Skip to main content

Royal Voluntary Service is committed to protecting your privacy. This statement explains what, how and why we collect information about you, how we use it, the circumstances in which we may disclose it to others and the way we work to keep your information safe and secure. We want you to feel confident that your personal information is safe in our hands.

We will only use your personal information in accordance with data protection law applicable to England and Wales from time to time. We will never sell or rent your personal information on to third parties.

Under data protection law, when we use your personal information, we will be acting as a data controller. Essentially, this means that we will be making decisions about how we want to use your personal information and why.

We have appointed a Data Protection Officer whose details are below in section 3.1. As an organisation who also processes health and social care personal data, we have appointed a Caldicott Guardian who is responsible for ensuring that all personal confidential data is handled legally, ethically and responsibly.

Royal Voluntary Service is a primarily volunteer led organisation with a mission to inspire and enable people to give the gift of voluntary service to meet the needs of the day in communities. We are a registered charity (in England and Wales number 1015988 and in Scotland number SC038924) and a registered company (number 2520413). Our registered office is at the address below (paragraph 3.1). Royal Voluntary Service (“RVS”) is registered with the Information Commissioners Office with the reference Z9787450.) Reference to “we” or “us” mean RVS. We are a data controller and gather certain information about you. We are also a data processer and may process your personal data.

This document (our “privacy notice”) sets out information relating to how we use personal information relating to individuals we have dealings with, including supported individuals, volunteers, donors (including Royal Voluntary Service Lottery participants), social media users, those who respond to surveys, people captured by CCTV, website users, subscribers to our newsletters, individuals who make a complaint to us and individuals who contact us from time to time. It also sets out information about what rights individuals have in relation to their personal information and various other matters required under data protection law. We have a version of this privacy notice which is suitable for children.

NHS and Care Volunteer Responders - If you are involved with the NHS and Care Volunteer Responder Scheme, follow the links below to find out more information about the way we collect, use, share and store information about you relating to that Scheme.

Royal Voluntary Service works with corporate partners and their employees that volunteer through their company with Royal Voluntary Service. Follow the link below to find out more information about the way we collect, use, share and store information about you if you wish to volunteer in the programme.

Coronation Champions Awards is an official Coronation project run by Royal Voluntary Service with support from with Her Majesty The Queen to celebrate the contribution of volunteers to make a difference to people’s lives and to their communities. Follow the link below to find out more information about the way we collect, use, share and store information about you relating to the awards:

In addition to the above, we also have specific privacy notices which apply to:

We also have a cookies policy which is relevant for individuals who use our website. Further information in relation to this can be accessed in section 4.7.

This privacy notice contains the following sections:

  • Who does this privacy notice apply to?
  • What’s our approach to privacy?
  • How can you get in touch with us and who is our data protection officer?
  • How can you complain about our use of your personal information?
  • What rights do you have under data protection law?
  • When and how can you withdraw your consent?
  • How will we notify you of any changes to our privacy notice?
  • How will we use your personal information?
  • When will we use your personal information for direct marketing?
  • When will we share your personal information with others?
  • Circumstances in which we will send your personal information outside the UK
  • How do we keep your personal information secure?

This privacy notice provides information to individuals about how they can object to our use of their personal information, how they can withdraw any permissions they have given to us to enable us to process their personal information and how they can make a complaint.

This privacy notice applies to:

  • Individuals who register to receive our services (see section 4.1)
  • Volunteers (see section 4.2)
  • Referrers (i.e. an individual who has commissioned us to deliver a service on behalf of another individual) (see section 4.3)
  • Donors (including Royal Voluntary Service Lottery participants) (see section 4.4)
  • Individuals who engage with us on social media (see section 4.5)
  • Individuals who participate in one of our surveys or questionnaires (see section 4.6)
  • Individuals who use our website (see section 4.7)
  • Individuals who access our premises or the surrounding areas and who may be recorded on our CCTV system (see section 4.8)
  • Individuals who subscribe to our updates and newsletters (see section 4.9)
  • Individuals who contact us to make a complaint; (see section 4.10)
  • Individuals who contact us with general enquiries; (see section 4.11)

In the sections below, when referring to the individuals listed above, we use the terms “you” or “your”.

