{"id":6670,"date":"2024-07-18T10:14:12","date_gmt":"2024-07-18T09:14:12","guid":{"rendered":"http:\/\/langworthycornerstone.co.uk\/staging2\/?page_id=6670"},"modified":"2026-01-30T15:35:17","modified_gmt":"2026-01-30T15:35:17","slug":"data-privacy","status":"publish","type":"page","link":"http:\/\/langworthycornerstone.co.uk\/staging2\/our-policies-2\/data-privacy\/","title":{"rendered":"Data Privacy Policy"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

our Data Protection Policy<\/h2>\n

Langworthy Cornerstone Association (LCA) recognises the importance of the correct and lawful treatment of personal data; it maintains confidence in the organisation and provides for successful operations. In order to ensure effective delivery of services, LCA is required to maintain certain personal data about individuals in order to carry out our work and legal obligations. This personal information must be collected and dealt with appropriately.<\/span><\/p>\n

The aim of this policy is to ensure that<\/span> everyone handling personal data is fully aware of the requirements and acts in accordance with data protection procedures. <\/span><\/p>\n

The Data Protection Act 2018 and the General Data Protection Regulations (2018) governs the use of information about people (personal data). Personal data can be held on computer or in a manual file, and includes email, minutes of meetings, and photographs. <\/span><\/p>\n

LCA will remain the data controller for the information it collects and holds. LCA, its members, staff and volunteers will be personally responsible for processing and using personal information in accordance with the current legislation.\u00a0\u00a0\u00a0 <\/span><\/p>\n

All board members, staff and volunteers working with LCA who have access to personal information, will be expected to read and comply with this policy. None compliance with this policy could result in disciplinary action, loss of job (or volunteering placement), personal fines and potentially imprisonment.<\/span><\/p>\n

    \n
  1. \n

    Principles<\/span><\/b><\/h4>\n<\/li>\n<\/ol>\n

    The General Data Protection Regulations sets out seven key principles (Article 5(1)) which are summarised as follows:<\/span><\/p>\n

      \n
    • Lawfulness, fairness and transparency<\/span><\/li>\n
    • Purpose limitation<\/span><\/li>\n
    • Data minimisation<\/span><\/li>\n
    • Accuracy<\/span><\/li>\n
    • Storage limitation<\/span><\/li>\n
    • Integrity and confidentiality (security)<\/span><\/li>\n
    • Accountability<\/span><\/li>\n<\/ul>\n

      These principles specify the legal conditions that must be satisfied in relation to obtaining, handling, processing, transportation and storage of personal data and lie at the heart of the GDPR. Compliance with the spirit of these key principles are the fundamental building blocks for good data protection practice and compliance. <\/span><\/p>\n

      LCA fully endorses and adheres to these principles. Employees and any others who obtain, handle, process, transport and store personal data for LCA must adhere to these principles.<\/span><\/p>\n

        \n
      1. \n

        Responsibilities <\/span><\/b><\/h4>\n<\/li>\n<\/ol>\n

        The LCA Board will ultimately take responsibility for the implementation of this policy and take into account legal requirements to ensure that it is properly implemented, <\/span><\/p>\n

        LCA is currently not legally required to have a Data Protection Officer. However, a Data Protection Lead has been identified and will be responsible for ensuring that the policy is implemented and will have the responsibility:<\/span><\/p>\n

          \n
        • To inform and advise the organisation, the board and its employees about their obligations to comply with the GDPR and other data protection laws.<\/span><\/li>\n
        • To monitor compliance with the GDPR and other data protection laws, including managing internal data protection activities, advise on data protection impact assessments; train staff and conduct internal audits.<\/span><\/li>\n
        • To ensure LCA continues to be registered with the Information Commissioner and that our details remain up to date.<\/span><\/li>\n
        • To be the first point of contact for supervisory authorities and for individuals whose data is processed (employees, customers etc).<\/span><\/li>\n<\/ul>\n

          Staff and Volunteers are actively encouraged and supported through training and their line manager to report any concerns that they may have in order to improve both our data protection and services to users. <\/span><\/p>\n

          However, all staff and volunteers are also aware that a deliberate breach of the rules and procedures identified in this policy may result in disciplinary action being taken against them<\/span><\/p>\n

          This policy will be updated as necessary to reflect best practice in data management, security and control and to ensure compliance with any changes or amendments made to legislation.<\/span><\/p>\n

