Privacy Policy

PRIVACY STATEMENT – HARROW CLUB W10

This privacy notice sets out the basis on which any personal data we collect from you, or that you provide to us, will be used by us – how we collect, use and store your personal information.
We are committed to treating you with respect and openness and to not holding data that is not important for the effective delivery of our services.

About Us & Contact Details

Harrow Club W10 is a youth charity supporting young people in the boroughs of Kensington & Chelsea and Hammersmith & Fulham.
We are a “data controller” for the purposes of the UK data protection laws. This means that we are responsible for, and control the processing of, your personal information.
Our Data Protection Officer is Rosalind Oxley. You can contact her – ros@harrowclub.org

There are many other ways you can contact us, including:

Email: info@harrowclub.org
Phone: 0208 969 2528
Post: Harrow Club W10, 187 Freston Road, London W10 6TH
Website: harrowclub.org

How Do We Obtain Your Information?

This might be provided by yourself if you attend our youth clubs or are the guardian of someone who attends, if you become a member of staff or volunteer with us, if attend an event or donate monies to the Club, or visit the Club for a 3rd party activity or are a contractor.

If you are aged 18 or under, we will require your parent/guardian’s permission before you provide any personal information to us and we will ask for your parent/guardian to provide consent to us in addition to your permission.

What Specific Information We Request, And How We Use, Store and Protect Your Information

There are six categories of people for whom we obtain and retain personal information. These are:

Young People – who register to attend our youth club sessions
Parents/Carers/Guardians – whose young people are registered with us
Donors/Supporters – who attend fundraising events and/or who donate to the Club
Staff & Volunteers
Club Visitors – anyone who enters our premises or driveway
Third Party People/Organisations Who Book To Use Our Facilities

Young People

Purpose of Processing	What Personal Data Do We Obtain?	Lawful Basis	How Long We Keep Your Personal Data?
To ensure we are able to contact you our services and/or to process information where we reasonably think there is a risk of serious harm or abuse to you or someone else	Name Postal Address Email Address Mobile Phone Home Phone	It is in our legitimate interest to be able to be in contact with you.	Up to 7 years
To ensure we have details so we can contact you in an emergency or to keep you aware of our service provision	Name Postal Address Email Address Mobile Phone Home Phone	It is in our legitimate interest to be able to contact you	Up to 7 years
To ensure we are aware of any medical conditions or disabilities and to enable us to safeguard our young people	Medical Conditions Disabilities	You will have given your consent to this when registering as a member of the Club	Up to 7 years
To be able to report to our funders and trustees regarding ethnicity and other criteria such as age, gender and education centre	Name Postal Address Education Centre Date of Birth Gender Ethnicity Photograph (during activities)	It is in our legitimate interest as this is information required to report on a funded project. Where we process information about your ethnicity, we do so specifically for the purpose of monitoring equality of opportunity or treatment by us and our funders and trustees.	Up to 7 years
To be able to produce images of our activities for our website/newsletter	Photograph (during activities)	It is in our legitimate interest so we can create hard and soft copy images to communicate the services of the club.	Up to 10 years
To review any incidents taking place at the club	CCTV	It is in our legitimate interest so that we can safeguard our young people in the event of an incident	Up to 30 days

Parents/Carers/Guardians

Purpose of Processing	What Personal Data Do We Obtain?	Lawful Basis	How Long We Keep Your Personal Data?
To ensure we have your consent for a young person to join the Club	Name Signature	It is in our legitimate interest as our members are often under the age of 18.	Up to 7 years
To ensure we have your consent for a young person to attend an offsite activity	Name Signature	It is in our legitimate interest as our members are often under the age of 18 and we are taking them offsite.	Up to 7 years
To ensure we can contact you in an emergency or to advise you of our services	Name Signature Postal Address Email Address Mobile Phone Home Phone	It is in our legitimate interest to be able to stay in touch with you about our services and in the event there is an emergency related to your child.	Up to 7 years
To ensure we have your consent to take and publish pictures of a young person.	Name Signature	It is in our legitimate interest as we need your consent to publish photos of young people under the age of 18.	Up to 7 years
To review any incidents taking place at the club	CCTV	It is in our legitimate interest so that we can investigate any incidents	Up to 30 days