Below, we summarise the main rules that apply to us under data protection law when we use your personal information.

a. We must be upfront about how we intend to use your personal information and must use your personal information fairly. Providing privacy information to individuals (such as in this privacy notice) is one aspect of using personal information fairly.

b. We must only use your personal information if we have a legal basis to do so under data protection law. These legal bases include:

  • That you have consented to our use of your personal information.
  • That we need to use your personal information to perform a contract between us (or to take steps at your request prior to entering into a contract).
  • That we (or someone else) has a legitimate reason for needing to use your personal information and those legitimate interests are not outweighed by your rights or interests. We must balance our respective rights and interests before we can rely upon this legal basis.
  • We need to use your personal information to comply with laws we are subject to.

c. We must only use certain types of sensitive personal information, known as “special category data”, (such as information relating to your health, genetic or biometric data, sex life or sexual orientation, racial or ethnic origin or religion) if we can also satisfy one of the conditions for processing this type of information set out in data protection law, in addition to the conditions listed in paragraph 2 above. These conditions include:

  • That you have given us your explicit consent to use the information.
    And/or
  • That the processing is necessary for reasons of substantial public interest.

d. We are only permitted to share your personal information with others in certain circumstances and if we take steps to ensure that your personal information will be secure.

e. Generally speaking, we must only use your personal information for the specific purposes we have told you about. If we want to use your personal information for other purposes, we need to contact you again to tell you about this.

f. We must not hold more personal information than we need for the purposes we have told you about and must not retain your personal information for longer than is necessary for those purposes (this is known as the “retention period”). We must also dispose of any information that we no longer need securely.

g. We must ensure that we have appropriate security measures in place to protect your personal information.

h. We must act in accordance with your rights under data protection law.

i. We must not transfer your personal information outside the UK unless certain safeguards are in place. One such safeguard is that the personal data is only transferred to a country that has been approved by the Secretary of State as having an acceptable level of data protection law.

We have appointed a Data Protection Officer ("DPO") to oversee our compliance with data protection law and this privacy notice. If you have any questions about this privacy notice, how we handle your personal information or if you wish to make a complaint, please contact our DPO.

You can get in touch with us in the following ways:

Postal address
Royal Voluntary Service
Hanley Centre
29 Charles Street
Stoke-on-Trent ST1 3JP

Email address
dataprotection@royalvoluntaryservice.org.uk

Phone number
029 2073 9184

If we are unable to deal with a complaint to your satisfaction or if you are unhappy with the way we are using your personal data, you also have the right to make a complaint at any time to the UK’s supervisory authority for data protection issues, ICO. You can find further information by following the link below:

ico.org.uk

How we will use your personal information, the legal bases we will rely upon, how long we will keep your personal information and other details will depend upon who you are and why we need your personal information in the first place.

In this section, we provide specific privacy information relating to the different categories of individuals that this privacy notice applies to.

This includes, but is not limited to services such as:

a - Home from Hospital/Supporting your Recovery
b - Home library
c - Lunch clubs
d - Patient Transport
e - Community clubs/centres
f - Social transport
g - Supporting you at Home/Good Neighbours.

What personal information we will use

  • Your name
  • Your contact details
  • Date of birth
  • Next of kin.

If required, we may also ask for the following information:

  • Medical history
  • Ethnicity
  • Gender
  • Religion.

How we will obtain the personal information

This information will be provided by you or by someone registering on your behalf.

What purposes we will use the personal information for

  • We will use your personal data for the purpose of providing you with the services you have been registered for.
  • We will anonymise your data for the purposes of any data reporting obligations we are subject to, for diversity monitoring.
  • We will retain information for the purposes of archiving in the public interest and historical research. Such information may include your personal data. Any such retention and subsequent processing of your personal data will be in accordance with the National Archives Guide to Archiving Personal Data 2018.

The legal bases for processing we rely upon

  • We will rely upon our legitimate interests in providing the service you have registered for, in anonymising your data and in archiving your data.
  • Where we process your special category data (e.g. your medical history) we will rely on the fact that this processing is carried out in the course of our legitimate activities as a charity and that we have appropriate safeguards in place, if we need to disclose your special category data to a third party, we will rely upon your consent.
  • Where we process your special category data for the purposes of archiving we will ensure that suitable safeguards are put in place (e.g. pseudonymisation).