          In case of any queries or questions in relation to this policy please contact the LCA Data Protection Lead: Bev.fletcher@langworthycornerstone.co.uk\u00a0<\/span>\u00a0<\/span>\u00a0<\/span><\/p>\n

            \n
          1. \n

            Data collection<\/span><\/b><\/h4>\n<\/li>\n<\/ol>\n

            LCA will only collect data that is \u2018necessary\u2019 to conduct its operational and contractual requirements. It will identify the lawful basis for processing and ensure that this communicated clearly within its privacy notices and that appropriate documentation of our processing activities is recorded.<\/span><\/p>\n

            When collecting data, the LCA will ensure that the Individual\/Service User:<\/span><\/p>\n

            a)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Clearly understands why the information is needed <\/span><\/p>\n

            b)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Understands what it will be used for and what the consequences are should the Individual\/Service User decide not to accept the purposes of processing<\/span><\/p>\n

            c)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Where necessary, grants explicit consent, either written or verbal for data to be processed<\/span><\/p>\n

            d)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Is, as far as reasonably practicable, competent enough to understand what processing would require and if necessary provide consent that has been given freely.<\/span><\/p>\n

            e)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Has received sufficient information on why their data is needed and how it will be used.<\/span><\/p>\n

            Further information on the data we collect including its conditions for processing can be found within the LCA Privacy Notice.<\/span>\u00a0<\/span><\/p>\n

              \n
            1. \n

              Data Storage, Retention and Disposal<\/span><\/b><\/h4>\n<\/li>\n<\/ol>\n

              Information and records relating to service users will be stored securely and will only be accessible to authorised staff and volunteers.<\/span><\/p>\n

              Information will be stored for only as long as it is needed or required statute and will be disposed of appropriately. Retention periods will be kept to a minimum and data held will be filtered annually.<\/span><\/p>\n

              The organisation will take steps to ensure that personal data is kept secure at all times against unauthorised or unlawful loss or disclosure. The measures taken include: <\/span><\/p>\n

                \n
              • Personal Data will be kept in locked filing cabinets with access restricted to those people whom have authority to access the data<\/span><\/li>\n
              • Password protection on personal information files<\/span><\/li>\n
              • Restricted access to computer files and systems<\/span><\/li>\n
              • Data, including personal data, is backed up daily and information kept off site<\/span><\/li>\n
              • Suitable encrypted attachments for sensitive personal information sent by email<\/span><\/li>\n<\/ul>\n

                Any deliberate unauthorised disclosure of personal data to a third party by an employee may result in disciplinary proceedings.<\/span><\/p>\n

                The Board and Trustees are accountable for compliance of this policy. A trustee could be personally liable for any penalty arising from a breach that they have made. <\/span><\/p>\n

                Any deliberate unauthorised disclosure made by a volunteer may result in the termination of the volunteering agreement.<\/span><\/p>\n

                It is LCA\u2019s responsibility to ensure all personal and company data is non-recoverable from any computer system previously used within the organisation, which has been passed on\/sold to a third party. Any external destruction of data will be undertaken under contract and undertaken to any relevant British Standard.<\/span><\/p>\n

                  \n
                1. \n

                  Data Accuracy<\/span><\/b><\/h4>\n<\/li>\n<\/ol>\n

                  LCA will undertake reasonable steps to ensure data is kept accurate and up to date. This includes:<\/span><\/p>\n

                    \n
                  • To limit errors, data will only be held where necessary <\/span><\/li>\n
                  • Asking data subjects whether there have been any changes to their information<\/span><\/li>\n
                  • Ensuring that when inaccuracies are found that records are updated e.g. an out of date phone number is deleted from files<\/span><\/li>\n
                  • Investigating and acting upon any notifications by individuals of inaccuracies.<\/span><\/li>\n<\/ul>\n
                      \n
                    1. Training<\/span><\/b><\/li>\n<\/ol>\n

                      Training and awareness raising about the Data Protection Legislation and how it is followed in this organisation will take the following forms: <\/span><\/p>\n

                      On induction:<\/span><\/u>\u00a0 All new staff, trustees and volunteers will have an assessment of their understanding of Data Protection during the induction process.\u00a0 Following this assessment staff will have a session which will outline Data Protection regulations, the organisations policy and procedures in respect of Data Protection and their responsibilities as staff volunteers of LCA.\u00a0 Staff and Volunteers will be asked to sign a declaration confirming they understand and will adhere to the policy.<\/span><\/p>\n

