Last Reviewed:                                  24/04/2018

Next Review:                                     25/04/2019

  1. INTRODUCTION
  2. ABOUT US
  3. WHAT INFORMATION WE COLLECT & HOW WE USE IT
  4. HOW WE USE INFORMATION
  5. DISCLOSING AND SHARING DATA
  6. MARKETING
  7. HOW WE PROTECT DATA
  8. STORAGE OF INFORMATION
  9. KEEPING YOU IN CONTROL
  10. CHANGES TO THIS PRIVACY POLICY

1. INTRODUCTION

INNER FLAME is committed to protecting your privacy and security. This policy explains how and why we use your personal data, to ensure you remain informed and in control of your information.

We will never sell your personal data and will only ever share it with organisations we work with where necessary and if its privacy and security are guaranteed.

Any questions you have in relation to this policy or how we use your personal data should be sent to

INNER FLAME Data Protection

email: data@innerflame.org.uk

post: Inner Flame, Data Protection, The Shaftesbury Centre, Percy Street SWINDON SN2 2AZ

telephone: +44 (0) 7531 473 482

2. ABOUT US

Inner Flame is a local Charity based in Swindon and Bath, whose aim is to improve the life chances of young people (aged 16-25) who are at a disadvantage, through a personal journey of challenging development programmes that build confidence, resilience and self-esteem.

3. WHAT INFORMATION WE COLLECT & HOW WE USE IT

Inner Flame collects information from students, staff, volunteers and supporters (members of the public who have offered us help or shown an interest in Inner Flame) in a number of ways:

Staff & Volunteers

For staff and volunteers we collect and process personal contact details, application data & background checks, relevant financial information, biometric data (photo and personality profiling) and we maintain a full staff record.  This information enables us to carry out all the necessary HR processes to run Inner Flame.

The data is only kept as long as is required. In most cases, this is for the duration of employment and up to 6 months thereafter for administrative processing and to enable us to reinstate the individual if required. In exceptional circumstances, such as where the individual leaves because of a disciplinary procedure, we may keep the records for up to 3 years or longer in the case of an alleged criminal offence having taken place.

After the given period of time the employee/volunteer’s record will be reduced to a minimum to enable us to keep accurate historical records.

The legal bases for collecting data are:

  • on the basis of Contract or
  • on the basis of Legitimate Interests or
  • on the basis of your Consent (once the duration of employment has ended)

Students
At Inner Flame we hold and process the personal data of students including personal details, family and social circumstances, education and training records, employment information and services provided.

Inner Flame may obtain, hold and process the sensitive personal data and special category data of students including racial or ethnic origin, religious or philosophical beliefs, biometric data and physical or mental health.

This data is used to help us provide the best possible support for the individual and to formulate our business strategies going forward. We also have a contractual obligation to provide certain data to our funding providers and awarding bodies, without which the courses could not run.

The legal bases for collecting data are:

  • on the basis of Contract or
  • on the basis of Legitimate Interests or
  • on the basis of your Consent

Supporters
For others who work with and / or support Inner Flame

The legal basis for collecting and processing your data is either:

  • on the basis of your Consent, or
  • on the basis of Legitimate Interests

Personal data you provide: We collect data you provide to us. This includes information you give when showing an interest in supporting Inner Flame (name, email, address, telephone).

Financial data: We process cheques, bank transfers and online payments, but we do not collect or retain your financial data, only a record of transactions.

Sensitive personal data: We do not collect or store sensitive personal data from supporters (such as information relating to health, beliefs or political affiliation).

4. HOW WE USE INFORMATION

Marketing: We may process personal data to communicate with supporters. This includes emailing Newsletters, invitations to events and general communications.

Administration: We use personal data for administrative purposes. This includes:

  • maintaining a database of our supporters and their interactions with Inner Flame;
  • helping us respect your choices and preferences

5. DISCLOSING AND SHARING DATA

We will never sell your personal data.  At the start of each course, students will be required to fill in one or more enrolment forms, Profile forms or other entry forms. The data controllers for these forms are the Funding Partners or the Prince’s Trust.

We use Microsoft software for processing data, Outlook for email and Google for file storage and questionnaire responses. Microsoft and Google participate in and have certified their compliance with the EU-U.S. Privacy Shield Framework and the Swiss-U.S. Privacy Shield Framework.

We also use our CRM system for storing data. This is provided and supported by Green Inc. (EU) Ltd, Bowman House, Whitehill Industrial Estate, Whitehill Lane, Royal Wootton Bassett, Swindon, Wiltshire, England, SN4 7DB.

6. MARKETING

From 25 May 2018 Inner Flame will ask its supporters to consent to receive most communications. This includes all our marketing communications: E-Newsletter, our Events and Activities (including fund-raising, workshops and Presentations).

This means you’ll have the choice whether to receive these messages or not and be able to select which you want to receive, and how you want to receive them (post, phone, email).

You can decide not to receive communications or change how we contact you at any time. If you wish to do so please contact Data Protection by:

email: data@innerflame.org.uk

post: Inner Flame, Data Protection, The Shaftesbury Centre, Percy Street SWINDON SN2 2AZ

telephone: +44 (0) 7531 473 482

We will seek specific consent to publish photographs of learners or supporters for Inner Flame purposes.

7. HOW WE PROTECT DATA

We employ a variety of physical and technical measures to make sure your data is protected from unauthorised access, loss, manipulation, falsification, destruction or unauthorised disclosure.

Electronic data and databases are stored on secure computer systems.

8. STORAGE OF INFORMATION

Where we store information: Inner Flame is based in the UK and we store our data within the European Union. Some organisations which provide services to us (Microsoft, Google) may transfer personal data outside of the EEA, but we’ll only allow them to do so if your data is adequately protected.

How long we store information: We will only use and store information for as long as it is required for the purposes for which it was collected. How long information will be stored depends on the information in question and what it is being used for. For example, if you ask us not to send you marketing emails, we will stop storing your emails for marketing purposes (though we’ll keep a record of your preference not to be emailed).

We are required by law to keep certain learner records for a period of 13 years. We reduce some records to a bare minimum for the purpose of recording the history of Inner Flame. We strip other data (such as feedback forms) of any identifying information for the purposes of using them for anonymous statistical analysis.

We continually review what information we hold and delete what is no longer required.

9. KEEPING YOU IN CONTROL

We want to ensure you remain in control of your personal data. Part of this is making sure you understand your legal rights, which are as follows:

  • the right to request access to your information stored and processed by us.
  • the right to have your data deleted. Students please note, we cannot fulfil your enrolment contract without holding and processing your data. Staff please note, we cannot fulfil your employment contract without processing your personal data.
  • the right to have inaccurate data corrected;
  • the right to object to your data being used for purposes other than those for which it has been collected.
  • Inner Flame does not use automated decision-making or profiling of personal data.

If you would like further information on your rights or wish to exercise them, please contact us:

email: data@innerflame.org.uk

post: Inner Flame, Data Protection, The Shaftesbury Centre, Percy Street SWINDON SN2 2AZ

telephone: +44 (0) 7531 473 482

If you are not happy with our response, or you believe that your data protection or privacy rights have been infringed, you can complain to the UK Information Commissioner’s Office which regulates and enforces data protection law in the UK. Details of how to do this can be found at www.ico.org.uk

10. CHANGES TO THIS PRIVACY POLICY

We’ll amend this Privacy Policy from time to time to ensure it remains up-to-date and accurately reflects how and why we use your personal data. The current version of our Privacy Policy will always be posted on our website www.innerflame.org.uk.

This Privacy Policy was last updated on 24 April 2018.