How long we retain the personal information and why

We will only retain your personal information for as long as necessary for the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements. This is set out in our Records Retention policy. For further information about the retention period in a particular case, please contact our Data Protection Officer using the contact details in section 3.1.

Consequences of not providing/permitting us to obtain personal information

Without your personal data we will be unable to provide you with the services you have registered for.

Occasionally, we will require your consent to process special category data (e.g your medical history), without which we will be unable to provide you with the service you have registered for. If this is the case we will notify you.

If you are part of our NHS and Care Volunteer Responders scheme we have a separate privacy notice.

What personal information we will use

  • Your full name
  • Your contact details (such as your telephone number or email address)
  • Your address
  • Your date of birth
  • Information to enable us to check and verify your identity (e.g. a copy of your passport or driving licence)
  • Details of which volunteering roles you wish to opt for
  • Your first language and any other language you may speak
  • If required for the role, details to enable a DBS check to be undertaken
  • Emergency contact details
  • Whether you have been cautioned for, or convicted of, a criminal offence
  • If you choose to share it, special category data including the following:
    • Disability
    • Ethnicity
    • Gender
    • Trans status
    • Sexual orientation.

How we will obtain the personal information

  • Provided by you when you contact us (e.g. by making a phone call, emailing us or using our website to search for and submit an enquiry regarding volunteering opportunities) or make an enquiry at our premises.
  • Provided by you when you complete a volunteer application form.

What purposes we will use the personal information for

  • To process your volunteer application.
  • We will use the personal information to deal with any enquiry.
  • We will also make a record of your enquiry for internal administrative purposes.
  • Should you become a volunteer, we will use your personal information to administer your volunteering role and activity with us.
  • We may record telephone calls for internal administrative and training purposes and will inform you if this is the case at the beginning of a call.
  • We will anonymise your data for the purposes of any data reporting obligations we are subject to, for example diversity monitoring.
  • We will retain information relating for the purposes of archiving in the public interest and historical research. Such information may include your personal data. Any such retention and subsequent processing of your personal data will be in accordance with the National Archives Guide to Archiving Personal Data 2018.

The legal bases we rely upon

  • Our use of your personal is based upon our legitimate interests in:
    • Ensuring you are who you say you are and are suitable to volunteer to provide support to service users
    • Ensuring the safety and wellbeing of individuals who receive support
    • Administering the work of the charity effectively
    • Our legal obligation to ensure you are a suitable person to provide certain categories of volunteering support
    • Our lawful basis in processing your data in the context of promotional communications (see the section on Direct Marketing below.)

How long we retain the personal information and why

We will only retain your personal information for as long as necessary for the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements. This is set out in our Records Retention policy. For further information about the retention period in a particular case, please contact our Data Protection Officer using the contact details in section 3.1.

Consequences of not providing/permitting us to obtain personal information

Failure to provide the relevant information and/or your consent to the processing of your data may result in you being unable to volunteer.

What personal information we will use

  • Your full name
  • Your contact details (such as your telephone number or email address)
  • Details of your relationship to the individual
  • Who you work for and your job title (if you are making a referral on behalf of the organisation your work for)
  • Any additional personal data you choose to provide to us via telephone conversations or other communications.

How we will obtain the personal information

We will obtain your personal data from you when you make the referral.

What purposes we will use the personal information for

  • We will process your personal data in the context of the referral to facilitate the provision of the relevant service
  • We may also need to use your personal data to comply with our statutory and regulatory obligations
  • We may record telephone calls for internal administrative and training purposes and will inform you if this is the case at the beginning of a call.

The legal bases we rely upon

Our use of your personal data is based upon our legitimate interests in running our services and facilitating assistance to individuals and organisations who stand to benefit from the services.

How long we retain the personal information and why

We will only retain your personal information for as long as necessary for the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements. This is set out in our Records Retention policy. For further information about the retention period in a particular case, please contact our Data Protection Officer using the contact details in section 3.1.

Consequences of not providing/permitting us to obtain personal information

Failure to provide the relevant information may result us not being able to provide the relevant service to the individual being referred.