                      Staff processing DBS applications will have additional training on the safe and secure handling of disclosure information.<\/span><\/p>\n

                      General training\/ awareness raising:<\/span><\/u> Information will be placed around the building to remind staff of the principles of data protection.\u00a0 This will be in the form of simple do\u2019s and don\u2019ts.\u00a0 Staff will be reminded of their responsibilities at team meetings and in line management. Where required staff will be offered additional training as part of staff training and professional development opportunities.<\/span><\/p>\n

                      LCA will ensure that:<\/span><\/p>\n

                        \n
                      • Everyone managing and handling personal information is trained to do so. <\/span><\/li>\n
                      • Anyone wanting to make enquiries about handling personal information, whether a member of staff, volunteer or service user, knows what to do; <\/span><\/li>\n
                      • Any disclosure of personal data will be in line with our procedures.<\/span><\/li>\n
                      • Queries about handling personal information will be dealt with swiftly and politely.<\/span><\/li>\n<\/ul>\n
                          \n
                        1. Data Protection by Design<\/span><\/b><\/li>\n<\/ol>\n

                          LCA is committed to considering data protection and privacy issues upfront in everything we do. LCA are committed to integrating data protection into all our activities and practices, from the design stage right through delivery lifecycles. This includes:<\/span><\/p>\n

                            \n
                          • Anticipating risk and privacy invasive events through the organisational risk register and taking steps to prevent harm to individuals.<\/span><\/li>\n
                          • Considering data protection issues as part of the planning, design and implementation of systems, services and delivery. Both through broader tools and Data Protection Impact Assessments as required.<\/span><\/li>\n
                          • Only processing the personal data that we need for our purposes(s), and that we only use the data for those purposes.<\/span><\/li>\n
                          • Providing the identity and contact information of those responsible for data protection both within our organisation and to individuals.<\/span><\/li>\n
                          • Ensuring that data processors can provide sufficient guarantees of the measures for data protection.<\/span><\/li>\n
                          • Using \u2018plain language\u2019 policy with any public documents and privacy notices so that individuals easily understand what we are doing with their personal data.<\/span><\/li>\n<\/ul>\n
                              \n
                            1. \n

                              Subject Access Request<\/span><\/b><\/h4>\n<\/li>\n<\/ol>\n

                              Under legislation individuals have the right to access data held about them as well as the right to be \u2018forgotten\u2019 where there is no longer a compelling reason to continue processing.<\/span><\/p>\n

                              A subject access request must be made in writing (including email) to LCA although reasonable adjustments can be made if required.<\/span><\/p>\n

                              Individuals can only request access to their own data (or must provide evidence that they are legitimately acting on another person\u2019s behalf). LCA may request proof of identity to ensure this.<\/span><\/p>\n

                              LCA may request further information on or clarification of the request.<\/span><\/p>\n

                              Information mentioning other people will be redacted if reasonable to do but may not be shared unless reasonable to do so or unless consent can be obtained for the relevant individual. <\/span><\/p>\n

                              Where requests are manifestly unfounded or excessive, in particular because they are repetitive, LCA will send a response to this affect and details of an appeals process (within the next calendar month)<\/span><\/p>\n

                              LCA will respond to any formal request within a calendar month. If there is a delay in obtaining the information requested then the request shall still be acknowledged within this period with an explanation for the delay and an expected date of response. <\/span><\/p>\n

                              Members of the public may request certain information from statutory bodies under the Freedom of Information Act 2000. The Act does not apply directly to LCA. However if at any time we undertake the delivery of services under contracts with relevant statutory bodies we may be required to assist them to meet the Freedom of Information Act request where we hold information on their behalf.<\/span><\/p>\n

                              In case of any requiring further information on this aspect of the policy please contact the LCA Data Protection Lead.<\/span><\/p>\n

                              \u00a0<\/span><\/p>\n

                                \n
                              1. Disclosure & Data Sharing<\/span><\/b><\/li>\n<\/ol>\n

                                LCA <\/span>may need to share data with other agencies such as <\/b>local authorities, funding bodies and other voluntary agencies as part of its work.<\/span><\/p>\n

