Lawful Processing

Data protection law requires us to rely on one or more lawful grounds to process your personal information. Depending on the service you are accessing, these will change. We consider the following grounds to be relevant:

• Specific Consent – Where you have provided specific consent to us using your personal information in a certain way, such as to send you an email or newsletter
• Performance of a contract—To enable us to provide products or services to you, such as support from our team or a grant.
• Legal obligation – Where necessary so that we can comply with a legal or regulatory obligation to which we are subject
• Vital interests – Where it is necessary to protect life or health (for example, in the case of a medical emergency suffered by an individual at one of our events) or a safeguarding issue that requires us to share your information with the emergency services.
• Legitimate interests – Where it is reasonably necessary to achieve our or others’ legitimate interests (as long as what the information is used for is fair and does not duly impact your rights). Examples of this include:
  • Sending you specific related opportunities or events such as new funding or training opportunities.
  • Letting you know about the research we conduct to help us improve our services or the lives of people in Bury.

When we legitimately process your personal information in this way, we consider and balance any potential impact on you (both positive and negative), and your rights under data protection laws.

We will not use your personal information where our own interests are overridden by the impact on you, for example, where use would be excessively intrusive (unless, for instance, we are otherwise required or permitted to by law).

When we use sensitive personal information, we require an additional legal basis under data protection laws. We will either do so on the basis of your explicit consent or another lawful route (for example, if we need to process it for employment, social security or social protection purposes, your vital interests, or, in some cases, if it is in the public interest for us to do so).

Data Sharing

Bury VCFA will only share information with those who need to know it to provide our services. Further information on who we share information with is within each service area.

We share anonymised statistical information and case studies with our funders and commissioners, including Bury Council and Greater Manchester Integrated Care System – no personal individual can be identified from this data.

If you have any queries regarding if your data is shared and the sharing processes we undertake, please speak to the member of staff you are working with or contact our data protection lead via admin@buryvcfa.org.uk

By law, we are required to protect public funds that we are responsible for (e.g. our grants programme). This means we may also use any of the information you provide to prevent and detect fraud. This may involve sharing this information with organisations responsible for auditing or administering public funds, including the local authority and the clinical care commission.

When necessary and appropriate, information held will be shared with organisations such as the Police to prevent or detect crime, apprehend or prosecute offenders or prevent the risk of harm to an individual, e.g. safeguarding.

Data Storage and Retention

We have implemented appropriate measures to help ensure your data is kept secure. These include:

• The appointment of a data protection lead who reports directly to the board
• Taking a ‘data protection by design and default approach to our activities.
• Adopting and implementing data protection policies and ensuring we have written contracts in place with our data processors.
• Implementing appropriate security measures in relation to the personal data we process.
• Carrying out data protection impact assessments for our high-risk processing
• Staff that can see your information have undergone specific training around how to handle information properly
•  We have relevant policies and procedures which set how your information is handled and protected.

Bury VCFA main database and server systems are hosted in the UK and technical our main support contracts are provided by a UK-based organisation. However, on occasion, it may be necessary to transfer personal data outside of the EAA. If we transfer your information beyond the EU, we will ensure it’s protected in the same way as if it was being used in the EAA. To keep your information safe, we will either:

• transfer it to a non-EAA country with privacy laws that give the same protection as the EAA
• put in place a contract with the recipient, which means they must protect it to the same standards as the EAA

Where the transfer is to the US, we will ensure that the transfer is lawful and, if required, undertake an additional risk assessment to protect your personal rights and data.

Information must be kept for different lengths of time, often dictated by law or funding terms and conditions. Due to the many kinds of information that Bury VCFA uses, we have included how long we keep the data under each project or service notice.

Automated Decision Making

Automated decision-making occurs when an electronic system uses your personal information to make a decision without human intervention. No decisions are made in Bury VCFA about you based solely on automated decision-making, including profiling.