This includes the following type of donor:

  1. Royal Voluntary Service Weekly Lottery (the “Lottery”)
  2. Prize Draw
  3. Raffle
  4. Regular giving
  5. Individuals who leave us a legacy.

What personal information we will use

  • Your full name
  • Contact details including your address and email address
  • Your age
  • Your payment information
  • Your tax payer status.

How we will obtain the personal information

  • We will obtain your information when you play our lottery or raffle, or donate via our website
  • We will obtain your information from our external lottery manager, Sterling Management Centre Limited
  • We will obtain your information via electronic devices used by our face-to-face teams
  • We will obtain your information from postal donations via our fulfilment house Telebank Ltd
  • We will obtain your information when you complete a legacy intention form.

What purposes we will use the personal information for

  • We will use your personal data to administer the Lottery, raffle and prize draw, including but not limited to register you as a player, include you in our regular draw, collect payment from you and provide you with important information about playing the Lottery, raffle and prize draw.
  • We will use your contact details and payment information to inform you of, and pay out, any winnings from the Lottery, raffle and prize draw.
  • We will use your information in the promotion of the Lottery, raffle and prize draw.
  • We will use your information to contact you regarding our work, including any fundraising activities.
  • We will use your information to administer your individual giving relationship with us.
  • We will use your information to process collect direct debit donations.
  • We will use your information to collect Gift Aid on your donations where applicable.
  • We will use your information to administer your legacy wishes.

The legal bases we rely upon

  • We will rely on performance of a contract to administer your personal data in the context of the Lottery.
  • We will rely on legitimate interests to administer your personal data in the context of raffle, prize draw and individual giving.
  • We will rely on your consent to contact you via email to provide information on our work and fundraising activities. For more information, see our section on direct marketing (section 5).
  • We will rely on legitimate interest to contact you via telephone and post to provide information on our work and fundraising activities.

How long we retain the personal information and why

We will only retain your personal information for as long as necessary for the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements. This is set out in our Records Retention policy. For further information about the retention period in a particular case, please contact our Data Protection Officer using the contact details in section 3.1.

Consequences of not providing/permitting us to obtain personal information

Failure to provide the relevant information and/or your consent to the processing of your data may result in you being unable to participate in the Lottery, raffle or prize draw. If this is the case, we will let you know.

What personal information we will use

  • Your name
  • Your contact details (such as your telephone number, address and/or email address)
  • Details of your enquiry
  • Details of the method and/or social media platform used to contact us.

How we will obtain the personal information

Provided by you when you contact us (e.g. messaging us on social media, by making a phone call or emailing us) or make an enquiry at our premises or at your volunteering site. Often you’ll be asked to fill in one (or multiple) permission form[s].

What purposes we will use the personal information for

  • We will use the personal information to deal with your enquiry
  • We will also make a record of your enquiry for internal administrative purposes
  • We also pass on personal information to relevant Royal Voluntary Service teams and departments such as Problem Solving and Safeguarding in the case of them needing to pick-up a case.

The legal bases we rely upon

  • Our use of your personal information to dealing with your enquiry is based on your implied consent and our legitimate interests in ensuring our business is run efficiently and effectively
  • Our use of your personal information for record keeping purposes and for sharing with internal RVS departments is based on our legitimate interests in ensuring our business is run efficiently and effectively.

How long we retain the personal information and why

We will only retain your personal information for as long as necessary for the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements. This is set out in our Records Retention policy. For further information about the retention period in a particular case, please contact our Data Protection Officer using the contact details in section 3.1.

Consequences of not providing/permitting us to obtain personal information

Failure to provide your name and/or contact information may impede our ability to deal with your query. If this is the case we will let you know.

What personal information we will use

  • Your name
  • Your contact details (such as your telephone number, address and/or email address)
  • Details of your response to our questions
  • Where required – postcode data
  • Your age.

How we will obtain the personal information

Provided by you when you complete our survey or respond to our questionnaire.

What purposes we will use the personal information for

  • We will use the personal information to improve our activities.
  • We will use your personal information to contact you about our services and/or fundraising activity, see our direct marketing section for more information.
  • We will also make a record of your responses for internal administrative purposes.

