Volunteers privacy policy

1.1.
This policy applies to all volunteers of the Royal Society for the Protection of Birds (charity no. 207076 in England and SC037654 in Scotland with data controller number Z5794583) and RSPB Sales Limited (a private limited company with registration number 2693778 and data controller number Z5539068) (together referred to as “RSPB” or “we”, “us” or “our”). 

1.2.
This policy is to be read alongside the information in the publication ‘A little of your time goes a long way’, the Staff Privacy Policy and its public Privacy Policy which sets out how RSPB collects and uses the personal data of customers, other supporters and staff.

1.3.
The RSPB may supplement or amend this policy by additional policies and guidelines from time to time.

2.1.
In this policy: 

“personal data” means any information which relates to an identifiable individual. This includes (but is not limited to) name, address, contact details, financial information, likes and dislikes and interests. It also includes work/volunteering history and appraisals, expressions of opinion about someone and any indication of someone else’s intentions towards a person; 

“sensitive personal data” means personal data about an individual’s racial or ethnic origin, political opinions, religious or similar beliefs, trade union membership (or non-membership), physical or mental health or condition, biometric or genetic information, information about sexual life, criminal offences or proceedings; and 

“processing” means obtaining, recording, holding or doing anything with data, such as organising, using, altering, retrieving, disclosing or deleting it. 

3.1.
RSPB decides how and why it processes volunteer personal data and, for the purposes of data protection law, RSPB is the controller. We will only process personal data in accordance with data protection law (including the General Data Protection Regulation) and with respect for the rights of the individuals involved.

3.2.
When processing personal data, we will ensure that we: 

• do so fairly, lawfully and in a transparent manner; 

• only process the data for specified purposes, and we will make sure the personal data are adequate, relevant and not excessive for that purpose; 

• only collect and process personal data to the extent necessary; 

• keep personal data accurate and up to date (where necessary); 

• keep personal data for no longer than is necessary; and 

• protect the security, confidentiality and integrity of personal data.

3.3.
We will also record and document our processing, so we can account for these activities and demonstrate that we have complied with our obligations.

4.1.
We will collect, store and use the following categories of personal data about you: 

• Contact details such as: name, title, addresses, telephone numbers, mobile phone numbers and personal email addresses; 

• Date of Birth; 

• Gender; 

• Next of kin and emergency contact information; 

• Bank account details (when necessary) for example, to reimburse legitimately incurred expenses; 

• Copy of driving licence, passports and visas (when necessary); 

• Recruitment information (including references and any other information enclosed in a CV or disclosed in the application process); 

• Performance information, training records, meeting minutes and appraisals; 

• Disciplinary and grievance information; 

• CCTV footage and other information obtained through electronic means (such as cash donation paying-in cards); 

• Testimonies, quotes or opinions about volunteering with the RSPB; 

• Information about your use of our information and communication systems; 

• Photographs, video and audio footage; and 

• Information gathered from social media sources in the public domain eg Facebook. 

4.2.
We may collect, store and use the following special categories of personal data about you: 

• Information about your ethnicity, religious beliefs, sexual orientation and political opinions; 

• Information about your health including any medical conditions or dietary requirements; 

• Information about criminal convictions and offences 

• Information required and related to DBS or PVG checks or any other background checks associated with vulnerable individuals. 

5.1
5.1.1 We collect personal data about volunteers through the volunteer enquiry and recruitment process. We may sometimes collect additional information from third parties including former or current employers (e.g. referees or if you are a corporate volunteer your employer may supply your data, occupational health providers or background check agencies for example DBS (and Volunteer Scotland for PVG checks).  

