1. Introduction

This Notice explains when and why we collect personal information, (personal data) about people who use our services and visit our website, how we use it, the conditions under which we may disclose it to others and how we keep it secure. It explains your data protection rights and how to make a complaint. Any questions about this policy can be asked using the contact details at the end of this policy. 

2. Your Personal Data – what is it?

This is any information about living individuals (this could be a service user, volunteer or employee for example) that enables them to be identified – e.g., name and address. The information could be used to identify them directly or by combining it with other information we have or that we are likely to have come into our possession. The collection and processing of such  information (data)  is governed by the Data Protection Act 2018 and UK General Data Protection Regulation (GDPR).

3.Who are we?

We are a small independent charity who collects personal data to carry out our charitable activities and report to funders and partners. This makes us a Data Controller under GDPR and in turn that makes us responsible for how and why we collect, process, store and use your personal data.

DMNW complies with Data Protection and GDPR legislation by:

• Keeping personal data up to date.
• Storing – and when required, destroying it (securely)
• Not collecting any unauthorised (any that is above the minimum needed to run the organisation) data.
• Not disclosing or sharing personal data with any individuals or organisations (unless necessary for our legitimate business interests, contractual obligations, crime prevention & safeguarding or where we have obtained additional prior explicit consent).
• Ensuring appropriate measures are in place to secure and protect stored personal data whether in electronic or hardcopy media.
• Ensuring that appropriate measures are in place to protect personal data during and after processing or transmission.

4. What type of personal data do we collect?

The personal data we currently collect from you includes:               

• contact details: name, address, telephone number, email address
• Your computer IP address when you visit our website
• Your date of birth where this is necessary for some of our services or activities.

5. Who do we collect personal data about?

DMNW collects and uses personal data if you contact us, including if you are:

• a member or becoming a member
• accessing our services, activities or events
• attending our training
• an employee or applying for employment with us
• a volunteer or applying for a volunteering opportunity with us
• a consultant or applying to become a consultant

6.Why do we collect and process your personal data?

DMNW uses your personal data for the following purposes:

• To contact you when needed.
• To enable DMNW to provide services to you, and/or to check your eligibility on any of our funded charity projects that you have requested access to.
• To seek your views or comments on the services we provide for monitoring and evaluation purposes. Information we send to our funders is anonymised and we would never provide personal data or information to another organisation or funders without your prior consent.
•  Keep you up to date with any upcoming activities.
• For promotional & marketing purposes, we will sometimes use  photographs of our events or activities. We will always ask your permission first.
• Carrying out our legal & financial obligations (invoicing, payments, annual accounts and reports to Companies House & Charities Commission)
• To tell you about changes to our services
• To process applications for jobs, volunteer placements, internships and apprenticeships (see also our staff privacy notice)

7.How we collect your personal data and what is the legal basis for our processing of your personal data? 

The majority of the personal data we process is collected directly from you, when you complete electronic or paper forms. Or when you telephone, e-mail or write to us at DMNW.

Sometimes we may collect personal data indirectly, from a third party, for example a partner organisation who makes a referral to one of our programmes of work. This could be a school, or a health visitor for example.

We rely on the following lawful basis for processing your personal data under the GDPR:

1. where we need to use personal data to carry out, or enter into a contract with you the lawful basis for this is contract
2. where we need to use personal data to deliver our services or activities to you the lawful basis for this is legitimate interest, or contract
3. where we need to use personal data to comply with our legal obligations (for example as an employer) then the lawful basis for this is legal obligation 

8. Sensitive Personal Information (Special Category Data)

• Data Protection Law recognises that some categories of personal information are more sensitive. Sensitive Personal Information (known as “Special Category”) can include information about a person’s health, race, ethnic origin, political opinions, sex life, sexual orientation, biometrics, trade union membership, genetics,  religious or philosophical beliefs.
• DMNW may collect sensitive personal information. We will only do this when it is necessary for delivery of the programme of work and when we can show we have an additional basis for processing this data under the Data protection Act 2018 and UK GDPR. Some of our projects funders require DMNW to collect certain sensitive information and, in some cases, DMNW will require Special Category data to enable us to provide to you the services you desire.

You can rest assured DMNW will only use this information:

• For the purposes of dealing with your enquiry, providing services, training, and quality and equalities monitoring or evaluating the services we provide.
• We will not pass on your details to anyone else without your express permission except in exceptional circumstances. Examples of this might include anyone reporting serious self-harm or posing a threat to others or children contacting us and sharing serious issues such as physical abuse or exploitation.
• Where you have given us your express consent or otherwise clearly indicated to us that you are happy for us to share your information but only to the extent DMNW agrees with you. 