The legal bases we rely upon

Our legitimate interests in ensuring the charity is run efficiently and effectively.

How long we retain the personal information and why

We will only retain your personal information for as long as necessary for the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements. This is set out in our Records Retention policy. For further information about the retention period in a particular case, please contact our Data Protection Officer using the contact details in section 3.1.

Consequences of not providing/permitting us to obtain personal information

Failure to provide your name and/or contact information may result in your responses not being considered. If this is the case we will let you know.

What personal information we will use

  • Technical information, including the IP address used to connect your computer to the internet, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform
  • Information about your visit, including the full Uniform Resource Locators (“URL”), clickstream to, through and from our website (including date and time), page response times, download errors, length of visit to certain pages, page interaction information (such as scrolling clicks and mouse-overs), methods used to browse away from the page and any phone number used to call our customer service number.

How we will obtain the personal information

  • Some of the information is obtained by us automatically whenever you use our website
  • Some of the information is collected by us each time you use our website through our use of cookies. Further information about the cookies we use and the purposes for which we use them can be found in our Cookies Policy.

What purposes we will use the personal information for

  • The above information is used by us to:
    • make a tailored website available to you
    • track usage of our website
    • help us to continually improve our website e.g. if we know pages are not viewed then we might consolidate information on fewer pages.
  • Information collected through our use of cookies is used in the ways described in our Cookies Policy.

The legal grounds we rely upon

Our collection and use of the above information is based on our legitimate interests in ensuring that our website is user-friendly and appeals to our customers.

How long we retain the personal information and why

We will only retain your personal information for as long as necessary for the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements. This is set out in our Records Retention policy. For further information about the retention period in a particular case, please contact our Data Protection Officer using the contact details in section 3.1.

Consequences of not providing/permitting us to obtain personal information

If you disable our Cookies, you will be unable to use certain parts of/functions on our website. Further information about this can be found in our Cookies Policy.

What personal information we will use

Static and moving images of you and individuals with you.

How we will obtain the personal information

Provided by you when you visit any of our premises or its surrounding areas that are monitored by CCTV.

What purposes we will use the personal information for

  • To ensure the health and safety of employees, workers, volunteers, service users and visitors
  • To detect, prevent or reduce incidences of crime
  • To prevent and respond effectively to all forms of harassment, disorder, bullying or victimisation of our employees, service users and visitors at our premises
  • To assist with health and safety and deal with other serious occurrences such as employment issues, for example disciplinary investigations and/or grievance investigations
  • To assist our defence of any legal and/or insurance claims.

The legal bases we rely upon

  • It is necessary to meet our legal obligations to our employees, workers and visitors
  • It is necessary to perform tasks in the public interest, namely the protection of the health and safety of visitors to our premises
  • We rely on our legitimate interest in processing this information.

How long we retain the personal information and why

We will only retain your personal information for as long as necessary for the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements. This is set out in our Records Retention policy. For further information about the retention period in a particular case, please contact our Data Protection Officer using the contact details in section 3.1.

Consequences of not providing/permitting us to obtain personal information

Failure to permit the CCTV recording of visit to our premises may result you being unable to access our premises.

What personal information we will use

  • Your name and address
  • Your email address
  • Your telephone number
  • Your delivery preferences.

How we will obtain the personal information

Provided by you when you subscribe to our newsletters or updates.

What purposes we will use the personal information for

To provide you with the newsletters or updates you have requested.

The legal grounds we rely upon

We will rely on your consent to provide you with the newsletters or updates you have requested and retain your details on our database
We will rely on our legitimate interest in promoting our products and services to provide you with other information that may be of interest to you.

How long we retain the personal information and why

We will only retain your personal information for as long as necessary for the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements. This is set out in our Records Retention policy. For further information about the retention period in a particular case, please contact our Data Protection Officer using the contact details in section 3.1.

Consequences of not providing/permitting us to obtain personal information

  • Without your contact details, we will not be able to provide you with newsletters and updates.
  • You can opt-out of receiving related information at the time you subscribe to our newsletters and updates and each subsequent time we contact you.
  • You can opt-out of receiving related information each time we contact you.

