1. INTRODUCTION
Harmeny is committed to protecting your personal data and this privacy policy states how we collect data, how we store it and how we use it, in line with the General Data Protection Regulation (GDPR) and other relevant legislation.
This privacy policy applies to:
- Children, families and former pupils
- Job applicants
- Employees, consultants, volunteers and trustees
- Fundraising supporters, volunteers assisting with fundraising projects and event participants
- Individuals using our website or our social media channels
Full details for each of the above can be found within the headers below.
Changes to this policy
We may change this Privacy Policy from time to time. If we make any significant changes in the way we treat your personal information, we will make this clear on the Harmeny website or by contacting you directly.
Privacy policy last updated: 28 November 2019
Keeping your information up to date
Where possible we use publicly available sources to keep your records up to date. We really appreciate it if you let us know if your contact details change.
Complaints
If you have any complaints about the way in which we have used your data, please get in touch with us using the details below. We would be happy to help and discuss your concerns.
You are also entitled to make a complaint to the Information Commissioner’s Office and, if relevant, the Scottish Fundraising Standards Panel.
Contact us
If you have any questions about this policy, would like more information, or want to exercise any of the rights set out in section 8 below, you can get in touch with us in the following ways:
Call: 0131 449 3938
Email: [email protected]
Write to: Harmeny Education Trust, Mansfield Road, Balerno, EH14 7JY
External Links
Our website may contain links to other websites run by other organisations of which we have no control over. This privacy policy applies only to our website‚ so we encourage you to read the privacy statements on the other websites you visit.
We cannot be responsible for the privacy policies and practices of other sites even if you access them via links from our website – although all measures are taken to ensure sites are safe at time of linking.
In addition, if you linked to our website from a third-party site, we cannot be responsible for the privacy policies and practices of the owners and operators of that third-party site and recommend that you check the policy of that third-party site.
2. CHILDREN, FAMILIES & FORMER PUPILS
2.1 What information do we collect?
Harmeny holds personal information about you which may include your name, date of birth, address, gender, ethnicity and whether you have a disability, so that we can make sure our services meet your needs. We will also record information about the service provided to you, including case reporting, plans and reviews.
2.2 Why do we collect your information?
Under data protection legislation we must have a legal reason to keep your data and process it. When Harmeny provides you with a service, we will process your data under legitimate interest or public task. We do this because we cannot provide a service to you without using your personal information.
2.3 Who do we share your information with?
We share your data within Harmeny with people who need to see it in order to provide you with a service. We may also share it with the local authority that pays for your service or with external agencies that inspect our work. At the point of your service starting, you will be given information that will provide you with more detail.
We have a legal obligation to share data from 1958 to 1995, relating to former pupils placed at Harmeny during this period, as well as documents relating to the running of the school from then, with Save the Children, who ran the school during this period. We may be required to share your data with other agencies for legal reasons, a court order for example, or with other organisations if we believe that you are at risk of harm or may harm someone else.
There may be occasions when we will ask you for consent to use your data, for example; to help us inform the public about our work. If this is the case, we will explain to you exactly what your data will be used for. You can withdraw your consent at any time, and wherever possible, any of your data that has been used for publicity purposes will be deleted.
2.4 Who is responsible for your data?
The Data Controller is responsible for your data. This may be Harmeny or the local authority that funds the service being delivered by Harmeny. You can get more information about who the Data Controller is for your data by contacting us.
2.5 How long do we keep your data?
Harmeny will keep your data for a specified period of time once we have finished working with you. Depending on the nature of the service and our legal obligations this will be a minimum of 6 years but can extend to 100 years for certain types of work. Information can be provided, on request, which will tell you exactly how long we keep your data and why.
Sometimes Harmeny is required to transfer your data to the local authority who have commissioned us to provide your service, or to another organisation providing you with a service. Information can be provided, on request, which will give you more details about what will happen to your data.
2.6 How can you access your data? (Subject Access Requests)
You may request a copy of the information that Harmeny holds about you by contacting us in writing at:
Harmeny Education Trust, Mansfield Road, Balerno, EH14 7JY
We are required to respond within one calendar month of you asking and may make a small charge for doing so.
See section 8 for further information.