Donors/Supporters

Purpose of Processing	What Personal Data Do We Obtain?	Lawful Basis	How Long We Keep Your Personal Data?
To provide you with information about our services and how their donations have been used	Name Email Address	We require your consent for this type of communication and rely on your express consent. If a contact of yours, who is already connected to the club, provides us with your contact information, we will ask for your consent before adding you to our database	Up to 5 years
To invite you to events	Name Email Address	We require your consent for this type of communication. We will ask for your consent before adding you to our database	Up to 5 years
To ask you for financial or practical support/donations	Name Email Address	We require your consent for this type of communication. We will ask for your consent before adding you to our database	Up to 5 years
To claim Gift Aid for your donations	Postal Address Connection to Club Sums Donated Month of Donation or Campaign	It is in our legitimate interest as you have donated to the Club and we require this information to make a gift aid claim	Up to 5 years

Staff/Volunteers

Purpose of Processing	What Personal Data Do We Obtain?	Lawful Basis	How Long We Keep Your Personal Data?
In order to pay you	Name Email Address Postal Address NI Number Tax Code Bank Account Details Working Hours Salary	It is in our legitimate interest to facilitate payroll	Up to 5 years
To be able to contact you if you are working offsite or to communicate issues related to your employment	Name Email Address Postal Address Mobile Number	It is in our legitimate interest to be able to contact members of staff	Up to 5 years
To apply for DBS Certificate which is required if you work with young people so we are aware of any prior criminal acts	Name Current Address Historical Addresses Prior Names Place of Birth Current and Historic Nationality Convictions and Dates 3 Proofs of Identity	We rely on your express content	Up to 1 year
To provide you with an employment contract and be able to send it to you	Name Postal Address Email Address Salary Working Hours	It is our legitimate interest to provide you with an employment contract so that we have a contractual relationship with you as your employer	Up to 5 years
To record sick days, sick notices, holidays and performance appraisals, disciplinaries etc	Name Dates of Illness Dates of Holiday Info re Disciplinary	It is our legitimate interest to record data related sick days, holidays and performance appraisals, disciplinaries etc. To the extent that we collect any of your health information, we will obtain your consent beforehand. Any personal data that we process that relates to any criminal convictions or offences, we hold for the purpose of the detection or prevention of unlawful acts.	Up to 5 years
To have the ability to contact your selected person in an emergency	Contact Person Name Contract Person Mobile Relationship with Contact Person	It is our legitimate interest to have an emergency contact person	Up to 5 years
To review any incidents taking place at the club	CCTV	It is in our legitimate interest so that we can investigate any incidents	Up to 30 days

Building Visitors

(could be staff, parents, young people, contractors, third party bookers)

Purpose of Processing	What Personal Data Do We Obtain?	Lawful Basis	How Long We Keep Your Personal Data?
To investigate incidents and prevent crime that might affect you – there are notices that advise you of this in reception	Footage of anyone in certain areas of the Harrow Club Building at 187 Freston Road, London W10 6TH	It is in our legitimate interest to investigate incidents and provide security. We process any personal data that relates to criminal offences or convictions for the purpose of preventing or detecting unlawful acts	Up to 5 weeks
To review any incidents taking place at the club	CCTV	It is in our legitimate interest so that we can safeguard our young people in the event of an incident	Up to 30 days

3rd Parties Who Rent Our Facilities

Purpose of Processing	What Personal Data Do We Obtain?	Lawful Basis	How Long We Keep Your Personal Data?
To contact you about your enquiry, booking or payment	Name Postal Address Email Address Mobile Number	It is in our legitimate interest to be in contact with those enquiring or booking our services	Up to 2 years
To review any incidents taking place at the club	CCTV	It is in our legitimate interest so that we can investigate any incidents	Up to 30 days

Do We Share Your Information?

We do not share your information with any third parties other than:

specific organisations who provide us with grants and who require us to submit certain information about the young people who have benefited from their grant
software providers whose systems we use but who are subject to contractual obligations related to data protection
tax, legal or accounting professional advisers
our Website and Software developers.
email marketing suppliers such as Mailchimp
we will also comply with requests where disclosure is required by law, for example, we may disclose your personal information to the government for tax investigation purposes, or to law enforcement agencies for the prevention and detection of crime. We may also share your information with the emergency services if we reasonably think there is a risk of serious harm or abuse to you or someone else.

Keeping Your Information Safe

We’ve implemented appropriate physical, technical and employee measures to help us protect the personal information we have, both on and off-line, from improper access, use, alteration, destruction and loss.

How Long Do We Keep Your Information?

We only keep your information if it’s reasonable and necessary for either organisational or legal purposes. For details, see above.

