18 March 2019