5.1.2 Equality, Diversity & Inclusion (“EDI”) Data - 
We collect EDI data through your answers to the Diversity information-questions on your application form or when update your Diversity details via the “DETAILS” tab on your profile. While your information remains being treated as confidential, Diversity details could be seen by the Assemble System Administrator who has been given a password-protected & access-only permission for Diversity administration. This is to enable the efficient running and administration of the system in relation to EDI Administration 

6.1.
We collect and process personal data about our volunteers in order to facilitate their volunteer role and for volunteer-related purposes (e.g. volunteer welfare, equal opportunities monitoring, administrative purposes, financial, regulatory, business development and for information strategy). These purposes are explained in more detail in this policy.

6.2.
We will only process personal data about our volunteers for the relevant purposes (when the law permits us to): 
 
if the processing is necessary for: 

• the performance of the agreement we have entered with you (this does not amount to a contract of employment); 

• our (or a third party’s) legitimate interests (provided these are not overridden by your fundamental rights and interests), in particular: 

• to administer our relationship with you; 

• to build a picture of your skills, experience and interests in order to assess your suitability for volunteering projects; 

• the protection of your vital interests (e.g. in a ‘life or death’ scenario); 

• compliance with a legal obligation, or 

• with your consent 

6.3.
Where we process your personal data for our legitimate interests, we will make sure that we consider and balance any potential impact on you (both positive and negative), and your rights under data protection laws. Our legitimate interests do not automatically override your interests – we will not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required to or are permitted by law). You have the right to object to this processing if you wish, and if you wish to do so, then please contact us at dpofficer@rspb.org.uk.

6.4.
We will only use your personal data for the purposes we collected it unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and explain the legal basis which allows us to do so. 

6.5.
We may process your personal data without your knowledge or consent, in compliance with the above basis for processing, where this is required or permitted by law.

6.6.
We may process sensitive personal data (also known as ‘special categories’ of personal data) about our volunteers from time to time. This can include (but is not limited to) data relating to your physical or mental health, or EDI data. Whenever we process sensitive personal data, we will take extra care to ensure your rights are protected and your information is kept safe. 

6.7.
We will only process special categories of personal data with your explicit consent, or if there are other grounds for doing so, including (but not limited to) the processing being: 

• necessary to carry out obligations or exercise rights regarding volunteering (for example, processing medical or health information to assess your suitability for volunteering with us and for being involved on specific projects and in order to accommodate you in a voluntary role); 

• necessary to protect your vital interests (or someone else’s interests); 

• necessary to comply with a legal obligation (for example, to protect vulnerable individuals or for insurance purposes); 

• in relation to personal data which you have made public; or 

• necessary for bringing, defending or conducting a legal claim. 

 
6.8.
We process personal data because we need to do so to run the RSPB, to exercise our rights and obligations, and to comply with legal and regulatory duties we are under. 

6.9.
If you fail to provide certain information when requested, object to the processing of your personal data by us, or refuse to accept from us the communications specified in section 8, we may not be able to register you for or continue to make available to you volunteering opportunities or we may be prevented from meeting our obligations (such as to ensure your health and safety). 

7.1.
This will usually be where such processing is necessary to carry out our obligations. 

7.2.
Less commonly, we may use information relating to criminal convictions where it is necessary in relation to legal claims; where it is necessary to protect your interests (or someone else’s interests) and you are not capable of giving your consent; or where you have already made the information public.

7.3.
Where appropriate we will collect this information as part of the recruitment process or we may be notified of such information directly by you in the course of your voluntary work.

8.1.
There is certain information which the RSPB is required to send volunteers to support and facilitate their voluntary role and any related activities. Volunteers can expect to receive the following communications by email (and sometimes by post), to fulfil their voluntary work for the RSPB: 

• Timesheets; 

• Rotas; 

• Invitations to training events (both local and national); 

• Notifications to take part in training; 

• Sign up to volunteering requests; 

• Invitations to take part in volunteering activities; 

• Booking information (for example, if you are a residential volunteer); and 

• Other communications to facilitate your voluntary work. 