                                The Data Subject will be made aware in most circumstances how and with whom their information will be shared as part of the Privacy Notice process.\u00a0 However, there are circumstances where the law allows LCA to disclose data (including sensitive data) without the data subject\u2019s knowledge.\u00a0\u00a0 <\/span><\/p>\n

                                These include:<\/span><\/p>\n

                                  \n
                                1. When required to by law \u2013 This may as simple as providing information to HMRC for tax purposes or if required by the police in relation to a crime. <\/span><\/li>\n
                                2. \u00a0<\/span><\/span>Protecting vital interests of a Data Subject or other person \u2013 This includes safeguarding concerns where an individual may be at risk or in cases of medical emergencies. <\/span><\/li>\n
                                3. The Data Subject has already made the information public <\/span><\/li>\n
                                4. \u00a0<\/span><\/span>Conducting any legal proceedings, obtaining legal advice or defending any legal rights\u00a0 <\/span><\/li>\n<\/ol>\n

                                  LCA regards the lawful and correct treatment of personal information as very important to successful working, and to maintaining the confidence of those with whom we deal.\u00a0 <\/span><\/p>\n

                                  LCA will ensure that personal information is treated lawfully and correctly.<\/span><\/p>\n

                                  Staff or Volunteers who are unsure about whether they can legitimately disclose personal data to an individual or organisation should seek advice from their line manager or the Data Protection Lead.<\/span><\/p>\n

                                    \n
                                  1. Risk Management\u00a0 <\/span><\/b><\/li>\n<\/ol>\n

                                    The consequences of breaching Data Protection can cause harm or distress to service users if their information is released to inappropriate people, or they could be denied a service to which they are entitled. <\/span><\/p>\n

                                    This policy and the supporting policies and procedures are designed to minimise the risks and to ensure that the reputation of LCA is not damaged through inappropriate or unauthorised access and sharing.<\/span><\/p>\n

                                    Data Protection is everyone\u2019s responsibility; if staff or volunteers know or suspect that a personal data breach has occurred, then they should immediately contact the Data Protection Lead. <\/span><\/p>\n

                                    LCA makes every effort to avoid data protection incidents, however, it is possible that mistakes will occur on occasions. Examples of how personal data incidents might occur include through: <\/span><\/p>\n

                                      \n
                                    • Loss or theft of data or equipment <\/span><\/li>\n
                                    • Ineffective access controls allowing unauthorised use <\/span><\/li>\n
                                    • Equipment failure <\/span><\/li>\n
                                    • Unauthorised disclosure (e.g. email sent to the incorrect recipient) <\/span><\/li>\n
                                    • Human error <\/span><\/li>\n
                                    • Hacking attack<\/span><\/li>\n<\/ul>\n

                                      In the event of a breach leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data, LCA will promptly assess the risk to individuals concerned and if appropriate report this breach to the Information Commissioners Office (more information is available on the ICO website). <\/span><\/p>\n

                                      If a reportable breach has occurred LCA is required to notify the Information Commissioner\u2019s Office as soon as possible, and not later than 72 hours after becoming aware of it.<\/span><\/p>\n

                                      Staff and Volunteers are actively encouraged to report any incidents or concerns that they may have in order to improve both our data protection and services to users. <\/span><\/p>\n

                                      However, staff and volunteers are also aware that they can be personally liable if they deliberately or maliciously use service user\u2019s personal data inappropriately.\u00a0 <\/span><\/p>\n

                                        \n
                                      1. \n

                                        Related Policies<\/span><\/b><\/h4>\n<\/li>\n<\/ol>\n

                                        Data protection is an organisation wide process and this policy does relate to other policies and documents within the organisation including but not limited to Subject Access Requests Procedure, IT Usage Policy, and Business Continuity.<\/span><\/p>\n

                                          \n
                                        1. \n

                                          Policy Review<\/span><\/b><\/h4>\n<\/li>\n<\/ol>\n

                                          This policy should be reviewed annually by the board<\/span><\/p>\n

                                          \u00a0<\/span><\/p>\n

                                            \n
                                          1. Further information\u00a0 <\/span><\/b><\/li>\n<\/ol>\n

                                            If staff, volunteers or members of the public\/or stakeholders have specific questions about information security and data protection in relation to LCA please contact the Data Protection Lead:<\/span><\/p>\n