2.7 Access to Records
If you make a request to access our historical records, we’ll collect information to:
- Check your identity
- Keep a record of all enquiries received
- Help locate the information you’ve requested
- Monitor our service
We’ll never share your data with any other organisation, unless required by law, and once we’ve acted upon your request, your identity documents will be securely destroyed.
Any other information in relation to your request, such as notes from meetings, is added to your file and stored according to the data protection legal requirements.
3. JOB APPLICANTS – PAID, VOLUNTEER AND TRUSTEE ROLES
As part of any recruitment process, Harmeny collects and processes personal data relating to job applicants. If you apply for a role with Harmeny, we will only use the information you supply to us to process your application and to monitor recruitment statistics.
3.1 What information do we collect?
We will collect a range of information about you, including:
- Your name, address and contact details, including email address and telephone number
- Details of your qualifications, skills, experience and employment history (including any disciplinary record)
- Information about your current salary
- Whether or not you have a disability for which we need to make reasonable adjustments during the recruitment process
- Information about your entitlement to work in the UK
- Information regarding any criminal convictions and/or offences.
- Equal opportunities monitoring information, including information about your ethnic origin, sexual orientation, health, and religion or belief. We will only collect this sensitive information with your explicit consent, which can be withdrawn at any time.
3.2 How do we collect your personal data?
We collect it in a variety of ways. For example, you may have filled in an application form, or submitted a CV or resumé, you may have provided your passport details or other identification documents, or we may have collected it through interviews or other forms of assessment, like online tests.
We may also collect information about you from third parties, such as references supplied by former employers. Harmeny will only seek information about you from third parties once we’ve made you an offer. In all cases the application process will make clear at what point we will be contacting third parties.
3.3 Where will we keep your data?
Your personal information will be stored, securely, within our website Jobs Section, on your application record and in our HR management system.
3.4 Why do we need your personal data?
We need to process your data in order to enter into a working agreement with you. In some cases we need to process your data to ensure that we are complying with our legal obligations, e.g. checking an individual’s right to work in the UK.
We have a legitimate interest in processing your personal data during the recruitment process and for keeping records of the process. It allows us to manage that process, assess and confirm your suitability for the role and decide whom to offer a role to. We may also need to process data from job applicants to respond to, and defend against, legal claims. Where we are relying on legitimate interest as a reason for processing data, we have considered whether or not those interests override the rights and freedoms of the applicant and have concluded that they do not.
We process health information if we need to make a reasonable adjustment to the recruitment process for the candidates who have a disability, or to determine whether a candidate may have a condition that affects their ability to carry out an intrinsic part of the role. This is to carry out our obligations particularly in relation to child safeguarding, and to exercise specific rights in relation to employment.
For some roles Harmeny is obliged to seek information about criminal convictions and offences. This is necessary to carry out our obligations and exercise specific rights in relation to employment.
Harmeny will not use your personal information for any purpose other than the recruitment exercise for which you have applied.
3.5 How long will we keep your data?
Personal information about unsuccessful candidates – including those who have not been shortlisted and those who have been unsuccessful at interview – will be held for up to one year after the recruitment exercise has been completed, and will then be destroyed unless the candidate requests that they wish for us to keep their information for longer. Interview notes for all unsuccessful applicants are destroyed after six months. We retain de-personalised statistical information about applicants to help inform our recruitment activities, but no individuals are identifiable from that data.
If you set up an account on our online recruitment system, we will hold your data on file until you delete your account, when your data will be deleted and destroyed.
If your application is successful, personal data gathered during the recruitment process will be transferred to your personnel file and will be processed and retained in accordance with your employment contract or volunteer agreement and other applicable human resources and volunteer policies we have from time to time.
3.6 Who has access to your data?
Your information will be shared internally for the purposes of the recruitment exercise. This includes members of the HR team, interviewers involved in the recruitment process, managers in the area with a vacancy and IT staff if access to the data is necessary for the performance of their roles.
As part of the recruitment process we may need to share your data with third parties in order to conduct any necessary background checks and vetting processes, such as contacting previous employers/referees to obtain a reference; and/or the Disclosure Scotland to conduct criminal record checks. We may also share data with the Scottish Social Services Council and/or the General Teaching Council for Scotland, for regulatory purposes. As part of the recruitment process, we will make clear to you which checks will be required and at what stage of the process.