What personal information we will use

  • Your name
  • Your contact details (such as your telephone number or email address)
  • Details of your complaint
  • Any additional personal data you choose to provide in relation to your complaint.

How we will obtain the personal information

The information will be provided by you (or someone acting on your behalf) when you (or they) make a complaint to us.

What purposes we will use the personal information for

  • We will use the personal information listed above to deal with your complaint.
  • We may also make a record of your enquiry/communication for internal administrative purposes and regulatory purposes were applicable.

The legal grounds we rely upon

The legal bases we will rely upon when doing so will either be (i) your consent or (ii) our legitimate interests in ensuring that all complaints received by us are dealt with appropriately and to enable us to refer back to your complaint if you have further dealings with us.

How long we retain the personal information and why

We will only retain your personal information for as long as necessary for the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements. This is set out in our Records Retention policy. For further information about the retention period in a particular case, please contact our Data Protection Officer using the contact details in section 3.1.

Consequences of not providing/permitting us to obtain personal information

Without your personal data we may not be able to consider your complaint.

What personal information we will use

  • Your name
  • Your contact details (such as your telephone number or email address); and
  • Details of your enquiry/communication.

How we will obtain the personal information

The information will be provided by you (or someone acting on your behalf) when you (or they) contact us (e.g. by making a phone call or emailing us or enquiring at our premises).

What purposes we will use the personal information for

  • We will use the personal information listed above to deal with your enquiry/communication.
  • We may also make a record of your enquiry/communication for internal administrative purposes.
  • We will use your personal information to contact you about our services and/or fundraising activity see our direct marketing section for more information.

The legal grounds we rely upon

The legal bases we will rely upon when doing so will either be (i) your consent or (ii) our legitimate interests in ensuring that all enquiries/communications received by us are dealt with appropriately and to enable us to refer back to your enquiry/communication if you have further dealings with us.
We will rely on our legitimate interest in promoting our products and services to provide you with other information that may be of interest to you.

How long we retain the personal information and why

We will only retain your personal information for as long as necessary for the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements. This is set out in our Records Retention policy. For further information about the retention period in a particular case, please contact our Data Protection Officer using the contact details in section 3.1.

Consequences of not providing/permitting us to obtain personal information

  • Without your contact details, we will not be able to provide you with newsletters and updates
  • You can opt-out of receiving related information at the time you subscribe to our newsletters and updates and each subsequent time we contact you
  • You can opt-out of receiving related information each time we contact you.

In addition to data protection law, if we use your personal information for direct marketing purposes, we may also be subject to additional rules that regulate direct marketing. The term “direct marketing” essentially means directing marketing material or advertising at a particular individual.

To ensure compliance with both data protection laws and the specific rules relating to direct marketing, we will only use your personal information to tell you about our latest offers or to inform you of products and services which we think may be of interest to you in the circumstances outlined below:

Direct marketing by post and telephone

  • We may contact you in this way if we have a previous existing relationship with you.

Direct marketing by email, text or other forms of electronic communication

  • We will only contact you in this way if you have given us your express consent to do so.

Our legal bases for such processing under data protection law will either be your consent or reliance upon our legitimate interests in our the carrying out of legitimate activities of a charity or not for profit body.

We will retain your personal information unless and until you inform us that you no longer wish to receive direct marketing information from us. If you are a volunteer, you can update your preferences with us at any time through the profile section of our app.

Alternatively, you can ask us to stop sending direct marketing to you at any time by clicking the unsubscribe link at the bottom of our direct marketing emails, or contact us using the details provided in 3.1.

Sometimes, we will need to share your personal information with others. This section sets out details of who we will share your personal information with and why. It also tells you about our legal basis for doing so under data protection law and steps we will take to protect your personal information.

We will never sell or rent your personal information on to third parties.

Who are our service partners?

Our service partners include:

  • Sterling Management Limited will administer the Lottery on our behalf.
  • Barclays, PayPal, Stripe, the Access Group and Open Mobile Global, provide card payment processing services to us for donations to us, and purchases from us.
  • Couriers and other suppliers of delivery services.
  • Telebank, our fulfilment house, which provides our mailing services.
  • Melissa – provides ID verification services.
  • Ucheck – provides DBS services.