8.2.
Volunteers are also obliged to receive several communications from the RSPB.  These are a fundamental part of your volunteering, in order to support you, thank you, and disseminate information which is pertinent to your role (for example, a Local Group leader and/or committee member will receive News and Views which includes key guidance for the group). Volunteers can expect to receive the following by email or by post: 

• National and Regional Involve; 

• News and Views; 

• Volunteering E-News; 

• Reserve News and Bulletins; 

• Regional Round Ups; 

• Thank you Cards; 

• Long Service Awards; 

• Invitations to the Presidents Awards and other Thank You Events; 

• Invitations to Regional/Country Meetings; 

• the Volunteer Engagement Survey (VES) and other surveys; and 

• we may also follow up with you to request testimonies (and associated photographs and/or videos) of your volunteer experience. 

8.3
The RSPB sometimes works with other organisations (for example, another conservation charity) in partnership as part of a wider project (for example, Colour in the Margins or Back from the Brink). To keep you informed, the RSPB may send you communications which are relevant to the project, additionally, our partners may also send you communications of this nature. 

8.4
If you are a volunteer and a member of the RSPB, this does not affect your data protection rights as a member or the marketing preferences that you provided in your capacity as a member. If you have chosen not to receive marketing communications, as a member, the RSPB will continue to respect your preferences in relation to non-volunteer related marketing.

9.1.
9.1.1 Certain personal data about our volunteers will be made available to other  RSPB employees, and volunteers which is limited to those who have access to  volunteer information. We may publish limited personal data for example,  testimonies/quotes and photographs which may be featured on our internal or  external publications, e.g. our volunteer brochure. 

9.1.2 By reason of the changes introduced to the Assemble system,  the Assemble System  Administrator has permission for access-only to Equality, Diversity & Inclusion Data.  This is to enable the efficient running and administration of the system in relation to  EDI Administration  

9.2. 
Some content, including personal data, may also be held another systems. Where appropriate, access to sensitive information is restricted only to those who have a legitimate business reason to see it. 
 
9.3. 
On occasion may be required to share your personal data with third parties. For more information please see section 10.  

10.1.
The RSPB may be required to share personal data (including, special categories of personal data) with third parties. For example, we may share information with: 

• occupational health providers for undertaking necessary health checks; 

• third party service providers (for example, those who carry out background checks for safeguarding purposes or driving licence checks); 

• Governmental and regulatory bodies (including the police, DBS and Volunteer Scotland); 

• Professional advisers (such as lawyers, accountants, auditors, health advisors and insurance brokers); 

• Trusted suppliers and service providers who will process information on our behalf for administrative purposes, for example in arranging trips for local groups; 

• Trusted partners or organisations when necessary, for example if you are volunteering for a joint project with another organisation, we may need to share your personal data with it. 

10.2.
We will only share personal data with third parties if adequate security measures are taken and your rights are respected. We will never sell your personal data to anyone.

10.3.
If you use a personal computer or electronic device (such as tablet or mobile phone) for your voluntary work purposes (e.g. to access ROBINS if you are a pin badge volunteer), then information about you and your device may be collected.  This may be done by a third party, e.g. if you access your email via an application on your mobile phone the app provider may collect details of your device, phone number and IP address. RSPB will have no control over (or responsibility for) the collection or processing of personal data by third parties arising from the use of a personal device for work purposes and you should read the privacy policy of an application or website you use. 

11.1. 
We use personal data to help us understand our volunteers, employees and organisation. One way in which we do this is through research (e.g. surveys) to gather data on, for example, volunteer satisfaction and identify areas that need improvement. Results may be aggregated or anonymised and used in reports (published internally and/or publicly) about the RSPB. From time to time these might flag up particular issues relating to the welfare or conduct of a particular person, and we may have to look into those situations in more detail.  
 
11.2. 
Information from surveys may include sensitive personal data (e.g., if you complete an equal opportunity survey). We may also combine information from surveys with other information that we hold about our volunteers (which might include, or result in, sensitive personal data). 
 