Your data protection rights

Under data protection law, you have rights including:

• Your right of access – you have the right to ask us for copies of your personal information.
• Your right to rectification – You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
• Your right to erasure—You have the right to ask us to erase your personal information in certain circumstances. We may need to keep certain aspects of the data that we hold on record about you, particularly where this is connected to a constituted group or organisation that has received funding from us. We will advise you if this is the case. We will explain exactly what information can be deleted and why we cannot delete any element of your data.
• Your right to restriction of processing – You have the right to ask us to restrict the processing of your information in certain circumstances.
• Your right to object to processing – You have the right to object to the processing of your personal data in certain circumstances.
• Your right to data portability – You have the right to ask that we transfer the information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights.

If you make a request, we have one month to respond. Please contact us if you wish to make a request. Tel: 0161 518 5550, email: admin@buryvcfa.org.uk. If you require further information about how we use data at Bury VCFA, please get in touch with the Chief Officer on 0161 518 5550.

You have the right to complain if you feel your information is not being used properly. To begin with, it may be better to speak with the staff member who is working with you to discuss your concerns. Alternatively, you can contact our data protection lead –admin@buryvcfa.org.uk

If you are still not satisfied with Bury VCFA’s response, you have the right to complain to the Information Commissioner’s Office. For further details on this and your information rights, please visit the Information Commissioner’s Office Website.

Changes to this policy

We will review this privacy policy as we update or change our services (at least annually), and the updated document will be made available to individuals via our website.

Our Services and Activities

Bury VCFA Membership

We collect your information to administer our membership service offer, including processing their membership applications as well as keeping organisations and groups informed about our services as well as news, events and activities that affect them and their work.

What type(s) of information do we use?

• Contact details
• Information about your organisation

What is the legal basis for using your information?

• Performance of a contract – To enable us to provide products or services to you
• Legitimate interests – Where it is reasonably necessary to achieve our or others’ legitimate interests. Examples of this include:
  • Sending you specific related opportunities or events such as new funding or training opportunities.
  • Letting you know about the research we conduct to help us improve our services or the lives of people in Bury.

Where do we get your information?

• Submitted by yourself / the organisation

Who do we share your information with?

Statistical Data regarding our membership may be provided to our funders and commissioner. However, this data is anonymous, and no individuals can be identified from these reports.

How long will we keep your information?

• Information is kept for the duration of your membership with Bury VCFA.
• Membership of Bury VCFA is terminated at the request of the member or Bury VCFA as outlined in the membership agreement.
• Personal data is currently kept for 12 months after the end of your membership.

Back to Top

Bury VCFA Development Support / Capacity Building

We collect your information to provide you with a service. We record details of the support we give through our processes, including the nature of the support, how we have helped, what the outcome was, etc. Although the majority of this information is about the organisation, we may also occasionally be given personal information.

What type(s) of information do we use?

• Contact details
• Information about your organisation

What is the legal basis for using your information?

• Performance of a contract – To enable us to provide products or services to you
• Legitimate interests – Where it is reasonably necessary to achieve our or others’ legitimate interests. Examples of this include:
  • Sending you specific related opportunities or events such as new funding or training opportunities.
  • Letting you know about research we conducting to help us improve our services or the lives of people in Bury.
• Public Task – For example, monitoring the reach and diversity of our service.
• Legal obligation – Where necessary so that we can comply with a legal or regulatory obligations.
• Vital interests – Where it is necessary to protect life or health for example a safeguarding issue which requires us to share your information with the emergency services.
• Consent – this is used explicitly with regards to E26 / Our Business Social Enterprise Support, including sharing your information with 10GM and the GMCA

Where do we get your information?

• Submitted by yourself / the organisation
• A referral from a third party e.g. local authority

Who do we share your information with?

• Your organisational contact details may be shared with other organisations in order for us to support your work. This will not be done without your permission unless we have a legal reason for doing so e.g. safeguarding, charity fraud etc
• Our core development work is funded through a range of funders including Bury Council, 10GM and the GMCA. We provide statistical information and case studies to them regarding the delivery our services. This information is anonymous and no individuals can be identified from it.
• Groups being supported through our Social Economy Support (Our Business) will be asked additional monitoring and evaluation questions. and Bury VCFA will share their information as a commissioned body to the GMCA via 10GM. For more details on how your data is used in this programme, visit the GMCA privacy notice

How long will we keep your information?
Our development support case files are kept for a minimum of seven years to meet our legal and funding obligations.