3.7 What if you don’t provide personal data?
You are under no statutory or contractual obligation to provide data to us during the recruitment process. However, if you do not provide Harmeny with the information, we may not be able to process your application properly, or at all.
You are under no obligation to provide information for equal opportunities monitoring purposes and there are no consequences for your application if you choose not to provide such information. The interview panel will not have access to this information, with the exception of any HR representative.
4. EMPLOYEES & CONSULTANTS
If you commence employment with Harmeny Education Trust, your personal information will be processed in accordance with your employment contract and other applicable human resources policies we have from time to time.
5. FUNDRAISING SUPPORTERS, VOLUNTEERS & EVENT PARTICIPANTS
5.1 What information we collect
If you support us, for example, make a donation, help with fundraising, events or volunteering projects, the types of information we collect from you might include:
- Your full name
- Your contact details including your postal address, telephone number(s), and email address
- Records of your correspondence and engagement with us
- Donation history and Gift Aid details
- Your bank or payment card details
- Information relevant to the type of fundraising, events or volunteering project you wish to help with
- Details on individuals, companies or trusts that you have chosen to share with us
- Information you may enter on the Harmeny website
- Photographs, video or audio recordings
- Your occupation
- Biographical information
- Date of birth (where this is required for participation in an event or for young people who wish to help with fundraising, since accompaniment by an adult may be required, depending on the type of fundraising).
Where it is appropriate, we may ask for:
- Information relating to your health (for example if you are taking part in a high-risk event)
- Your motivation for giving, including whether this relates to any personal experience of Harmeny. We will never make this question mandatory, and only want to know the answer if you are comfortable telling us.
5.2 Where we collect information about you from
We collect information in the following ways:
5.2.1 When you give it to us directly
You may give us your information in order to sign up for one of our events, tell us your story, make a donation, volunteer, or communicate with us.
5.2.2 When you give it to us indirectly
Your information may be shared with us by independent event organisers; for example a Marathon organiser or fundraising sites like JustGiving. These independent third parties will only do so when you have indicated that you wish to support Harmeny and with your consent. You should check their Privacy Policy when you provide your information to understand fully how they will process your data.
5.2.3 When you give permission to other organisations to share it
Depending on your settings or the privacy policies for social media and messaging services like Facebook, WhatsApp or Twitter, you might give us permission to access information from those accounts or services. See 5.8 Social media/Digital for more information.
You may also provide permission for third-party organisations to share your data with other third parties, including charities. You may do this when you buy a product or service, register with a website that runs competitions or register with a comparison site.
The information we get from those services depends on your settings or the responses you give, so you should regularly check them.
5.2.4 From publicly available sources
We may combine information you provide to us with information which is publicly available, in particular from online fundraising pages, to gain a better understanding of our supporters and to improve our communications with you. This is because sites such as JustGiving only pass on basic contact details and the amount raised but do not pass on information regarding your motivations in raising funds for the charity.
5.2.5 Through your use of the Harmeny website
Like most websites, we use ‘cookies’ to help us make our site – and the way you use it – better. Cookies mean that a website will remember you. They are small text files that sites transfer to your computer (or phone or tablet). See section 6. Data collected via our website for more info.
We sometimes also collect sensitive, personal data about individuals. This includes information about health and criminal records. We will normally only record this data where we have your explicit consent, unless we are permitted to do so in other circumstances under data protection law. For example, we may make a record that a person is in a vulnerable circumstance to comply with requirements under charity law and the Code of Fundraising Practice, to ensure that we do not send fundraising communications to them.
5.3 Why we collect your information
We will mainly use your data for the purposes below:
- Dealing with your enquiries, requests or complaints
- Sharing information about our work, events and fundraising activities
- Helping Harmeny with fundraising activities, events and volunteering projects
- Administering donations, including processing gift aid
- Keeping a record of your relationship with us
- Managing your contact and marketing preferences
- Conducting surveys, researching and gathering feedback
- Obtaining information in order to improve Harmeny’s services and supporter experiences
- Carrying out research to find out more information about our supporters’ and prospective supporters’ backgrounds and interests
- Complying with our legal obligations, policies and procedures.
Whatever it is about Harmeny you are interested in, we really want to be as tailored as we can in our communications to you. We also want to speak to you in the way you would prefer – be it by email, phone or in writing.
5.4 Fundraising and direct marketing
We would love to let you know about the progress we are making with the children and young people with whom we work. We would also like to tell you about how your support is helping and other ways you can help in the future, whether that’s through volunteering, events or fundraising. From time to time, we may also send you information about appeals, asking for a donation to help us with our work with disadvantaged children.
We promise that we will only communicate with you in the way you wish us to and will always respect your privacy. You can change your mind at any time and it’s quick and easy to let us know you no longer want to hear from us by calling our Fundraising team on 0131 449 3938 or emailing us at [email protected] We will always respond to your wishes in a sensitive, timely, courteous and professional way.
Please be assured that we will take appropriate measures to keep your personal information safe and secure and we promise not to over contact you.
We will never share or sell your personal data to a third-party organisation for its marketing, fundraising or campaigning purposes.
5.4.1 How we communicate with you
We use a range of marketing activities and channels to contact our supporters – including our website, direct mail, email, and telephone.
We will obtain your consent to contact you by email for marketing purposes.
For all new supporters who sign up for an event or donate to us after 29th November 2019 we will send you marketing by post, on the basis of it being within our legitimate interests to do so, unless you opt out. See 5.5 Our legal basis for processing data below for more information about our use of legitimate interests. We will also contact these supporters by phone on this basis (unless they are registered with the Telephone Preference Service or have opted out of receiving marketing communications from Harmeny). For supporters registered with Harmeny before 29th November 2019 we will only contact you with marketing material by post or phone if you have consented to this previously.
We send the following marketing materials:
- updates about Harmeny’s work – including newsletters, e-newsletters and other publications informing you about our work.
- appeals and fundraising activities – including requests for donations, information about how you can leave us a gift in your will, how you can raise money on our behalf, attend or take part in a fundraising event, and updates on the impact that your fundraising activities have had on our work.
- events – including details of our challenges, such as fundraising events organised by Harmeny or other sponsored runs and activities. Or progress events related to our Learning for Life Appeal. Please note that if you sign up to a Harmeny event, we will also send you administrative communications about how you can take part. On occasion, we will also send you a reminder about the same event in future years, in case you want to participate in it again.
- volunteering – information about how you can help support Harmeny by giving up your time or using your influence to progress our aims, along with updates on the impact of your volunteering.
5.4.2 Managing your contact preferences
You can withdraw your consent, unsubscribe from, or update your marketing preferences at any point by calling 0131 449 3938 or emailing [email protected] Any electronic communications, such as emails, will have a link to unsubscribe from future electronic communications, so you can manage your own communication preferences.
If you make any changes to your consent, we will update your record without undue delay and at the latest within one month of receipt. It may take 60 days for our systems to update and stop any postal communications being sent to you. Email communications will, however, be stopped immediately. If you tell us you do not wish to receive marketing or fundraising communications, you may still receive transactional and service-based communications confirming and servicing other relationships you have with us (as described below).
5.4.3 Marketing via email
We use a third party company – MailChimp – to deliver our updates via email, including our e-newsletter. This allows us to share information efficiently and cost-effectively.
If you receive an email, open it, don’t open it, select a link and/or browse our website, we collect this information via MailChimp to ensure that the information we send to people is received and relevant. See 5.10 Use of data processors below for details on data security.
We will obtain your consent to contact you by email for marketing purposes.
All marketing emails will have a link to unsubscribe from future electronic communications should you change your mind about receiving these at any time. You can resubscribe, if you wish, or if you unsubscribe in error via our website.
5.5 Our legal basis for processing personal data
We need a lawful basis to collect and use your personal data under data protection law. The law allows for six ways to process personal data (and additional ways for sensitive personal data). Four of these are relevant to the types of processing that we carry out. This includes information that is processed on the basis of:
- a person’s consent (for example, to send you direct marketing by email or SMS).
- a contractual relationship (for example, to provide you with goods or services, including events, that you have purchased from us).
- processing that is necessary for compliance with a legal obligation (for example to process a Gift Aid declaration, and carrying out due diligence on large donations).
- Harmeny’s legitimate interests (please see below for more information).
Personal data may be legally collected and used if it is necessary for a legitimate interest of the organisation using the data, if its use is fair and does not adversely impact the rights of the individual concerned.
Harmeny’s legitimate interests
When we use your personal information, we will always consider if it is fair and balanced to do so and if it is within your reasonable expectations. We will balance your rights and our legitimate interests to ensure that we use your personal information in ways that are not unduly intrusive or unfair. Our legitimate interests include:
- Charity Governance: including delivery of our charitable purposes, statutory and financial reporting and other regulatory compliance purposes.
- Administration and operational management: including responding to solicited enquiries, providing information and services, research, events management and the administration of volunteers.
- Fundraising, including administering donations, sending direct marketing by post (and in some cases making marketing calls), sending thank you letters, analysis, targeting and segmentation to develop communication strategies and maintaining communication suppressions.
If you would like more information on our uses of legitimate interests, or to change our use of your personal data in this manner, please get in touch with us on 0131 449 3938 or [email protected]
5.6 Administrative communications to supporters
In addition to the fundraising and marketing communications that you receive from Harmeny, we will also communicate with you by post, telephone, and email in relation to administrative and transactional matters. For example, we will call you after you have set up a Direct Debit to confirm your details and upon cancellation. There may also be other occasions where we need to contact you about your donation – for example, if there is a problem with a payment, or in relation to your gift aid declaration.
On occasion, we will also contact you about an event that you have signed up to participate in, for example, to check that online fundraising pages have been set up and to provide any other necessary information.
As mentioned above, we may still need to communicate with you for administrative purposes even where you have opted out of marketing communications from us.
5.7 Supporter research and analysis
We may use profiling and database segmentation techniques to analyse your personal information, and create a profile of your interests, preferences and ability to donate. This allows us to ensure communications are relevant and timely, to provide an improved experience for our supporters. It also helps us understand the background of our supporters so that we can make appropriate requests to those who may be willing and able to donate more than they already do, or leave a gift in their will. This enables us to raise funds quicker and in the most cost-effective way.
We will use information that is already in the public domain (information that has been published in print or online) to identify high net worth individuals who may be interested in supporting our work with a major gift. These publicly available sources of information include Companies House, the electoral register, the phone book, the Charity Commission and Scottish Charity Regulator (OSCR) Register of Charities, Who’s Who, LinkedIn, company annual reports, and articles in newspapers and magazines. We may also use any publically available data that you share on social media.
We also carry out research to identify existing supporters who may be able to join our major donor programme. This is based both on publicly available information, and information our supporters have given us voluntarily (e.g. where a person lives, who they bank with, what their occupation is and their age).
Under data protection legislation, you have the right to object to your data being processed in this way. If you wish to opt out of being identified as a high net worth individual, please contact call 0131 449 3938 or email [email protected]
Please note that before seeking or accepting major donations we are required to conduct a minimum level of due diligence. This is in accordance with our legal and regulatory obligations and our internal risk management policies and procedures. This means that if you opt out of analysis of your data, we may still conduct some analysis that is required to enable us to accept donations from you.
5.8 How we keep your data safe and who has access
We ensure that there are appropriate technical controls in place to protect your personal details, for example, our network is protected and routinely monitored.
All supporter data is stored confidentially and securely on our Fundraising Database – Donorfy – a UK based CRM software provider fully compliant with GDPR regulations. More information on the Data Processing Agreement between us is viewable here: Donorfy
We undertake regular reviews of who has access to information that we hold to ensure that your information is only accessible by appropriately trained staff, volunteers and contractors.
We may need to disclose your details if required by the police, regulatory bodies or legal advisors.
We will only ever share your data in other circumstances if we have your explicit and informed consent.
We will never share or sell your personal data to a third-party organisation for its marketing, fundraising or campaigning purposes.
5.9 Use of data processors
We may use a third-party supplier to manage mailings for fundraising appeals, e-newsletters, conduct research surveys or storage of your personal information on our behalf, and to provide some of our advice and support services to you. You can find out more about the suppliers that we use by getting in touch with us.
We actively screen and monitor these companies to maximise the protection of your privacy and security. They are only permitted to use the data in accordance with relevant data protection legislation, under strict instructions from us, and in accordance with a data processing agreement entered into between Harmeny and the supplier.
5.10 Retention of your data
We will only store your information for a specified amount of time, as set out in our internal data retention policy.