When processing Special Category data the additional bases for processing that we rely on are usually:

• (a*) you have given explicit consent to the processing of those personal data for one or more specified purposes,
• (b) processing is necessary for the purposes of carrying out the obligations and exercising specific rights of DMNW or of you in the field of employment and social security and social protection law in so far as it is authorised by domestic law and as long as appropriate safeguards are in place; an example of this would be processing health data about an employee.
• (c) processing is necessary to protect the vital interests of you or of another person where the data subject is physically or legally incapable of giving consent; an example of this would be in order to protect a service user in a medical emergency.
• (f)  processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity; an example would be information needed for a court case DMNW was involved in.
• (g) processing is necessary for reasons of substantial public interest on the basis of domestic law, with measures to safeguard you;
• (h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee.
• *refers to sub sections of Article 9(2) UK GDPR

9 .Who do we share your personal data with

Your personal data is treated as strictly confidential and will only be shared with staff members of DMNW and only for the purposes given in section 6. We may share your information with other people and organisations where we are required to do so by law or with appropriate justification under the Data Protection Act (2018). Examples of this include the sharing of employee data with HMRC regarding payroll functions or where we have a duty of care such as a safeguarding concern.

We will not sell or rent your information to third parties.

We will not share your information with third parties for marketing purposes.

Third Party Service Providers working on our behalf:

• We may occasionally work with ‘third party service providers’, agents or subcontractors who may provide services on our behalf (for example to provide payroll or IT services). However, if and when, we use third party service providers, we only disclose the personal information that is necessary to deliver the service and we have a contract in place that requires them to keep your information secure and not to use it for their own direct marketing purposes. We will not release your information to third parties for any other reason unless you have given us express permission or requested us to do so, or we are required to do so by law, for example, by a court order or for the purpose of prevention of fraud or other crime.
• We may have to share data with our funders or partner organisations as part of the conditions of receiving that funding. Where this occurs, any data shared will be anonymised statistical or anonymised case study data.
• When you use the Donate facility on our Facebook page and website DMNW does not hold any of your payment or financial details this is all held securely by Stripe, Facebook Pay or by Pay Pal. You can find more information about their privacy policies and data security here:

https://pay.facebook.com/security-and-protection/

https://www.paypal.com/uk/webapps/mpp/ua/privacy-full

https://stripe.com/gb/privacy

• DMNW may at times deliver our programmes of work under contract (for example to Tameside Council). If for any reason any of our contracts were transferred to another provider, we will take steps to ensure that your privacy rights continue to be protected and we will inform you of our plans in line with this policy

10.How long do we keep your personal data?

Information, including personal data, must be kept for different lengths of time that is often dictated either by law or funding terms and conditions. Where this is not the case, we use recommendations from legal advisors and industry best practice to make a decision based around our business needs. Full details are in our Records Keeping policy. This is available on request from. Gemma@diversitymattersnw.org.uk / 0161 368 3268 / 20 Great Norbury St Hyde SK14 1BR

11. Storing your personal data securely and keeping it safe

Your personal data will be stored in our secure electronic database and retained in line with our record keeping policy.

We take our obligations to look after your data very seriously and keep to the principles of data protection. We have put in place appropriate technical and organisational measures to meet the requirements of accountability. These include:

• The appointment of a data protection lead who reports directly to the Board of Trustees
• Taking a ‘data protection by design approach to our activities. This means thinking about data protection at the very beginning of our planning and throughout our work.
• Keeping records of our data processing activities.
• Having data protection policies, making sure we implement them and ensuring we have written contracts in place with our data processors.
• Putting appropriate security measures in place to protect the personal data we process.
• Carrying out data protection impact assessments for our high-risk processing.
• Making sure staff that can see your information have undergone specific training around how to handle information properly.
• Relevant paper-based information is processed only by the relevant members of the DMNW team and kept securely, in locked filing cabinets, within our registered office. at 20 Great Norbury Street Hyde. 
• Our electronic systems and physical storage have appropriate access controls applied. This means that team members will have access to information on a need-to-know basis. If a team member is not the appropriate person, they will not be able to see your information.
• Electronic information is processed within our secure network and systems.
• Any sensitive information (such as credit or debit card details) is encrypted and protected by the third-party companies we use, for example DMNW do not see or hold your credit / debit card details.
• The systems we use to process personal data allow us to erase or update personal data at any point in time where appropriate.

We strive to protect your personal information, whether provided digitally or in paper format, however we cannot guarantee the security of how you transmit this information to us, and you do so at your own risk. Once we receive your information, we make our best effort to ensure its security on our systems. For further information please read our Data Protection policy, Complaints Procedures and Confidentiality policy.

12.Your rights and choices

You have a choice about whether or not you wish to receive marketing information from us about our services and activities. We will only send you information directly related to the project of activity you have signed up for unless you choose to receive our monthly newsletter and other occasional direct marketing communications. You can select your choices by ticking the relevant boxes situated on the form on which we collect your information.