Back to Top

Bury VCFA Training and Events

We collect your information to administer our training and events offer, including enabling you to attend an accessible, high-quality event or training experience.

What type(s) of information do we use?

• Contact details
• Information about your organisation
• Any access or mobility issues
• Any dietary requirements

What is the legal basis for using your information?

• Performance of a contract – To enable us to provide products or services to you
• Legitimate interests – Where it is reasonably necessary to achieve our or others’ legitimate interests. Examples of this include:
  • Sending you specific related opportunities or events such as new funding or training opportunities.
  • Letting you know about the research we are conducting to help us improve our services or the lives of people in Bury.

Where do we get your information?

• Submitted by yourself / the organisation.

Who do we share your information with?

Your details will be shared in advance with the event trainer/facilitator to ensure the best possible course delivery.

Statistical Data regarding our training may be provided to our funders and commissioner. However, this data is anonymous, and no individuals can be identified from these reports.

How long will we keep your information?

Once data has been transferred onto our database system, hard copy booking forms are securely disposed of. Data relating to our training and events programme is kept for 12 months to enable event administration and the competition of annual reports.

Back to Top

Bury VCFA Administered Grants and Investments

We collect your information to administer and monitor our grant and investment programmes to support VCSE organisations in Bury in accessing funding.

What type(s) of information do we use?

• Contact details
• Information about your organisation, including bank account details

What is the legal basis for using your information?

• Performance of a contract – To enable us to provide products or services to you
• Legitimate interests – Where it is reasonably necessary to achieve our or others’ legitimate interests. Example of this include:
  • Sending you specific related opportunities or events such as new funding or training opportunities.
  • Letting you know about research we conducting to help us improve our services or the lives of people in Bury.
• Legal obligation – Where necessary so that we can comply with a legal or regulatory obligation

Where do we get your information?

• Submitted by yourself / the organisation

Who do we share your information with?

Bury VCFA does not usually share the personal information contained within grant applications. The only exception is where there is a legal obligation, such as to prevent fraud or theft of public funds.

However, details of grants awarded to organisations are shared with the funder and made publicly available as details in the terms and conditions of the award.

Statistical monitoring and project case studies are collected from organisations we’ve funded. The collection of any consent required is the responsibility of the funded organisations before sharing with Bury VCFA

How long will we keep your information?

Information will be kept as contractually required by our funder. This is typically seven years from the point of award.

Back to Top

Bury Volunteer Bank  / Our Volunteer Centre Services – Individuals

We collect your information to enable us to deliver a high-quality volunteer brokerage service within Bury.

What type(s) of information do we use?

• Contact details
• Date of Birth
• Your volunteering interest and availability
• Demographic information

What is the legal basis for using your information

• Performance of a contract – To enable us to provide products or services to you
• Legitimate interests – Where it is reasonably necessary to achieve our or others’ legitimate interests. Examples of this include:
  • Contacting individuals after they’ve been referred to a placement to check on their progress and whether further support is required.
• Legal obligation – Where necessary so that we can comply with a legal or regulatory obligation

Where do we get your information?

• Submitted by yourself

Who do we share your information with?

Your contact details will be shared with VCSE organisations of your choice to enable volunteer placement.

Various funders, including Bury Council, GMCA, and Government bodies such as Sport England, fund our work. We provide them with statistical information and case studies regarding the delivery of our services. This information is anonymous, and no individuals can be identified from it.

How long will we keep your information?

Our files are kept for a minimum of seven years to meet our legal and funding obligations.

Bury Volunteer Bank  / Our Volunteer Centre Services – Organisations

We collect your information to enable us to deliver a high-quality volunteer brokerage service within Bury.

