How your information will be used

1. When you volunteer for us, Crisis needs to keep and process information about you. The information we hold and process will be used for our management and administrative use only.
2. We will keep and use it to enable us to run our charitable business and manage our relationship with you effectively, lawfully and appropriately, during:
   1. the recruitment process,
   2. whilst you are volunteering for us,
   3. at the time when your volunteering ends and
   4. after you have left.
3. This includes using information to enable us to comply with our agreement with you, to comply with any legal requirements, pursue the legitimate interests of Crisis and protect our legal position in the event of legal proceedings. If you do not provide this data, we may be unable in some circumstances to comply with our obligations and we will tell you about the implications of that decision.

The lawful basis that enables us to process your information

4. We process your information to enable you to volunteer at Crisis at Christmas and support our relationship with you. The most obvious example is the recording of your contact details in order to notify you of your volunteer shifts and of any information relating to your volunteer experience.
5. Where the processing is necessary in order to comply with a legal obligation: for example, complying with health and safety law in certain circumstances;
6. Where the processing is necessary for our ‘legitimate interests’: This ground enables us to process your personal data where we have a legitimate interest (more than simply an economic interest) which is not outweighed by your right to privacy and such processing is necessary in pursuing that interest. For example, to prevent fraud, administrative purposes or reporting potential crimes. We will never process your data where these interests are overridden by your own interests.

Where do we get your information from?

7. All of the information we hold will have been provided by you. The sort of information we hold includes:
   1. your online application form with your personal details
   2. a volunteer agreement if you are a Senior Volunteer
   3. correspondence with or about you, for example emails to Shift Leaders that may mention your name
   4. contact and emergency contact details;
   5. records of absence;
   6. information needed for equal opportunities monitoring policy including protected characteristic information; and
   7. records relating to your volunteering history with us, such as training records;
8. Where necessary, we may keep information relating to any support needs you have notified us of. This information will be used to comply with our health and safety obligations – to consider how your health affects your ability to volunteer with us and whether any adjustments to your role might be appropriate.
9. We process limited special categories of information relating to your racial or ethnic origin for the purposes identified in section 7(f) above.
10. Where we are processing data based on your consent, you have the right to withdraw that consent at any time.

Sharing and keeping your personal information

11. Other than as mentioned below, we will only share (disclose) information about you to third parties if we are legally obliged to do.
12. Your personal data will be stored for a period of four years from when you last completed a volunteer application online. If you did not complete an application, we will delete your data after 2 years from you last logged in to the online system.

Your Rights

13. Under the Data Protection Act 2018 (DPA) you have a number of rights with regard to your personal data. You have the right to:
    1. request from us access to and rectification or erasure of your personal data,
    2. the right to restrict processing,
    3. object to processing as well as in certain circumstances the right to data portability.
14. If you have provided consent for the processing of your data you have the right (in certain circumstances) to withdraw that consent at any time which will not affect the lawfulness of the processing before your consent was withdrawn.
15. You have the right to lodge a complaint to the Information Commissioners’ Office if you believe that we have not complied with the requirements of the GDPR or DPA 2018 about your personal data. They can be contacted via their website https://ico.org.uk/concerns/handling/, but we would prefer that you discuss concerns with either your line manager, our HR team or our own data protection officer before escalation to the regulatory body.

Identity and contact details of controller and data protection officer

16. Crisis is a data controller of data for the purposes of the DPA 2018 and GDPR.
17. If you have any concerns as to how your data is processed, you can contact our Data Protection Officer Beverley Adams-Reynolds data.protection@crisis.org.uk. Beverley is based at our London Head Office.