We will not contact you for marketing purposes by email, phone or text message unless you have given your prior consent. We will contact you for marketing purposes by post if you have indicated that you wish to be contacted. You can change your marketing preferences at any time by contacting us by email at: info@diversitymattersnw.org.uk or telephone on. 0161 368 3268

Note on email marketing

Emails and text messages are also covered by Privacy and Electronic Communications Regulations.  Every time your email address is recorded, you will be offered email updates about our work programmes. You will be asked to agree to your details being used for these marketing emails.  Also, any marketing emails sent by DMNW will include the opportunity to unsubscribe from future emails.

You have the right to ask for access to any of the personal information that DMNW hold about you. If you want to ask for this information, please contact our data protection lead. gemma@diversitymattersnw.org.uk / 0161 368 3268  We will normally respond within one month.

Your Right to Complain / Object

You have the right to complain if you feel your information is not being used in the right way or is incorrect. In the first instance you can contact our data protection lead (above) –. If you do not wish to do this, details of our complaints procedure can be found on our website.

If you are still not satisfied with the response from DMNW you have the right to complain to the Information Commissioners Office. For further details about this and your information rights please visit the Information Commissioners website here: https://ico.org.uk/your-data-matters/

How you can access and update your information

The accuracy of your information is important to us. If you would like to review and / or correct the information that we hold about you, please contact us at: info@diversitymattersnw.org.uk/ 0161 368 3268 or write to us at Diversity Matters North West, 20 Great Norbury St Hyde SK14 1BR.

13 or under

We are concerned about protecting the privacy of children aged 13 or under. If you are aged 13 or under‚ please get your parent/guardian’s or school/college’s permission beforehand whenever you provide us with personal information.

For more information about your rights under the Data Protection Act 2018 and UK GDPR contact our Data Protection Lead: gemma@diversitymattersnw.org.uk / 0161 368 3268

13. Our website

DMNW currently has the following website: https://diversitymattersnw.org.uk/

It is hosted by a Third Party service provider, Zen Internet Ltd, a company located and  registered in the UK Company number: 03101568. Zen data centres are located in the UK.

If you use any of the email facilities or forms on our website, we will capture your email address, phone number and name. This means we can respond to you. We will ask if you want to opt in to being contacted in the future by mail, telephone, email or text.

Information is automatically provided on your browsing behaviour through the use of cookies on our sites. This information does not enable us to identify you personally. However, it does allow us to track usage of our sites so that we can improve them.

We use standard third-party web analytics services (such as Google Analytics) to collect anonymous information about your computer, including your partial IP address, operating system and browser type. This includes for example the number of users viewing pages on the site, but it does not identify you individually. This means we can monitor and report on the effectiveness of the site and help us improve it.

We may temporarily retain any data that you provide on the website, even if you do not complete your enquiry. Such contact details and data may be used to contact you to enquire if you require any assistance but for no other purpose.

Links to other websites

Our website may contain links to other websites run by other organisations. This privacy policy applies only to our DMNW website‚ so we encourage you to read the privacy statements on the other websites you visit. We cannot be responsible for the privacy policies and practices of other sites even if you access them using links from our website.

In addition, if you link to our website from a third-party site, we cannot be responsible for the privacy policies and practices of the owners and operators of that third party site and recommend that you check the policy of that third party site. 

14. People who contact us through social media

If you send us a private or direct message through social media, the message will be stored in line with our data retention policy. It will not be shared with any other organisations. Please bear in mind that direct messages sent through social media are not private. This privacy policy does not cover social media sites and we encourage you to read the privacy policies of sites such as Facebook or Instagram before signing up.

15. Transfer of data outside the European Union

We do not routinely transfer personal data overseas but if this is ever necessary, we ensure that we have appropriate safeguards in place. 

16.Further processing

If we need to process personal data for a purpose/s not covered by this notice then a new notice will be published explaining the new use prior to any processing commencing. Whenever necessary, additional or fresh consent will be sought.

17. Changes to this statement

DMNW will review this notice regularly. The updated document will be circulated to staff and made available on our website.

18.Contact Details

To exercise any of your rights, make queries or complaints please contact:

Gemma Gaskell, Chief Officer and Data Protection Lead, Diversity Matters North West

20 Great Norbury Street, Hyde SK14 1BR

0161 368 3268 | gemma@diversitymattersnw.org.uk

You can also contact the Information Commissioner’s Office at

https://ico.org.uk/global/contact-us/postal-addresses/

Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF.

Tel: 0303 123 1113 (local rate)

DMNW: Complaints & Feedback Policy

Approved by the Board, Sept 2018

Why We Want Your Feedback

We aim to be a learning organisation. We want to know what we are doing well and what we could do better, so we want our service users and volunteers to tell us honestly what they think of us.

