Privacy Policy Medrwn Môn Privacy Notice Introduction The aim of Medrwn Môn is to promote and support volunteering, voluntary and community organisations by working with individuals, groups and communities on Anglesey to ensure they play a full and prominent role in developing the potential of the Island. Our use of personal information allows us to make better decisions and ultimately helps us to achieve our vision. Medrwn Môn treats privacy and confidentiality very seriously, and we have developed this privacy notice in order to be as transparent as possible about the personal information we collect and use. Who are we? Medrwn Môn is the Voluntary Council for Anglesey, providing support and advice to voluntary organisations and community groups enabling them to work more effectively. Medrwn Môn is a member of the Third Sector Support Wales (TSSW). TSSW is a collaboration between Wales Council for Voluntary Action (WCVA) and the 19 County Voluntary Councils (CVCs) in Wales. Our shared goal is to enable the third sector and volunteers across Wales to contribute fully to individual and community well-being. What this Notice Covers? We ask that you read this privacy notice carefully as it contains important information about: How we collect your personal information The personal information that we collect and use The lawful bases we rely on to collect and use personal information Why we collect and use personal information Sharing your personal information When we transfer personal information outside the European Economic Area (EEA) How long we keep information How we ensure personal information is secure; and Your privacy rights. You should ensure that you read this general privacy notice alongside any specific privacy notice we may issue to you, from time to time, in relation to your information. How we collect information We collect information in the following ways: You may give us your information in order to: become members of Medrwn Môn; sign up for our newsletter - Dan Do Môn; join our Third Sector Network; answer questionnaires; apply for funding; receive services from Môn Community Linc and Car Linc Môn; information fairs and community events; register for training; sign up to our e-mail notifications, or otherwise communicate with us. When you use our website, we collect your personal information using “cookies” and other tracking methods. We will ask you to consent to our use of cookies when you first visit our website. A cookie is a file containing an identifier (a string of letters and numbers) that is sent by a web server to a web browser and is stored by the browser. The identifier is then sent back to the server each time the browser requests a page from the server. Cookies may be either "persistent" cookies or "session" cookies: a persistent cookie will be stored by a web browser and will remain valid until its set expiry date, unless deleted by the user before the expiry date; a session cookie, on the other hand, will expire at the end of the user session, when the web browser is closed. Cookies do not typically contain any information that personally identifies a user, but personal information that we store about you may be linked to the information stored in and obtained from “cookies”. Your data may also be available to our website provider to enable us and them to deliver their service to us, carry out analysis and research on demographics, interests and behaviour of our users and supporters to help us gain a better understanding of them to enable us to improve our services. This may include connecting data we receive from you on the website to data available from other sources. Your personally identifiable data will only be used where it is necessary for the analysis required, and where your interests for privacy are not deemed to outweigh their legitimate interests in developing new services for us. In the case of this activity the following will apply: Your data will be made available to our website provider. The data that may be available to them include any of the data we collect as described in this policy. Our website provider will not transfer your data to any other third party, or transfer your data outside of the EEA. They will store your data for a maximum of 7 years. This processing does not affect your rights as detailed in this privacy policy. If you wish to give us personal information about another person, please speak to us to ensure that you are legally entitled to give us the information and for advice on informing that person. Your information may also be shared with us by third parties. Social Media Depending on your settings or the privacy policies for social media and messaging services like Facebook or Twitter, you might give us permission to access information from these services, for example when you publicly tag us in an event photo. Categories of Personal Information that we hold The personal information that we collect includes: Your name Your contact details (including postal address, telephone number, e-mail address and/or social media identity) Your date of birth Your gender If you apply for a job with us, information necessary for us to process these applications and assess your suitability (which may include things like employment status, previous experience depending on the context, as well as any unspent criminal convictions or pending court cases you may have) If you apply for funding, information necessary to process your application, such as bank details, and the financial history of your organisation If you volunteer to a be a driver with Car Linc Môn, you will also need to provide us with your date of birth, national insurance number, driving licence information and your bank details in order to process payments. We will ask for your consent to collect information about any medical conditions that may affect your ability to drive. We will also need your name and date of birth to carry out a Disclosing and Barring Service (DBS) check. Information about your activities on our website and about the device you use to access these, for example your IP address and geographical location Information about events and activities that you have shown an interest in Information relating to your health (for example if you are taking part in or attending an event for health and safety purposes) Age, sexual orientation, disability and nationality and ethnicity information for monitoring purposes; and Any other personal information you provide to us. Certain types of personal information are in a special category under data protection laws, as they are considered to be more sensitive. Examples of this type of data include information about health, race, religious beliefs, political views, trade union membership, sex life or sexuality and genetic/biometric information. We only collect this type of information about you to the extent that there is a clear reason for us to do so or where you make it public or volunteer it to us. Wherever it is practical for us to do so, we will make it clear why we are collecting this type of information and what it will be used for. The lawful basis for processing personal information We will only store your personal information where we can do so lawfully. The data protection legislative framework provides for a limited number of reasons for processing personal information. We are relying on the following lawful bases to process general information: Where we have your consent Where our processing of your personal data is in the public interest Where our processing of your personal data is necessary for our legitimate interests or those of a third party