If you would like further information about any of our current service providers, please contact us at dataprotection@royalvoluntaryservice.org.uk

Why we need to share your personal information with them

  • We use the service partners described above to enable us to perform our contracts with you.
  • We use the service partners described above to enable us to efficiently run our business and carry out the legitimate activities of a charity or not-for-profit body.

The legal bases we rely upon when sharing your personal information

  • The sharing of your personal data with suppliers and sub-contractors is necessary for the performance of our contract with you.
  • The sharing of your personal data with suppliers and sub-contractors is necessary for our legitimate interest as a charity or-not-for-profit body.
  • The sharing of your personal data with suppliers and sub-contractors is necessary for our compliance with our legal obligations.

What precautions do we take?

We enter into contracts with our service providers which require them to put appropriate security measures in place and which restrict their use of your personal information.

Who are our marketing partners

  • Our marketing partners are marketing agencies that we use to create and/or deliver advertising and other promotional material on our behalf.
  • We haven’t included the names of our marketing partners in this privacy notice because their identity will change from time to time. However, if you would like further information about any of our current marketing partners, please contact us at dataprotection@royalvoluntaryservice.org.uk

Why we need to share your personal information with them

We may need to share your personal information with our marketing partners if we ask them to create marketing materials addressed to you or to contact you with direct marketing on our behalf.

The legal bases we rely upon when sharing your personal information

We will either be relying on your express consent or our legitimate interests in developing and expanding our business.

What precautions do we take?

We enter into contracts with our marketing partners providers which require them to put appropriate security measures in place and which restrict their use of your personal information.

Who will we be sharing your personal information with?

Suppliers of information technology products and services such as:

  • Website host
  • Cloud Data Storage provider
  • Analytics and search providers

We haven’t included the names of our IT partners in this privacy notice because their identity will change from time to time. However, if you would like further information about any of our current IT providers, please contact us dataprotection@royalvoluntaryservice.org.uk

Why we need to share your personal information with such providers

  • We use suppliers of information technology products and services in connection with the supply, maintenance and/or improvement of our IT network and the creation, development hosting and maintenance of our website
  • We use analytics and search engine providers to assist us to improve our website.

The legal bases we rely upon when sharing your personal information

We rely upon our legitimate interests in ensuring that our business can function properly and efficiently and that our IT network is secure
The sharing of your personal data with analytics and search engine providers is based on our legitimate interests in having an efficient and user-friendly website.

What precautions do we take?

We enter into contracts with our IT providers which require them to put appropriate security measures in place and which restrict their use of your personal information.

We may also need to share your personal information with others in the following circumstances:

If we sell, transfer or merge parts of our business or our assets

As we continue to develop our business we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. During any such process, we may need to disclose your personal information to other parties (such as potential purchasers or investors). Where we do so, we will be relying upon our legitimate business interests.

However, we will only share your personal information in this way if the third parties in question agree to keep your personal information safe and private.

Also, if, for example, a merger happens, the purchaser will only be able to use your personal information in the ways set out in this privacy notice.

Legal or regulatory requirements

On occasion, we will be required to disclose your personal information to organisations such as the courts or the police, local authorities, DBS to comply with legal obligations we are subject to and/or to prevent fraud or crime.

Protecting our business

From time to time we may need to disclose your personal information in connection with steps we need to take to protect our business interests or property.

Professional advice and legal action

We may need to disclose your personal information to our professional advisers (for example, our lawyers and accountants) in connection with the provision by them of professional advice and/or the establishment or defence of legal claims.

We will only send your personal data outside the UK in the following situations:

  • To comply with a legal obligation
  • To perform our obligations under a contract with you
    To efficiently and effectively run our website and our business
  • To process any payments, we receive from you or our service partners process on our behalf.

If we do transfer your personal data outside the UK, we will use one of these safeguards to make sure it is protected:

  • We will only transfer it to another country which the Secretary of State has decided has an adequate level of protection for personal data under the UK’s adequacy regulations. Find more about such countries
  • If there is no UK adequacy regulation, we will only transfer data subject to appropriate safeguards listed in Article 46 of UK GDPR.