As an Equal Opportunities organisation, we aim to treat everyone on their merits – irrespective of age, disability or impairment, race, ethnic or national origin, gender, marital status, sexuality, dependants or class. If you believe we have failed to do this, we welcome the chance to look into this.

How to Give Us Your Feedback

We have ways for you to feed back your views to us informally or, if you prefer, to make a formal complaint. These are set out in more detail in our Feedback and Complaints Procedures, which you can request at any time.

If you are confused or concerned by the way we have treated you, you may ask us for an explanation before deciding whether to make a complaint.

You may make a complaint about any aspect of our service regardless of whether you have asked for an explanation first.

DMNW: Complaints Procedure

Approved by the HCA Board, September 2018

Introduction

This complaints procedure is for use by anyone who is not satisfied with the service they have received from DMNW.

Sometimes misunderstandings can be sorted out informally. You can always speak to a member of staff or the manager, to try to sort the problem out straight away.

Or you could use our compliments and complaints box (near the front entrance of our building) for general comments about our service and how it could be improved. This will be checked on a weekly basis. If you attend any of our activities, you should be given the opportunity to tell us what you think at the end of the session. If this doesn’t happen, please ask a member of staff.

If, however you feel your issue is more serious and needs to be dealt with formally then you should use the formal complaints procedure.

How to Tell Us About Your Complaint

For all complaints other than complaints against the Chief Officer

You can choose any of these ways of making your complaint.

• You can post (or drop off) a letter or a note (in English, Bangla or in Urdu) addressed to: The Chief Officer, Diversity Matters Northwest, 20 Great Norbury Street, Hyde SK14 1BR. Be sure to include your name and contact details.
• You can ring 0161 368 3268 and ask to speak to the Chief Officer. If you wish to make your complaint in Bangla or Urdu, a Bangla or Urdu-speaking staff member will write down your complaint.
• You can send an email to chiefofficer@diversitymattersnw.org.uk .

For any complaints against the Chief Officer

You can choose any of these ways of making your complaint.

• You can post (or drop off) a letter or a note (in English, Bangla or in Urdu) addressed to: The Chair, Diversity Matters North West, 20 Great Norbury Street, Hyde SK14 1BR. Be sure to include your name and contact details.
• You can ring 0161 368 3268 and ask to arrange to speak to the Chair. If you wish to make your complaint in Bangla or Urdu, a Bangla or Urdu-speaking staff member will take your call.
• You can send an email to info@diversitymattersnw.org.uk

The complaint will initially be considered by a board member, any appeal will then be considered by a separate board member.

• If the outcome of the complaint is considered to require a disciplinary.

• The disciplinary will be considered by a board member (other than the one involved in any complaint (or other issue) the subject of which forms the disciplinary
• Any appeal will be heard by the Chair.

How we will handle your Complaint: Stage One

Normally, the Chief Officer will deal with your complaint. If your complaint is about our Chief Officer, then our Chair will deal with it.

We will acknowledge your complaint within five working days and carry out a full investigation of the circumstances surrounding it. The target time for responding in full to a complaint is 20 working days, but if the issue is more complicated you will be told about any delays and the reasons for this. We will always respond in full to your complaint in writing, setting out clearly the results of our investigation and if we accept your complaint.

If we accept your complaint, we will give you a full apology in writing and also tell you what we will do to improve the situation for you or at least ensure a similar situation does not arise again.

We will always try to resolve complaints at the earliest stage possible, however if you do not feel your complaint has been heard or resolved properly you can move to Stage Two. The letter you receive from us at the end of Stage One will give full details of your right to ask for a review of the investigation if you are not happy with the outcome.

In the case of a complaint against the Chief Officer investigated by the Chair, the next stage would be Stage Three.

How we will handle your Complaint: Stage Two

This review will be undertaken by our Chair, who will check that the investigation has been carried out fully and properly, checking that the fundamental point of the complaint has been addressed and looking at any outstanding issues raised by the complaint.

The process followed by the Diversity Matters North-West Chair, is similar in that the same timescales for responses apply and there is the same obligation for apology, if owed, and for putting things right if possible. You will be informed of the Chair’s decision in writing, with full details of the outcome of the complaint and what will happen as a result.

How we will handle your Complaint: Stage Three

If you still feel your complaint has not been properly dealt with you can appeal, in writing, to the full Diversity Matters North-West. Please send a letter to:

The Board of Trustees, Diversity Matters North-West, 20 Great Norbury Street, Hyde SK14 1BR.

Your complaint will then be considered by a full meeting of Diversity Matters North-West Board. The Board will not look at the detail of the complaint but will focus on making sure that the process has been followed properly and that the fundamental point of the complaint has been addressed.

You will receive acknowledgement of your complaint within five working days and a full written response within 6 weeks. This will contain enough information to show the complaint has been fully investigated and an apology where appropriate. The decision of the Board will be final.