The length of time that data will be kept may depend on the reasons for which we are processing the data and on the law or regulations that the information falls under. For example Gift Aid processing or for processing insurance claims related to our events or activities.
Once the retention period has expired, the information will be confidentially disposed of, permanently deleted, or anonymised.
If you request to receive no further contact from us, we will keep some basic information about you on our suppression list to avoid sending you unwanted materials in the future.
6. DATA COLLECTED VIA OUR WEBSITE & SOCIAL MEDIA CHANNELS
Like most websites, we use ‘cookies’ to help us make our site – and the way you use it – better. Cookies mean that a website will remember you. They are small text files that sites transfer to your computer, phone or tablet.
The Harmeny website uses a cookie for Google Analytics. This is used to record the number of visitors to our site and volumes of usage. For more information about Google Analytics visit the Google Analytics website
If you do not wish to accept cookies on to your device you can disable them by adjusting the settings on your browser. However, this will affect the functionality of the website.
Our website also uses web beacons or pixels through third-party service providers that allow us to track conversions and activity on our website, as well as generating advertisements that appear on Facebook and other search engines, like Google, for you and other potential users.
For more information about how we use cookies please see our Cookies Policy.
6.1 Social media
Depending on your settings or the privacy policies for social media messaging services like Facebook, Twitter, and Instagram, you may receive targeted advertisements through our use of social media audience tools. For example, Facebook’s ‘Custom’ and ‘Lookalike’ Audiences’ programmes enable us to display adverts to our existing supporters when they visit Facebook, or other people who have similar interests or characteristics to our supporters. For more information, or to manage your social media ad preferences, please see Facebook’s ‘About Custom Audiences’ guide and its Data Policy.
7. TRANSFERS OF DATA OUTSIDE OF THE EUROPEAN ECONOMIC AREA
We use Microsoft Office 365 a multi-tenant cloud service, for our internal office use. This means that internal documents and information generated by us are stored in cloud services hosted within the European Economic Area (EEA).
However, in some limited cases, we may use data processors that process and/or store data outside of the EEA – for example, payment processors such as Stripe, GoCardless and the email marketing service, MailChimp.
In these cases, we will take reasonable steps to ensure that the recipient implements appropriate measures to protect your information, for example, by entering into a contract that includes prescribed clauses about the use of data and (if the company is based in the United States, checking that it is accredited under the EU-US Privacy Shield).
8. YOUR RIGHT TO KNOW WHAT WE KNOW ABOUT YOU, MAKE CHANGES OR ASK US TO STOP USING YOUR DATA
You have many rights under data protection legislation. These include:
- Right of Access
You have a right to ask for a copy of the information we hold about you, although we may charge a small amount to provide this. If you spot any mistakes, please let us know and we will correct them.
We will supply any information you ask for, that we hold about you, as soon as possible but this may take up to one calendar month. You will be asked for proof of identity as the person dealing with your request may not be the staff member you have met before. We need to be sure we are only releasing your personal data to you.
If you want to access your information, send a description of the information you want to see, and proof of your identity by post to:
Harmeny Education Trust
Mansfield Road
Balerno
EH14 7JY
Or by email to: [email protected]
- Right to be informed
You have the right to be informed how your personal data will be used. This policy, as well as any additional information or notice that is provided to you either at the time you provided your details, or otherwise, is intended to provide you with this information.
- Right to withdraw consent
Where we process your data based on your consent (for example, to send you marketing texts or emails), you can withdraw that consent at any time. To do this, or to discuss this right further with us, please contact us.
- Right to object
You also have a right to object to us processing data where we are relying on it being within our legitimate interests to do so (for example, to send you direct marketing by post). To do this, or to discuss this right further with us, please contact us.
- Right to restrict processing
In certain situations, you have the right to ask for processing of your personal data to be restricted because there is some disagreement about its accuracy or legitimate usage.
- Right of erasure
In some cases, you have the right to be forgotten (i.e. to have your personal data deleted from our database). Where you have requested that we do not send you marketing materials, we will need to keep some limited information to ensure that you are not contacted in the future.
- Right of rectification
If you believe our records are inaccurate, you have the right to ask for those records concerning you to be updated. To update your records, please get in touch with us.
- Right to data portability
Where we are processing your personal data because you have given us your consent to do so, you have the right to request that the data is transferred from one service provider to another.