What type(s) of information do we use?

• Contact details
• Information about your organisation
• Information about volunteer roles and opportunities in your organisation

What is the legal basis for using your information?

• Performance of a contract – To enable us to provide products or services to you
• Legitimate interests – Where it is reasonably necessary to achieve our or others’ legitimate interests. Examples of this include:
  • Sending you specific related opportunities or events such as new funding or training opportunities.
  • Letting you know about research we conducting to help us improve our services or the lives of people in Bury.

Where do we get your information?

• Submitted by yourself / the organisation

Who do we share your information with?

Your organisational contact details will be shared with potential volunteers to support volunteer recruitment and brokerage.

Various funders, including Bury Council, GMCA, and Government Bodies such as Sport England that fund our work. We provide them with statistical information and case studies regarding the delivery of our services. This information is anonymous, and no individuals can be identified from it.

How long will we keep your information?

Our files are kept for a minimum of seven years to meet our legal and funding obligations.

Back to Top

Working or Volunteering for Bury VCFA

Bury VCFA values its Staff and Volunteers (including its Trustees). Our Volunteer records are kept and retained in the same manner as our employee records. We have created a specific privacy notice for our Staff and Volunteers, which can be downloaded here.

Beacon Service / Social Prescribing (This Service Closed 31st March 2024)

We collect your information to administer our social prescribing service and monitor the effectiveness and quality of service that we provide.

What type(s) of information do we use?

• Contact details
• Date of Birth
• NHS Number
• Details of your GP – so that we can provide feedback to them on the support you have received,
• Reason for Referral – This information is banded into groups to limit the information we receive
• Demographic Information- including gender and ethnicity
• Wellbeing Measurements – provided by you via questionnaires and sessions with your social prescriber.
• We also collate non-identifiable information regarding your referral point and satisfaction with the service

What is the legal basis for using your information?

• Performance of a contract – To enable us to provide products or services to you
• Consent – Some of the data is provided to us only with your consent
• Legal obligation – Where necessary so that we can comply with a legal or regulatory obligation
• Vital interests – Where it is necessary to protect life or health for example a safeguarding issue which requires us to share your information with the emergency services.

Where do we get your information?

• Submitted by yourself
• A referral from your GP or other health professional – given with your permission

Who do we share your information with?

• Your GP – Information will be shared back to your GP about your engagement with the service and any outcomes that you achieve
• Multi-Disciplinary Teams – With your permission your team may be raised in a Multiple Disciplinary Team Meeting. This is a team of health professional committed to ensure the best package of care and support for you.
• Commissioners – We provide regular statistical reports to them about this work. They do not receive your personal information.
• At the closure of the service (31st March 2024) any outstanding live cases were transferred to Bury GP Federation the new service provider to ensure a continuation of care and service.

How long will we keep your information?

Our records on this programme are kept for seven years to meet our legal and funding obligations.

Back to Top

Bury VCFA Mailing Lists / Bulletin

We collect your information to enable us to provide you with relevant information and updates for your group or organisation via our regular bulletin / thematic mailing lists

What type(s) of information do we use?

• Contact details
• Information about your organisation / Your role
• Details of Bury VCFA events you’ve attended (if relevant)

What is the legal basis for using your information?

• Consent– We process your personal information for the purposes above based on your consent. You can withdraw consent and unsubscribe to the communication you receive at any point by following the instructions provided in each communication we send you.

Where do we get your information?

•  Submitted by yourself

Who do we share your information with?
Our mailing lists are never shared or sold with any third party, and we make sure that everything we send is relevant to our work, including our support offer to organisations.

How long will we keep your information?
We will keep your data until you withdraw your consent or unsubscribe from receiving a specific communication. We will delete your details if we become aware that your contact details are out of date or incorrect.

Back to Top

Photography / Videos

We collect your information to showcase and highlight our work and to share the work and stories of the voluntary sector.

What type(s) of information do we use?

• Photos of Bury VCFA Events and Activities
• Case studies of the work of the VCSE Sector and Bury VCFA

What is the legal basis for using your information?