11.3. 
Certain survey results and information (including annual surveys) may be stored and archived for future use. We do this because compiling statistics over time provides a much more accurate picture of volunteer performance, wellbeing and satisfaction. We can then use this to inform our plans and strategies for the future.  

12.1. 
The use of RSPB’s IT systems (including internet) emails and telephone is monitored to ensure all our workforce including volunteers use our systems properly and to the standards expected, to prevent or detect inappropriate behaviour and crime, and to ascertain compliance with various legal or regulatory requirements. 
 
12.2. 
This information will be collected by the IT team who will report any issues to your line manager and, if necessary, any other senior employees. 
 
12.3. 
If you have an RSPB email account or phone number, it may be necessary to access the email account or voicemail of a volunteer if they are absent to ensure that the RSPB responds properly to communications. The RSPB also reserves the right to inspect any RSPB email or other email or internet activity carried out using RSPB equipment (including RSPB laptops) at any time without notice. 
 
12.4. 
Some of RSPB’s premises have CCTV, and you may be recorded on CCTV during the course of your volunteering with RSPB. CCTV is present for your protection and for the protection of RSPB. CCTV footage will only be viewed and used if it necessary to do so (e.g. to establish the facts surrounding an allegation of misconduct). CCTV surveillance is only stored temporarily and, unless it is flagged for review, tapes will be recorded over on a regular basis. RSPB complies with the CCTV Code of Practice published by the Information Commissioner’s Office and relevant RSPB guidance. 
 
12.5. 
All our workforce, including volunteers, may be checked from time to time through ‘mystery shopping’ which is a research technique, whereby trained individuals experience and measure a volunteer by acting as a potential customer, and report back on their experiences.  The objective of mystery shopping is to provide management with information on the process and/or quality of service in order to aid training plans, improve service, comply with our regulator’s requirements and increase customer satisfaction. 
 
12.6. 
Please note: RSPB vehicles (including company cars), may be fitted with telematics systems (i.e. devices which monitor how a car is driven and record locational and/or other information). This information will be shared with insurers to reduce our insurance costs. We will notify you in advance if the vehicle you drive is fitted with a telematics device.  

13.1. 
To prevent unauthorised access, use or disclosure of personal data we take all reasonable steps to employ a variety of physical and technical measures to keep your personal data safe. Where possible, electronic data and databases are stored on secure computer systems and we control who has access to personal data (using both physical and electronic means). 
 
13.2. 
Personal data may be held locally by those who manage volunteers, for example local group leaders or members of the committee, in which case it is the responsibility of those individuals to ensure all reasonable and appropriate security measures are in place. 

14.1. 
We only store information within the European Economic Area (EEA). If our trusted service providers (e.g. software providers like Microsoft) transfer any data outside of the EEA we will take steps to make sure adequate levels of privacy protection, in line with The General Data Protection Regulation and associated legislation, are in place. 
 
14.2. 
We will only retain your personal data for as long as necessary to fulfil the purpose we collected it for, including the purposes of satisfying any legal, accounting or reporting requirements. 
 
14.3. 
We will process personal data on volunteers for the duration of their voluntary work with RSPB. When a volunteer leaves RSPB, we will continue to retain data for as long as is necessary to: 

• exercise any remaining rights or fulfil any remaining responsibilities required in relation to your voluntary work which still remain (e.g. processing further payments); 

• comply with our legal obligations; 

• for record-keeping and administrative purposes which are in our legitimate interests and which are not overridden by your rights or interests; and 

• for health and safety purposes. 

14.4. 
We continually review what information we hold and delete what we no longer required. Certain special categories of personal data on volunteers will be retained, and in some cases this personal data may be kept for very long periods of time. For example, we may retain information relating to health (e.g. if you have an accident whilst volunteering, in case of a future insurance claim). 
 