and are not overridden by your privacy rights The data protection legislative framework contains specific provisions that enable us to process information about your gender, racial or ethnic origin and physical or mental health or condition in order to monitor diversity on an anonymised basis. Why do we collect and use personal information? The main purpose of keeping personal information is to enable us to manage our communications with people and organisations that wish to hear from us. We also collect and use personal information: to provide you with the services or information you asked for; to respond to or fulfil any requests, complaints or queries you make to us; to better understand how we can improve our services or information by conducting analysis and questionnaires; to send you correspondence and communicate with you, including updating your contact details; to generate reports on our work, services and events; to safeguard our staff and volunteers; to process your application for a job or volunteering position; to audit and administer our accounts; to meet our legal obligations to government and/or law enforcement bodies; to undertake background checks including checking identity and checks undertaken for anti-money laundering, anti-terrorism reasons, financial and reputational checks; to otherwise carry out the day-to-day operations of our organisation efficiently including managing our financial position, capability, planning, communications, corporate governance and audit; to train and develop our staff and volunteers; to prevent and respond to actual or potential fraud or illegal activities; to establish, exercise or defend our legal rights or for the purpose of legal proceedings in which we may be involved. We can send communications that we think will be of interest to you be email, phone, SMS, post, social media and other digital channels. Sending marketing communications Our marketing communications include information about our work and services. We operate an ‘opt-in only’ communication policy for electronic communications. This means that, except as set out below, we will only send electronic marketing communications to those that have explicitly stated that they are happy for us to do so. Sharing your personal information Where necessary and lawful, or when required by legal obligation, we may share information with: contractors, associates or representatives of the person whose personal data we are processing, next of kin, healthcare, social and welfare organisations educators and examining bodies financial organisations government agencies debt collection and tracing agencies service providers local and central government ombudsman and regulatory authorities press and the media professional advisers and consultants courts and tribunals trade unions political organisations credit reference agencies professional bodies survey and research organisations police forces housing associations and landlords voluntary and charitable organisations religious organisations students and pupils including their relatives guardians, carers or representatives data processors other police forces regulatory bodies courts, prisons customs and excise international law enforcement agencies and bodies security companies partner agencies approved organisations and individuals working with the police licensing authorities healthcare professionals law enforcement and prosecuting authorities legal representatives defence solicitors police complaints authority the disclosure and barring service (DBS). OUR DATABASE (CRM) – We may also share the personal information contained in our Client Relationship Management (CRM) database with a third party. Our database is managed by WCVA, but the information in the database is held on behalf of all the members of TSSW i.e WCVA and the CVCs in Wales together. We are joint data controllers of the personal information contained in the database. We have entered into a Memorandum of Understanding (MOU) that governs our relationship in connection with the database. We may also run anonymised aggregated reports off the database and share these with the TSSW, the WCVA, the Welsh Government, local authorities, health boards and the Charity Commission. These reports may also be published. We will not share your personal information with these bodies or give them access to the “raw” data on which the reports are based without your permission. The TSSW members may appoint an external researcher to help us with this work, who would have access to the information contained in the database. TSSW may also appoint an internal or external evaluation to assess the effectiveness of the database. The evaluator would have access to the personal information contained in the database, but would not be able to use any of the information. We do not transfer personal information contained in the database outside the European Economic Area (EEA). The service provider we use to help us provide the database is not based outside the EEA. We do not sell, rent or otherwise make personal information commercially available to any third party. For how long do we keep personal information? The data protection legislative framework places an obligation on us to review the length of time for which we keep personal information. We are only able to keep your personal information for as long as it is necessary for us to do so. We only intend to keep your information in an identifiable form in the CRM database while you remain happy to keep receiving communications from us. We have no current plans to delete your information. Your privacy rights You have a number of rights in relation to the personal information we hold about you. If you wish to exercise any of the rights, please contact Medrwn Môn in one of the ways mentioned below: You have a right of access to the personal information we hold about you You have the right to correct any information we have about you that you think is wrong or incomplete You have the right to object to our use of your personal information for direct marketing purposes. If you no longer want to receive communications from us, please contact us. We will stop sending you communications, but will continue to keep a record of you and your request not to hear from us. You have the right to ask us to delete your information. You should be aware that if we do this, we will have no record of the fact that you have asked not to receive communications from us. It is therefore possible that you may start receiving communications from us at some point in the future, if we obtain your details from a different source. Where our processing of your personal information is based on your consent, you have the right to withdraw it at any time. Please contact us if you want to do so. Contact Details These are Medrwn Môn’s contact details: E-mail: [email protected] Phone: 01248 724944 How to complain Please let us know if you are unhappy with how we have used your personal information by contacting us. You also have the right to complain to the Information Commissioner’s Office. Find out on their website how to report a concern: https://ico.org.uk/make-a-complaint Changes to this Privacy Notice This privacy notice was last updated on 10.10.19. We keep this privacy notice under regular review and may change it from time to time by updating this privacy notice in order to reflect changes in the law and/or our privacy practices. We would encourage you to check this privacy notice for any changes on a regular basis. ***************************** Please note that we have a separate Privacy Notice for our Môn Community Link project.