Your Rights

You have the:

Right of access to personal data – You have a right to request a copy of the personal data we hold about you.
Right to rectification – If you believe the personal data we hold about you is incorrect, you can contact us to request for any incomplete or inaccurate data that we hold about you to be corrected. However, we may need to verify the accuracy of the new information you provide to us.
Right to erasure – You have the right to request the deletion or removal of personal data we hold about you where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to us holding your information, where we may have processed your information unlawfully or where we are required to erase your personal data to comply with law. Although we will consider every request for erasure on its merits, we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at that time of your request.
Right to object to processing – You have a right to object to the processing of your personal data where we are using it for the purpose of our legitimate interests. If we agree that your objection is justified, we will stop using your information for those purposes. Alternatively, we will explain why we still need to use your information.
Right to restrict processing of your personal data – You have a right to request us to suspend the processing of your personal data in the following situations:
– for the period it takes us to rectify any inaccurate data about you;
– where our use of the data is unlawful but you do not want us to erase it;
– where you want to prevent us from deleting your data at the end of the retention period in the event that – you need it to establish, exercise or defend a legal claim;
– where you have objected to our use of your data, but we need to verify whether we (or a third party) have overriding legitimate grounds to use it.
Right to request the transfer of your personal data to you or to a third party – You have the right to ask us to transfer certain information we hold about you to a third party you have chosen, or directly to you. Where your request is valid, we will provide you with your personal data in a structured, commonly used, machine-readable format.

Just contact us using the contact details provided at the top of this notice.

Finally, you have a right to complain to the relevant data protection authority. In the UK this is the Information Commissioner’s Office. You can contact them:
by Telephone: 0303 123 1113 or 01625 545 745
or in writing to: Information Commissioner’s Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
or via their website: https://ico.org.uk/

Sharing Information Outside the UK

We will transfer your information outside the UK as some of our servers are held within the EU. Our database is hosted in the Republic of Ireland by a subsidiary of Apple Inc.

We will only share personal data with others outside the UK when we are legally permitted to do so, namely where:

If the UK government has decided that the relevant country has adequate protective rules in relation to data protection in place (an “adequacy decision”);
If we have entered into the relevant “standard contractual clauses” with the recipient of your personal data (these are a set of obligations about how your data is protected and used); or
If we can rely on another basis under the law such as having to share the personal data because this is necessary for the purpose of a court case, investigation or to protect our legal rights.

Third Party Access to Data

Under no circumstance will the Charity share with, sell or otherwise make available to Third Parties any personal data except where it is necessary and unavoidable to do so in pursuit of its charitable objects as authorised by the Data Controller.

Whenever possible, data subjects will be informed in advance of the necessity to share their personal data with a Third Party in pursuit of the Charity’s objects.

Before sharing personal data with a Third Party the Charity will take all reasonable steps to verify that the Third Party is, itself, compliant with the provisions of the GDPR and confirmed in a written contract. The contract will specify that:

The Charity is the owner of the data;
The Third Party will hold and process all data shared with it exclusively as specified by the instructions of the Data Controller;
The Third Party will not use the data for its own purposes;
The Third Party will adopt prevailing industry standard best practice to ensure that the data are held securely and protected from theft, corruption or loss;
The Third Party will be responsible for the consequences of any theft, breach, corruption or loss of the Charity’s data (including any fines or other penalties imposed by the Information Commissioner’s Office) unless such theft, breach, corruption or loss was a direct and unavoidable consequence of the Third Party complying with the data processing instructions of the Data Controller
The Third Party will not share the data, or the results of any analysis or other processing of the data with any other party without the explicit written permission of the Data Controller;
The Third Party will securely delete all data that it holds on behalf of the Charity once the purpose of processing the data has been accomplished.
The Charity does not, and will not, transfer personal data out of the EU.

Data Breach

In the event of any data breach coming to the attention of the Data Controller the Trustees will immediately notify the Information Commission’s Office.

In the event that full details of the nature and consequences of the data breach are not immediately accessible (eg: because Data Processors do not work on every normal weekday) the Trustees will bring that to the attention of the Information Commissioner’s Office and undertake to forward the relevant information as soon as it becomes available.

Cookies

We use cookies on our website. For more information on cookies, please see our cookie notice.

Notification Of changes To This Privacy Notice

This Privacy Notice may change from time-to-time. For example, we will continue to update it to reflect new legal requirements. This version was last updated on 27/02/2021.