Food Train is required to collect, store and process certain personal data to carry out our day to day charitable activities, meet our aims and vision and comply with legal obligations.
Food Train is committed to ensuring your personal data is dealt with in line with the EU General Data Protection Regulation (GDPR). To comply with the law and your right to be informed, this policy outlines why we need your personal data, what we do with your data, how long we will retain the data for and how you can exercise your rights in relation to our handling of your data.
Personal data must be processed in accordance with six ‘Data Protection Principles’. It must:
We are accountable for these principles and must be able to show that we are compliant.
To progress the charitable aims and objectives of Food Train, we need to collect personal information from:
If you are a Food Train member (service user), the data we will collect and hold includes your name, home address, telephone number, date of birth and emergency contact. Our lawful basis for collecting and processing this information is to allow us to fulfil our contractual obligation in providing you with a service.
We will also ask for some basic information about your health, access and support needs to ensure the service we are providing you with is appropriate and tailored to your needs. Our lawful basis for collecting and processing this information is also to fulfil our contractual obligation. Processing is necessary to provide you with a social care service.
We may also ask your permission to take, store and use photographs of you taken during the course of service delivery for the purposes of service promotion or evaluation. Our lawful basis for collecting and processing this data is consent. At the time of providing your consent, we will ensure you are notified of how we plan to use the photographs and how long we plan to continue using them.
From time to time, we may ask you how our services have helped you. This is for the purpose of service evaluation and to allow us to improve our services. This information will only be gathered with your consent.
All member data is stored electronically on a membership database, accessed only by approved staff and volunteers. Hard copy referral forms are stored in local offices in locked cabinets with restricted access to keys.
Your details will be removed immediately upon cessation of membership, unless appropriate and justifiable reason exists to retain for a limited period. An example of a justifiable reason may be the need to reconcile your account following the end of your service, this may take a number of weeks to complete.
Volunteers
If you are a Food Train volunteer, the data we will collect and hold includes your name, home address, telephone number, email address, date of birth, driving license details, PVG scheme record number and personal referee information. Our lawful basis for collecting and processing this information is to allow us to fulfil our contractual obligation of volunteer employment with you.
We will ask you for basic information about your health, access and support needs relevant to your volunteering role. This information allows us to assess the suitability of the role to you and to put in place any appropriate support that will help you to conduct your role. Our lawful basis for collecting and processing this information is also to fulfil our contractual obligation. Processing is necessary for assessing your work capacity.
We may also ask your permission to take, store and use photographs of you taken during the course of service delivery for the purposes of service promotion or evaluation. Our lawful basis for collecting and processing this data is consent. At the time of providing your consent, we will ensure you are notified of how we plan to use the photographs and how long we plan to continue using them.
From time to time, we may ask you how volunteering with Food Train has impacted on your life. This is for the purpose of service evaluation and to allow us to improve our services. This information will only be gathered with your consent.
All volunteer data is stored electronically on a membership database, accessed only by approved staff and volunteers. Hard copy referral forms are stored in local offices in locked cabinets with restricted access to keys.
Protecting Vulnerable Groups Scheme records are kept in accordance with the law and destroyed securely within the timeframe set out by Disclosure Scotland.
Your details will be removed immediately upon cessation of volunteering, unless appropriate and justifiable reason exists to retain for a limited period. An example of a justifiable reason might be your expressed uncertainty around the possibility of returning to your volunteer role after a short break.
If you are a Food train employee, we will hold your name, home address, telephone number, date of birth, national insurance number, emergency contact details, bank details, PVG scheme record details, employment contract copy, holiday data, appraisal data, salary data, pension data and employment management information. Our lawful basis for collecting and processing this information is to allow us to fulfil our contractual obligation of employment with you.
We will ask you for basic information about your health, access and support needs and record sickness data. This information allows us to put appropriate support in place during your employment where necessary and to manage our company sickness levels. Our lawful basis for collecting and processing this information is also to fulfil our contractual obligation of employment with you. Processing is necessary for carrying out our obligations under employment law.
All staff data is stored securely in locked files in Food Train Head Office and only accessed by those authorised by the Chief Executive.
Staff data is held for 7 years (after an employee leaves the organisation) in accordance with company law, after which it is securely destroyed.
If you apply for a job at Food Train, we will request certain personal data from you to process your application and assess your suitability for the role. Data collected during the recruitment process includes name, contact details, educational achievements, employment history, referee contact details, and shortlisting and interview records. Our lawful basis for collecting and processing this information is the necessity to undertake this step to enter into a contract of employment.
We will ask you for basic information about your access and support needs. This information allows us to put appropriate support in place during the interview stage of recruitment. Our lawful basis for collecting and processing this information is also the necessity to undertake this step to enter into a contract of employment. Processing is necessary for carrying out our obligations under employment law.
Recruitment files for non-appointed applicants are stored for 6 months in accordance with best practice, then securely destroyed.
If you are a Food Train Director, the data we hold about you includes your name, home address, telephone number, email address, date of birth, current directorships, employment status, a short biography and board meeting attendance. Our lawful basis for collecting and processing this information is to comply with our legal obligations in relation to charity law.
All director data is stored electronically within a director register, accessed only by approved staff and volunteers. Hard copy application forms are stored at Head Office in locked cabinets with restricted access to keys.
Director data is held for 7 years (after retirement) in accordance with company law, after which it is securely destroyed.
If you are a Food Train donor, the data we hold about you includes your name, home address, donation method, donation amounts, Gift Aid eligibility and your reasons for donating. Our lawful basis for collecting and processing this information is consent.
All donor data is stored electronically on a donor database, accessed only by approved staff and volunteers.