• Consent– We process your personal information for the purposes above based on your consent. If you wish to withdraw your consent, you may do so at any time by contacting Bury VCFA
• Legitimate interests – Where it is reasonably necessary to achieve our or others’ legitimate interests. This means that Bury VCFA benefits from being able to record events and activities to provide information and promote our services and other activities. We can do this as long as it does not unfairly impact you.

Where do we get your information?

• Submitted by yourself / your organisation
• Bury VCFA Staff / Volunteers
• External contractors

Who do we share your information with?

Published materials are available to anyone with access to the website or printed materials with photo or video features. Photographs/videos taken and any reproductions may be used by Bury VCFA for any advertising purposes or to illustrate wording. The photographs/videos may be used in promotional material, including, but not limited to, promotional flyers, websites, posters, social media, and display boards, with any reasonable retouching or alteration.

The original photographs and videos will only be accessible to employees, volunteers and agents of Bury VCFA, or third parties that process data on behalf of Bury VCFA (e.g. printing providers, digital asset management suppliers).

How long will we keep your information?
Photos, Videos, and Imagery will only be used in promotional materials for 3 years. After 3 years, they will be archived for organizational history.

Back to Top

Research and Monitoring

We will use the information you provide to:

• analyse statistical data so we can plan how we provide services;
• create anonymised data to help improve services and to be published in various reports that will also be publicly available.
• create anonymised reports and case studies for our funder and commissioners to demonstrate effective delivery and to enable us to continue service delivery.

Anonymising the data used in this way means that it will not contain any personal information. So, you, your family, or any individual person cannot be identified from this information.

As Bury VCFA, we also periodically conduct a range of research programmes and projects. The full details of how this information will be used will be included in specific project privacy notices.

Back to Top

Our Website

Gathering of Non-Personal Information

Our website collects non-personally identifying information that web browsers and servers typically make available. This information includes browser type, language preference, referring site, and the date and time of each visitor request. Our purpose in collecting non-personally identifying information is to understand better how visitors use our websites.

From time to time, we may release non-personally-identifying information in the aggregate, e.g., by publishing a report on trends in the usage of its website.

Gathering of Personal Information

Certain visitors to our website (buryvcfa.org.uk), choose to interact with the sites in ways that require Bury VCFA to gather personal information to access services. The amount and type of information that we gather depends on the service you are accessing e.g. the Bury Volunteer Bank. Individuals can always refuse to supply personal information, but doing so may prevent them from accessing certain activities online or require them to contact us directly.

Bury VCFA also collects potentially personally-identifying information like Internet Protocol (IP) addresses. We do not use such information to identify our visitors and do not disclose such information other than in the same circumstances that we use to disclose personally-identifying information, as described below.

Cookies

A cookie is a string of information that a website stores on a visitor’s computer, which the visitor’s browser provides to the website each time the visitor returns. Bury VCFA uses cookies to help us identify and track visitors, their usage of our websites, and their website access preferences. Bury VCFA website users who do not wish to have cookies placed on their computers should set their browsers to refuse cookies before using Bury VCFA’s websites, with the drawback that certain features of these websites may not function properly without the aid of cookies.

Bury VCFA website uses tracking software to monitor its visitors to better understand how they use it. Google Analytics and HotJar provide this software, which uses cookies to track visitor usage. The software will save a cookie to your computer’s hard drive in order to track and monitor your engagement and usage of the website, but will not store, save or collect personal information. You can read Google’s privacy policy here and the HotJar Privacy Information here for further details.

External links

Although Bury VCFA try to ensure that it only includes quality, safe and relevant external links, users are advised to adopt a policy of caution before clicking any external web links mentioned throughout this website. (External links are clickable text/banner/image links to other websites)

Despite our best efforts, Bury VCFA cannot guarantee or verify the contents of any externally linked website. Users should be aware that they click on external links at their own risk, and this website and its owners cannot be held liable for any damages or implications caused by visiting any external links mentioned.

Back to Top