                                            The Information Commissioner\u2019s website (www.ico.gov.uk) is another source of useful information.\u00a0 <\/span><\/p>\n

                                            \u00a0<\/span><\/p>\n

                                            Appendix i \u2013 Glossary of Terms<\/span><\/b><\/h3>\n

                                            The following list contains definitions of the technical terms we have used and is intended to aid <\/span><\/p>\n

                                            Data Controller \u2013 The person who (either alone or with others) decides what personal information (Langworthy Cornerstone Association) will hold and how it will be held or used.<\/span><\/p>\n

                                            Data Protection Act 2018<\/span> \u2013 The UK legislation that provides a framework for responsible behaviour by those using personal information.<\/span><\/p>\n

                                            Data Protection Impact Assessments (DPIA) – is a process to help you identify and minimise the data protection risks of a project.<\/span><\/p>\n

                                            Data Protection Lead \u2013 The person(s) responsible for ensuring that LCA follows its data protection policy and complies with legislation.<\/span><\/p>\n

                                            General Data Protection Regulation (GDPR) – The GDPR is the EU General Data Protection Regulation which will replace the Data Protection Act 2018<\/span> in the UK and the equivalent legislation across the EU Member States.<\/span><\/p>\n

                                            Individual\/Service User \u2013 The person whose personal information is being held or processed by (Langworthy Cornerstone Association) if for example: a client, an employee, or supporter.<\/span><\/p>\n

                                            Information Commissioner (ICO)\u2013 The UK Information Commissioner responsible for implementing and overseeing the Data Protection Act 2018.<\/span><\/span><\/p>\n

                                            Processing \u2013 means collecting, amending, handling, storing or disclosing personal information.<\/span><\/p>\n

                                            Personal Information \u2013 Information about living individuals that enables them to be identified \u2013 e.g. name and address. It does not apply to information about organisations, companies and agencies but applies to named persons, including service users, individual volunteers or employees <\/span><\/p>\n

                                            \u00a0<\/span><\/p>\n

                                            Sensitive data \u2013 refers to data about:<\/span><\/p>\n

                                              \n
                                            • race.<\/span><\/li>\n
                                            • ethnic origin.<\/span><\/li>\n
                                            • \u00a0<\/span><\/span>politics.<\/span><\/li>\n
                                            • \u00a0<\/span><\/span>religion.<\/span><\/li>\n
                                            • trade union membership.<\/span><\/li>\n
                                            • genetics.<\/span><\/li>\n
                                            • biometrics (where used for ID purposes);<\/span><\/li>\n
                                            • health.<\/span><\/li>\n
                                            • sex life; or<\/span><\/li>\n
                                            • sexual orientation<\/span><\/li>\n<\/ul>\n

                                              \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0<\/p>\n

                                              <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

                                              our Data Protection Policy Langworthy Cornerstone Association (LCA) recognises the importance of the correct and lawful treatment of personal data; it maintains confidence in the organisation and provides for successful operations. In order to ensure effective delivery of services, LCA is required to maintain certain personal data about individuals in order to carry out our…<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":6768,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"footnotes":""},"class_list":["post-6670","page","type-page","status-publish","hentry"],"acf":[],"_links":{"self":[{"href":"http:\/\/langworthycornerstone.co.uk\/staging2\/wp-json\/wp\/v2\/pages\/6670","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/langworthycornerstone.co.uk\/staging2\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"http:\/\/langworthycornerstone.co.uk\/staging2\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"http:\/\/langworthycornerstone.co.uk\/staging2\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/langworthycornerstone.co.uk\/staging2\/wp-json\/wp\/v2\/comments?post=6670"}],"version-history":[{"count":8,"href":"http:\/\/langworthycornerstone.co.uk\/staging2\/wp-json\/wp\/v2\/pages\/6670\/revisions"}],"predecessor-version":[{"id":11441,"href":"http:\/\/langworthycornerstone.co.uk\/staging2\/wp-json\/wp\/v2\/pages\/6670\/revisions\/11441"}],"up":[{"embeddable":true,"href":"http:\/\/langworthycornerstone.co.uk\/staging2\/wp-json\/wp\/v2\/pages\/6768"}],"wp:attachment":[{"href":"http:\/\/langworthycornerstone.co.uk\/staging2\/wp-json\/wp\/v2\/media?parent=6670"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}