Hard copy records for Gift Aid purposes are stored securely in Head Office and destroyed following the time lapse in accordance with Company Law.
If you are a professional/individual working with older people and have an interest in hearing about the work of Food Train for the further benefit of the older people you support, the data we hold about you might include your name, job title, postal address, email address, and telephone number. This data is used purely for sharing relevant information, news, developments and opportunities in relation to supporting older people at home. Our lawful basis for collecting and processing this information is usually consent but on occasion, we may also rely on your legitimate interest to further support the individuals you work with and our legitimate interest to further support our existing members (service users).
All contact details are stored electronically within a contacts database, accessed only by approved staff and volunteers. Hard copy consent forms are stored in locked cabinets with restricted access to keys.
Your data will be held for as long as we require it for the purpose listed above. You have the right to request a stop to any further communication from us at any time and the deletion of your contact details. Any electronic newsletters sent by Food Train will contain an unsubscribe button/link within the email.
We may also ask your permission to take, store and use photographs of you taken during the course of our professional involvement with you or whilst attending a Food Train event. This would be for the purposes of service/ project promotion, information sharing or evaluation. Our lawful basis for collecting and processing this data is consent. At the time of providing your consent, we will ensure you are notified of how we plan to use the photographs and how long we plan to continue using them.
If you have applied for an Eat Well Age Well grant, the personal data we hold about you will include your name, preferred name, position in organisation (if relevant), postal address, email address, telephone number and names of any social media accounts or websites owned by you. If you are successful in securing a grant (and have applied as an individual rather than as a representative of an organisation), we may also ask you for your bank details to allow for the transfer of funds, as well as two forms of personal identification with address details. This data is only held for the purpose of administering your grant application/award. Our lawful basis for collecting and processing this information is to allow us to fulfil our contractual obligation as a grants administrator.
Your data is stored electronically on the Eat Well Age Well website and on our grants administration database, accessed only by approved staff. Hard copy files in relation to each grant holder are stored within locked filing cabinets, with key access restricted to authorised staff.
Your data will be held for the duration of our relationship with you during the funding period and for 7 years beyond in accordance with company law.
For the purpose of grant scheme evaluation and assessing the impact of our grant awards in achieving our Eat Well Age Well objectives, we will ask you to report on the outcomes of your funded activity. We will encourage you where possible to anonymise any personal data in relation to your project beneficiaries and if this is not possible, to confirm that you have sought the consent of your beneficiaries to share their data with us. Data we collect may be shared with our project funder (Big Lottery), shared on our website or social media pages or used in publicly available reports/leaflets to demonstrate our impact.
Any personal data gathered about your beneficiaries for the purposes of impact assessment will be stored electronically within our Team Site and within hard copy grant holder files, as above. This data will be held for the duration of your relationship with us and for 7 years beyond, as above.
Data is collected in a number of ways at Food Train, including face-to-face (e.g. volunteer interviews), telephone (e.g. customer referrals), email (e.g. job applications), and via our websites (e.g. donations, enquiries). At every data collection point, we will make you aware, prior to you providing any personal data, why we are asking for your data, how your data will be used and how long we will keep it for. A copy of our full up-to-date privacy policy will also be provided.
Food Train hosts 4 websites:
Our websites use cookies and Google analytics to allow us to provide an improved experience for the user. Please see our full Cookies Policy for further information.
The security of your data is of paramount importance to us. Every category of data held at Food Train is given individual consideration and appropriate security measures are in place to ensure we are keeping it as secure as possible. In general, across the organisation, we take the following steps to ensure all personal data is kept secure at all times against unauthorised or unlawful loss or disclosure:
Sometimes Food Train contractors or partner agencies may have access to your personal data while assisting us to conduct our business or provide a service to you. Such a contractor is our IT support provider. We require any contracted companies to keep your personal data confidential and secure and to protect it in accordance with the law and our policies. They are only permitted to process your data for the lawful purpose for which it has been shared and in accordance with our instructions.
We might share your personal data with partners, contractors and agents to carry out our obligations under our contract with you or to meet our legal obligations. Contractors and agents include:
Food Train does not send any personal data outside the European Economic Area where data protection legislation differs.
Unless subject to an exemption [under the GDPR], you have the following rights with respect to your personal data:
If you are a Food Train member (service user), volunteer or donor to a local branch and wish to simply correct or update the information we hold about you, you may do so via the local office/ Regional Manager/ Project Manager.
For all other contact in relation to exercising your rights, enquiries/suggestions about Food Train’s data protection practices, requests to access the data we hold about you (a Subject Access Request) or to complain about how your data has been handled, please contact our Data Protection Officer – email dpo@thefoodtrain.co.uk, or telephone 01387 270800.
If you have any concerns about how Food Train has used your personal data, our Data Protection Officer would like to hear about this. Please contact using the details above.
Should you have continued reason to be unhappy about how Food Train has collected or handled your personal information, you have the right to complain to the UK’s Information Commissioner. You can do this by contacting the Information Commissioner’s Office directly.
The Information Commissioner’s Office can be contacted on 0303 123 1113. The www.ico.org.uk website has further information on your rights and our obligations.
Food Train has robust measures in place to minimise and prevent data breaches taking place. In the event that any personal data becomes lost or shared inappropriately by Food Train, we have a data breach management procedure in place to ensure any associated risk is minimised as soon as possible. If a significant breach occurs that is likely to risk the rights and freedoms of individuals, we will notify the Information Commissioner’s Office within 72 hours of the breach being discovered.
We may update our privacy policy occasionally. Our up to date policy will always be available on our websites. If we make any significant changes to the way in which we treat your personal data, this will be highlighted on our website and you will be notified directly.