We take various steps to protect your personal information while it is in our possession, including:

  • Implementation of appropriate security measures to protect our IT infrastructure
  • Encryption of personal information
  • Implementation of internal data security policies and training for members of staff in relation to such policies
  • Annual penetration testing of systems
  • Physical security measures, such as locking information away and keypad access to premises.

You can help us to protect your personal information by adhering to the following security measures:

  • Keep your passwords private
  • When creating a password, do not use words such as your name, date of birth or other personal data
  • Change your password regularly
  • Use a complex password or passphrase.

Under data protection law, you have a number of different rights relating to the use of your personal information. Below is a summary of those rights and our obligations.

More information about your rights and our obligations can be found on the ICO website.

Your rights - A right of access

What this involves:

  • This is a right to obtain access to your personal data and various supplementary information.

What our obligations are:

  • We must provide you with a copy or your personal information and the other supplementary information without undue delay and in any event within 1 month of receipt of your request
  • We cannot charge you for doing so save in specific circumstances (such as where you request further copies of your personal information).

Your rights - A right to have personal data rectified

What this involves:

  • This is a right to have your personal information rectified if it is inaccurate or incomplete.

What our obligations are:

  • We must rectify any inaccurate or incomplete information without undue delay and in any event within 1 month of receipt of your request
  • If we have disclosed your personal information to others, we must (subject to certain exceptions) contact the recipients to inform them, that your personal information requires rectification.

Your rights - A right to erasure

What this involves:

  • This is a right to have your personal information deleted or removed.
  • This right only applies in certain circumstances (such as where we no longer need the personal information for the purposes for which it was collected).
  • We have the right to refuse to delete or remove your personal data in certain circumstances.

What our obligations are:

  • If this right applies, we must delete or remove your personal information without undue delay and in any event within 1 month of receipt of your request
  • If we have disclosed your personal information to others, we must (subject to certain exceptions) contact then recipients to inform them that your personal information must be erased.

Your rights - A right to data portability

What this involves:

  • This is a right to obtain and re-use your personal information for your own purposes
  • It includes a right to ask that your personal information is transferred to another organisation (where technically feasible).
  • This right only applies in certain limited circumstances.

What our obligations are:

  • If this right applies we must provide your personal information to you in a structured, commonly used and machine reasonable form
  • Again, we must act without undue delay and in any event within 1 month of receipt of your request
  • We cannot charge you for this service.

Your rights - A right to object

What this involves:

  • This is a right to object to the use of your personal information.
  • The right applies in certain specific circumstances only.
  • You can use this right to challenge our use of your personal information based on our legitimate interests.
  • You can also use this right to object to use of your personal information for direct marketing.

What our obligations are:

  • If you object to us using your personal information for direct marketing, we must stop using your personal information in this way as soon as we receive your request.
  • If you object to other uses of your personal information, whether we have to stop using your personal information will depend on the particular circumstances.

Your rights - A right to object to automated decision making

What this involves:

  • This is a right not to be subject to a decision which is made solely on the basis of automated processing of your personal information where the decision in question will have a legal impact on you or a similarly significant effect.

What our obligations are:

  • Where such a decision is made, you must be informed of that fact as soon as reasonably practicable
  • You then have 21 days from receipt of the notification to request that the decision is reconsidered or that a decision is made that is not based solely on automated processing
  • Your request must be complied with within 21 days.

Your rights - A right to restrict processing

What this involves:

  • This is a right to ‘block’ or suppress processing of your personal information.
  • This right applies in various circumstances, including where you contest the accuracy of your information).

What our obligations are:

  • If we are required to restrict our processing of your personal information we will be able to store it but not otherwise use it.
  • We may only retain enough information about you to ensure that the restriction is respected in future.
  • If we have disclosed your personal information to others, we must (subject to certain exceptions) contact them to tell them about the restriction on use.

If you wish to exercise any of your rights, you can make a request by contacting us.

If you request the exercise of any of your rights we are entitled to ask you to provide us with any information that may be necessary to confirm your identity.

If you have given us your consent to use any of your personal information, you can withdraw your consent at any time. To do so, please contact us dataprotection@royalvoluntaryservice.org.uk.

We may update this privacy notice from time to time. If we make any substantial updates, we will provide you with a new privacy notice. We may also notify you in other ways from time to time about the processing of your personal information.