14.5. 
If you are suspected or convicted of a criminal offence, we may retain information from our own records, and also other publicly available sources. We do this because it is necessary to do so: 

• in case it is required to bring, defend or conduct a legal claim;  

• to assist in the detection or prevention of crime; and 

• to protect the interests of the general public. 

14.6. 
Certain volunteers are required to undergo criminal record checks. The results of these checks will be stored by the RSPB for the purposes set out above.  

15.1. 
We want to ensure you remain in control of your personal data. Part of this is making sure you understand your legal rights, which are as follows: 

• the right to obtain a copy of the personal data we hold (this is known as subject access request) within 30 days; 

• the right to have your personal data erased (though this will not apply where it is necessary for us to continue to use the data for a lawful reason for example, your data will need to be retained for legal or insurance purposes); 

• the right to have inaccurate personal data rectified; 

• the right to object to your personal data being used for marketing (though this will not apply where it is necessary for us to continue to send you communications, as explained in section 7, as part of your volunteering role, this does not affect your rights in relation to non-volunteer related communications); 

• the right to object to your personal data being used for profiling 

15.2. 
Please keep in mind that there are exceptions to some of the rights above and, though we will always try to respond to your satisfaction, there may be situations where we are unable to do so. Any volunteers who would like request information that the RSPB holds relating to them should contact our Data Protection Officer, (dpofficer@rspb.org.uk) or write to RSPB Data Protection Officer, Corporate Governance and Risk, The Lodge, Sandy Bedfordshire SG19 2DL.

15.3
Data Protection Complaints

15.3.1 If you are not happy with our response, or you have a concern about how your data has been used, stored or shared, or you believe that your data protection or privacy rights have been infringed or that data protection laws has not been complied with, you can raise your complaints with the Data Protection Officer first via the dpofficer@rspb.org.uk. This does not affect your right to complain to the ICO but gives us the firsthand opportunity to investigate your complaint and seek to resolve it.  

15.3.2 The DPO aims to acknowledge all complaint within ten working days of receipt and reply to complaints within 30 working days. Sometimes further investigation is required to allow for resolution of your complaint, if the DPO thinks that this is the case, you will be kept informed with explanation on how long it will take before you receive a reply in full.   

15.3.3 If you are not satisfied with DPO response, or how your complaint has been handled, you should inform the Head of Volunteering, Engagement & Experience who will consult with the Head of Corporate and Legal Service Team for proper investigation and resolution.  

15.3.4 Following this stage, if you are still not satisfied, you should contact the UK Information Commissioner’s Office which enforces data protection law in the UK. Details of how to do this can be found at www.ico.org.uk. 

15.4. 
The RSPB will not charge a fee for you to access your personal data, or to exercise any of the above rights, however, we may charge a reasonable fee if your request is unfounded or excessive. We may refuse to comply with the request in such circumstances. 
 
15.5. 
We may request information from you to help us confirm your identity and ensure your personal data is not disclosed to anyone who has no right to receive it. 
 
15.6. 
Volunteers with any questions or concerns about anything in this policy or how their personal data is used by RSPB should not hesitate to discuss these with the RSPB’s Data Protection Officer as explained in 15.3 above. 
 
15.7. 
We have appointed EU Business Partners as our representatives in the EU for the purposes of Article 27 of the General Data Protection Regulation. You may contact our EU representative, as well as us directly, with any query that you may have in relation to your personal data. The contact details of our EU representative are as follows: 
 
EU Business Partners 
10 Ashe street 
Clonakilty 
Co. Cork 
P85 e403 
Ireland 

Point of contact: Flor McCarthy 
Email: info@eubusinesspartners.com 

16.1.
Any changes in personal circumstances should be notified to your line manager, who will ensure that our records are updated. Such changes would include address, telephone number, etc. 

17.1.
We will amend this Volunteer Privacy Policy from time to time to ensure it remains up-to-date and accurately reflect how and why we use your personal data. The current version of our Volunteer Privacy Policy will always be posted on Assemble, the website and the Intranet.