Data Protection Policy

1 INTRODUCTION AND BACKGROUND

1.1 The Poor Servants of the Mother of God (PSMG/'The Charity'), through its Trustees, is a Data Controller and consequently must process all Personal Data (including Special Categories of Personal Data) about Data Subjects in accordance with the General Data Protection Regulation 2016/679 (the "GDPR") and any other relevant data protection legislation, domestic or otherwise, (as may be in force or repealed or replaced from time to time) (together the "Data Protection Rules"). For the avoidance of doubt, the Charity remains the sole Data Controller, even where processing is carried out by the Frances Taylor Foundation, the.., Kairos Centre or any of its communities or associated organisations. Members of staff delivering a service through any associated organisation are employed by the Charity and therefore covered by this policy.

1.2 The Charity will collect, store, use and otherwise process Personal Data about the people with whom it interacts, who are the Data Subjects. This may include job applicants, services users, employees, former employees, agency workers, volunteers, community members, contractors, suppliers and other third parties.

1.3 The Charity processes Personal Data so that it can comply with its statutory obligations and achieve its charitable objects through the operation of the charity.

1.4 You have a number of rights in relation to how the Charity processes your Personal Data. The Charity is committed to ensuring that it processes Personal Data properly and securely in accordance with the Data Protection Rules, as such commitment constitutes good governance and is important for achieving and maintaining the trust and confidence of Data Subjects. Therefore, the Charity will regularly review its procedures to ensure that they are adequate and up-to-date.

1.5 All those who work for or are otherwise associated with the Charity who are involved in the Processing of Personal Data held by the Charity have a duty to protect the data that they process and must comply with this Policy. The Charity will take any failure to comply with this Policy or the Data Protection Rules very seriously. Any such failure may result in legal action being taken against the Charity and/or the individual responsible.

1.6 Details of the data we collect and process in relation to employees, how sensitive personal data is processed and shared, our obligations and your rights are detailed within the Privacy Notice for employees.

2 THE DATA PROTECTION PRINCIPLES

2.1 The Charity as the Data Controller is required to comply with the six data protection principles set out in the GDPR, which provide that Personal Data must be:

2.1.1 Processed fairly, lawfully and in a transparent manner;

2.1.2 Collected for specified, explicit and legitimate purposes and not further processed for other purposes incompatible with those purposes;

2.1.3 Adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed;

2.1.4 Accurate and, where necessary, kept up to date - every reasonable step must be taken to ensure that inaccurate personal data is erased or rectified

without delay;

2.1.5 Kept in a form that permits identification of Data Subjects for no longer than is necessary for the purposes for which the personal data is processed; and

2.1.6 Processed in a way that ensures its security, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organisational security measures.

2.2 There is also an overarching principle; the Data Controller must be able to demonstrate compliance with the six principles. Accountability is vital.

3 THE DATA PROTECTION OFFICER AND REGISTRATION WITH THE ICO

3.1 The Trustees have overall responsibility for compliance with the Data Protection Rules. However, the Data Protection Officer (the "DPO") shall be responsible for ensuring day-to-day compliance with this Policy and with the Data Protection Rules. The DPO will undergo training at least once a year and the Charity will provide the OPO with sufficient resources and support to carry out their responsibilities. The DPO's name and contact details can be found in section 10 of this Policy.

3.2 The Charity is registered with the Information Commissioner's Office (the "ICO") as the Data Controller as is required by law. The Charity will be responsible for paying to the ICO any future fees levied on Data Controllers by the Data Protection Rules.

3.3 This Policy applies to all Personal Data processed by the Charity in whatever format (e.g. paper, electronic, film) and regardless of how it is stored (e.g. electronically or in filing cabinets). It also includes information that is in paper form but is intended to be put into electronic form and to any recordings made such as telephone recordings and CCTV.

4 HOW THE CHARITY Will COMPLY AND DEMONSTRATE COMPLIANCE

4.1 This Policy is intended to ensure that any Processing of Personal Data is in accordance with the Data Protection Rules and the data protection principles. The Charity will therefore:

4.1.1 Ensure that, when personal information is collected (whether direct from the individual or from a third party), you are provided with a Privacy Notice and informed of what data is being collected and for what legitimate purpose(s);

4.1.2 Be transparent and fair in processing Personal Data;

4.1.3 Take steps to ensure the accuracy of data at the point of collection and at regular intervals thereafter, including advising you of your right to ask for rectification of Personal Data held about you;

4.1.4 Securely dispose of inaccurate or out-of-date data, or data which is no longer required for the purpose(s) for which it was collected;

4.1.5 Share information with others only when it is lawful to do so and ensure that individuals are informed of the categories of recipient to whom data

 will or may be disclosed and the purposes of any such disclosures;

4.1.6 Ensure that additional safeguards (as required by the Data Protection Rules) are in place to protect Personal Data that is transferred outside of the European Economic Area (the "EEA") (see section 7.4 of this Policy);

4.1.7 Ensure that data is processed in line with your rights, which include the right to:

( ) Request access to Personal Data held about you by the Charity (including, in some cases, having it provided to you in a commonly used and machine-readable format};

( ) Have inaccurate Personal Data rectified;

( ) Have the processing of your Personal Data restricted in certain circumstances;

( ) Have Personal Data erased in certain specified situations (in essence where the continued processing of it does not comply with the Data Protection Rules);

( ) Prevent the processing of Personal Data for direct-marketing purposes;

( ) Ask the Charity to prevent Processing of Personal Data which is likely to cause unwarranted or substantial damage or distress to you or any other individual; and

( ) Prevent, in some cases, decisions being made about you which are based solely on automated processing (i.e. without human intervention), and which produce significant or legal effects on them;

4.1.8 Ensure that all those who work for or are otherwise associated with the Charity are aware of and understand the Charity's data protection policies and procedures; and

4.1.9 Adopt a Data Retention Schedule which sets out the periods for which different categories of Personal Data will be kept.

4.2 Through adherence to this Policy and related data protection policies, and through appropriate record-keeping, the Charity will seek to demonstrate compliance with each of the data protection principles.

4.3 In addition, the Data Protection Rules require the Data Controller to carry out a Data Protection Impact Assessment (a "DPIA") prior to undertaking any Processing

of Personal Data that is "likely to result in a high risk for the rights and freedoms" of Q

individuals. DPIAs will therefore be considered where appropriate in relation to the implementation of any new projects, services or systems which could result in a high privacy risk to individuals (particularly where new technology is being deployed). Please contact the DPO for guidance (see section 10 of this Policy).

5 RETENTION OF DATA

5.1 The Charity may retain data for differing periods of time for different purposes as required by statute or best practices and will incorporate these retention times into its processes and manuals as appropriate. Other statutory obligations, legal processes and enquiries may also necessitate the retention of certain data. The Charity may store some data of employees such as names, addresses, date of birth, date of joining, date of leaving, job title, photographs, etc. indefinitely in its archive.

5.2 The Charity follows the retention periods recommended by the Information Commissioner in its Employment Practices Data Protection Code as follows for HR Related records: