This policy explains how and why The Connection at St Martin-in-the-Fields uses your personal information when you donate to us or take part in an event organised by us.

When we refer to “we” or “us” in this policy we are referring to The Connection at St Martin-in-the-Fields. We are listed on the Information Commissioner’s register of data controllers under Registration Number Z7919091.

1. Using your personal information

We only ever use your personal data if we are satisfied that it is lawful and fair to do so. When we process your personal information, it will be because:

• you have consented to the processing for the specific purposes described in this notice;
• it is necessary to enter into, or perform, a contract with you;
• we need to use it in order to comply with a legal obligation; or
• it is necessary in pursuit of a “legitimate interest”. A legitimate interest in this context means a valid interest we have or a third party has in using your personal data which is not overridden by your interests in data privacy and security.

We will only collect and use any special categories of personal information (information about your race, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation) if we have your explicit consent.

2. Information we collect and process

2.1 Donations
When you make a one-off donation to us (for example, via a form on our website), we will collect and record your name, address, email address, phone number and payment details in order to process the donation. We use a third party, Blackbaud, to process online donations. Blackbaud is a data processor for us and only processes personal information in line with our instructions.

If you donate or make a payment to us in person via card reader, our service provider is SumUp, who act as a data controller. We have no access to the card data provided for your transaction. SumUp may transfer data outside of the UK/EEA – you can see their privacy policy here.

If you donate to us via SMS text message we will collect and record your name and mobile phone number. We use a third party, RSM2000, to process SMS text donations. RSM2000 is a data processor for us and only processes personal information in line with our instructions.

If you make a one-off donation to us by post, we will record the personal information you provide to us in order to process your donation, to acknowledge receipt of the donation and to comply with our record keeping obligations.

If you set up a direct debit to donate to us regularly we will collect and record your name, address, email address, phone number and bank account details.

2.2 Friends of The Connection
Our sister charity, The Friends of The Connection (charity no. 1040560), exists to raise funds for us. The Friends is primarily a membership organisation and undertakes community fundraising. If you are a Friend, you should refer to The Friends Privacy Policy for details of how they use your personal information.

2.3 Legacies
If you indicate that you intend to leave a legacy to us, we will keep a record of your personal information (for example your name, address and contact details), as well as information about any other person or organisation that you provide to us (for example, a family member or a lawyer). This is so that we are able to communicate with you appropriately about your support.

2.4 Fundraising events
We run a number of fundraising events throughout the year, including challenge events like our Pilgrimage walk to Canterbury, art exhibitions, challenge events and musical concerts. If you sign up to take part in an event, we will ask you to provide us with personal information such as your name, address and contact details, to allow us to process your application. Depending on the event, we may also collect payment details from you and we may need to ask you to provide information about any health conditions or dietary requirements you have. Sometimes, we will ask you to give us your clothes size so that we can provide you with branded T-shirts and vests.

We sometimes partner with other organisations to run events, for example, our sister charities The Friends of The Connection and St Martin-in-the Fields Charity (charity no. 1156305) and we take part in events organised by other entities, such as the Radio 4 Christmas Appeal with St Martin-in-the-Fields. We may share your personal information with these other organisations, or with third parties who organise challenge events, where you have given us consent to do so or where we have a legitimate interest but we will always let you know in advance.

2.5 Fundraising with our sister charities

We work closely with other organisations located at St Martin-in-the-Fields to support our efforts. Because of this, we may share your information with:

The St Martin-in-the-Fields Trust
St Martin-in-the-Fields Limited
The St Martin-in-the-Fields Charity
The Friends of The Connection

We may share your information when we ask them to contact you about fundraising related activities and to process payments on our behalf, or when we join our forces to carry out market research and build fundraising strategies.

If you would like to opt out of such data sharing, please contact us at fundraising@cstm.org.uk or 020 7766 5555

2.6 Corporate support and corporate volunteers
We benefit from financial and in-kind support from companies and other commercial organisations. We keep a record of the names and contact details of key contacts at these organisations and we retain a record of relevant correspondence between us. If you work for one of our corporate supporters and you volunteer your time with us, we will collect some personal information from you (for example, your name, telephone number, email address and next of kind details) so that we can communicate with you about volunteering opportunities and make arrangements for you to volunteer with us.

2.7 Marketing
We would like to keep in touch with you about the work that we do, events that we organise, and ways in which you can support us (for example, by volunteering your time, by giving a financial donation, or by giving us donations-in-kind).
We will only send you marketing communications by email with your consent. You can opt out of email marketing by clicking the ‘unsubscribe’ link in any of our emails or you can contact us (see the ‘Contact Us’ section below) at any time to opt out, change your contact details or to update your communication preferences.

We may also send marketing information to you by post if we are satisfied that we have a legitimate interest to do so; for example, if you have donated to one of our appeals we may contact you to report on how we used the funds and to ask if you wish to support us again. You can contact us (see the ‘Contact Us’ section below) at any time to tell us that you no longer wish to receive marketing by post or to update your contact details and preferences.

From time to time, we may make marketing telephone calls to you. We do not regularly carry out telephone marketing and we never use automated calling systems. We will only contact you in this way if we are satisfied that we have a legitimate interest to do so and we will always check the telephone preference service and our own marketing preference records before we make any telephone marketing calls to you. You can contact us (see the ‘Contact Us’ section below) at any time to tell us that you no longer wish to be contacted by telephone for marketing purposes.

2.8 Case studies and photographs
We will always ask for your consent to use your personal information such as your name, your story and/or your photograph, to help us promote our organisation, our events and our activities for example by including a case study about you in our newsletters or on our website.

If you use social media to publicly share information about fundraising activities you have done for us, we may share this information on our own social media platforms (Facebook and Twitter).

2.9 Research
We use the personal information that you provide, sometimes together with data obtained elsewhere, to manage our fundraising efficiently and effectively so we can raise more to make a difference to the lives of homeless people in London. We use the information we collect about you to effectively target and tailor our communications, for example, so we can make appropriate requests to donors who may be able to support us at a higher level.

We also use publicly available information such as Companies House, Charity Commission and other charity registers, Who’s Who and Debrett’s guides, Electoral Roll, reputable newspaper articles, publications, company websites and biographies on professional networking sites, as well as geographic and demographic information based on your postcode, to find new potential supporters and invite them to be involved in supporting our cause through tailored communications which may be of interest to them or to gain a better understanding of our supporters.

If you would prefer us not to use your data in this way please contact the Fundraising Team on fundraising@cstm.org.uk or 020 7766 5555.

2.10 Queries and complaints
If you contact us by post, email or telephone using the contact details on our website, we will use the personal information you provide to us (for example, your name and the name(s) of any other individuals involved) in order to process your query or complaint, respond to you and take any follow up action.

3. Sharing personal information
We will never sell your personal data or share it with third parties who might use it for their own commercial purposes.

We routinely share your personal information with our sister charity The Friends of The Connection in order to avoid duplicating the contact our organisations have with you.

We will only disclose your personal information to other third parties:

• where you have given us consent to share the information with the specific third party;
• if we are under a legal duty to disclose or share your personal information, for example, if required to do so by a court order or for the purposes of prevention of fraud or other crime;
• in order to enforce any terms and conditions or agreements between us;
• where we have a legitimate interest to do so, such as
  • Conducting fundraising activities that benefit The Connection at St Martin’s together with our sister charities The St Martin-in-the-Fields Trust, St Martin-in-the-Fields Limited, The St Martin-in-the-Fields Charity and The Friends of The Connection, or where they act on our behalf
  • protecting our rights, property and safety, or the rights, property and safety of others (this includes exchanging information with other companies, organisations and regulators for the purposes of fraud protection and credit risk reduction)
  • Receiving IT support from external contractors
  • as part of a sale of some or all of our business and assets to any third party or as part of any business restructuring or reorganisation (we will always notify you in advance and we will ensure that your privacy rights will continue to be protected).

In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you. For example, we may share anonymised results of research that we carry out into the use of our services with third parties such as funders.

4. Data retention
We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements, and in accordance with our data retention policy.

Our default retention periods may be extended or reduced if we deem it necessary, for example, to defend legal proceedings or if there is an on-going investigation relating to the information.

We review the personal data (and the categories of personal data) we hold on a regular basis to ensure the data we are holding is still required and is accurate. If we discover that certain data we are holding is no longer necessary or accurate, we will take steps to correct or delete the data.

Please contact us if you would like more information on how long we keep your personal information.

5. Your rights
Under certain circumstances, by law you have the right to:

• Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Ask us to correct personal information that we hold about you which is incorrect, incomplete or inaccurate.
• Ask us to erase your personal information from our files and systems where there is no good reason for us continuing to hold it.
• Object to us using your personal information to further our legitimate interests (or those of a third party), e.g. for direct marketing purposes.
• Ask us to restrict or suspend the use of your personal information, for example, if you want us to establish its accuracy or our reasons for using it.
• Ask us to transfer your personal information to another person or organisation.

If you want to access, correct or request restriction or erasure of your personal information, or to object to us using your personal data, or request that we transfer a copy of your personal information to another party, please contact fundraising@cstm.org.uk in writing.

If you have given your consent to us processing your personal information, you have the right to withdraw your consent at any time. To withdraw your consent, please contact fundraising@cstm.org.uk. Once we have received notification that you have withdrawn your consent, we will no longer process your personal information and, subject to our retention policy, we will dispose of your data securely.

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.

6. Contact us
If you have any questions about this privacy notice or how we handle your personal information, please contact us by email at fundraising@cstm.org.uk or by telephoning 02077665555.

Last updated 04.01.2021

1. Why do we collect personal information about you?

The main reason why we collect personal information about you is so that we can work out what your situation is and provide the right advice and support.

We also use information about you for other reasons, which include:

To keep you, ourselves and others safe

To keep track of the work we do

To research homelessness in London so that we can provide better services

To manage the safety of our property (for example, through CCTV)

To keep important documents (e.g. your passport) safe on your behalf

To give you information about activities we are running (e.g. workshops)

To enter into contractual relationships with you (e.g. licence agreements)

To balance our finances (e.g. when handling grants on your behalf)

To publicise our work to the general public and our supporters (with your consent)

You do not have to tell us the information we need but this may mean that we give you the wrong advice or limit what we can do for you.

2. Where do we get the information from?

Generally, we get the information directly from you.

Sometimes it may also come from someone else. This could be because someone contacts us to share information about you, or it could be because we contact them, for example when you get referred to us or we ask another agency you have been in contact with about the support you have received.

We check the pan-London homelessness database (CHAIN) to see if you’ve had contact with Outreach services and what kind of support and advice you’ve received.

We sometimes get information from other homelessness, health, social care or enforcement agencies if they are worried about your safety or safety of others.

In very rare situations we may look at information that’s publicly available. We would only do this if we have a serious concern about your safety or safety of others.

3. What kind of information we may need

It depends on your situation and what we can offer you. At different times we may record and use any of the following:

• Contact details (your name, telephone number, email address, next of kin)
• Basic details (e.g. date of birth, gender, nationality, immigration status)
• Housing history
• Contact with other organisations
• Income
• Employment history
• Record of our meetings
• Participation in activities, volunteering or use of services
• Outcomes or achievements
• Information that relates to your safety or safety of others
• CCTV footage

It is also likely that we will need to collect and use the following special categories of your personal information:

• Data about your race or ethnicity, political opinions, religious or philosophical beliefs, sexuality or sex life
• Data about your health, including any medical condition
• Data about criminal convictions, offences and legal claims against you, or any related security measures

4. When do we share information with others?

Your information is confidential. This means we will only ever share information about you with others when it is necessary, on a need-to-know basis.

At The Connection, we work in teams so we share information about you with others in the teams you are in contact with.

We may also share information about you with external organisations to help you get linked with them or to advocate on your behalf. Normally, we will not share your information unless you give us permission (consent). We will be specific as to what information is being shared, with whom and for what purpose so you can make an informed decision. You can withdraw your consent at any time and we will no longer share it.

Where it’s necessary, we may share information about you without your consent. The most common situations where this happens are:

• Outreach teams (e.g. SOS), if you have been in touch with them. We will discuss your situation with them to ensure you are receiving the right support
• The Passage, West London Mission to check if they are working with you
• Organisations that share our building including Homeless Heath Service and Department of Work and Pensions.
• If we give you advice about your immigration situation, our notes may be accessed by our Immigration Advice regulator (OISC) when they check the quality of our advice, or our current legal partner who supervise the work of our immigration advisers. We will never share anything about you with the Home Office without your consent.
• Other quality auditors, such as Advice Quality Standard or Matrix,
• The provider of our database system (Homeless Link) and our third-party IT contractor, Silverbug, in order to receive technical support;
• External interpreting services, so that we can communicate with you in a language you understand

Other situations where we may share information without your consent are where:

• We have concerns about your safety and wellbeing, or the safety and wellbeing of others
• To protect our staff and property
• We are required to do so by law, e.g. a court orders us to do so
• It’s necessary in connection with a legal claim

In future, we may also need to share personal data with other legal entities, on a temporary or permanent basis, for the purposes of a collaboration, reorganisation, change of legal form, dissolution or similar event.

In some circumstances we may anonymise your personal data so that you can’t be identified, in which case we may use and share such data without further notice to you.

5. Our lawful basis for using your information

We will only use your personal information when we are satisfied that it is fair and we can do so lawfully. Our lawful bases for processing personal information may sometimes overlap and there may be several grounds which justify how we use it. The lawful basis are as follows:

We have a legitimate interest, for example:

• To assess your situation and to provide you with confidential advice
• To make applications, submit forms, obtain documents, buy tickets etc. on your behalf
• Keep copies of documents on your behalf (for example, correspondence, birth certificate, medical records)
• To coordinate our work with other organisations that support you (e.g. outreach teams)
• To alert others that we are seriously concerned about you or about other people in relation to you
• To monitor and evaluate our services so that we can constantly improve them
• To carry out any special research projects using data about clients or ex-clients
• To defend legal claims

It’s necessary for a contract, such as a licence agreement at St. Martin’s House.

It’s necessary in relation to work we do on behalf of public authorities (public task), for example providing accommodation or outreach services.

There is a substantial public interest (for example: when we provide confidential advice or support to you; to monitor equality of treatment; to safeguard adults and children at risk, or where we need to share data for the purposes of detecting and preventing unlawful acts)

We will typically ask for your consent to pass your information to other organisations, except for the circumstances described in the previous section. We will always ask for your consent if we would like to use information about you for publicity or fundraising purposes.

Less commonly, we may use your personal data where we need to protect your vital interests, where we have a legal obligation (for example when we are required to do so by a court) or in relation to legal claims.

6. How long do we hold your information?

Your personal details, as well as the record of your attendance and any support you have received from us will be held securely on our case management system (In-Form) for 7 years from the last time we had contact with you, in case you need our support again. We also need it to monitor our work, comply with audits, produce statistics about homelessness, as well as to defend any legal claims.

If you give us documents for safekeeping we will hold on to them for 1 year from last contact with you, unless you tell us to destroy them earlier.

If you use our address as your postal address, any letters you don’t pick up will be returned to sender after 1 month, unless you tell us to destroy them before then.

7. Your information rights

Under some circumstances, by law you have the right to:

• Request access to your personal data (also known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you
• Ask us to correct personal data that we hold about you which is incorrect, incomplete or inaccurate
• Ask us to erase your personal data from our files and systems but only where there is no good reason for us continuing to hold it. Please be mindful that we do need to hold on to the record of our work with you for a period of time so we won’t be able to delete everything on request
• Object to us using your personal data for a legitimate interests or for public task. When requesting this, please provide us with as much detail as you can about your reason for the request as we will need to balance your request against our organisational needs
• Ask us to restrict or suspend the use of your personal data, for example if you want to stop us from deleting it
• Ask us to transfer your personal data to another person or organisation

If you want to do any of the above, please speak to your key worker. If they are absent, you can speak to any member of staff or email data.protection@cstm.org.uk.

If you gave us consent to share your information and you are no longer happy with that, you can withdraw your consent at any time. To do it, please speak to a member of staff or e-mail data.protection@cstm.org.uk. and we will stop sharing it.

You can also make complaint at any time to the Data Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.

Effective from 01.08.2023

Recruitment of Employees Privacy Policy

This policy explains how and why The Connection at St Martin-in-the-Fields uses your personal information during the recruitment process.
This policy applies to all potential employees, who are going through the recruitment process. Please read it carefully to understand our practices regarding your personal information and how we will treat it.

This policy does not form part of any contract of employment or other contract to provide services. We may update this notice from time to time. When we refer to “we” or “us” in this policy we are referring to The Connection at St Martin-in-the-Fields. We are listed on the Information Commissioner’s register of data controllers under Registration Number Z7919091.

For the purposes of the Data Protection Act 1998, the General Data Protection Regulation (GDPR) and any applicable replacement legislation, we are the data controller.

Types of Information

When we use the term personal information we mean any personal data you give us from which you can be identified. This might include your name, your home address, your personal email contact details, or your telephone number. Personal information does not include information where your identity has been removed (i.e. anonymous data).

We use the term special categories of personal information to mean information about your race, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation.

We only ever use your personal data if we are satisfied that it is lawful and fair to do so. When we process your personal information, it will be because:

• You have consented to the processing for the specific purposes described in this notice;
• The processing is necessary to enter into, or perform, a contract with you;
• In order to comply with a legal obligation; or
• The processing is necessary in pursuit of a “legitimate interest”, a legitimate interest in this context means a valid interest we have or a third party has in using your personal data which is not overridden by your interests in data privacy and security.

We will only collect and use any special categories of personal information (information about your race, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation) where we have your explicit consent.

Information we collect about you

The organisation collects a range of information about you. This may include:

Data we collect and whether this is personal or sensitive data: Names, addresses, telephone numbers, email addresses (Personal Data)
What we use it for:
To contact you regarding a job application that you have made to us

Data we collect and whether this is personal or sensitive data: Application form (Personal Data)
What we use it for: To build a picture of your skills, experience and interests in order to assess your suitability for employment.

Data we collect and whether this is personal or sensitive data: References (Personal Data)
What we use it for:To assess your suitability for employment purposes

Data we collect and whether this is personal or sensitive data: Current salary details (Personal Data)
What we use it for: To help us assess your suitability for a paid employment role

Data we collect and whether this is personal or sensitive data: Your right to work in the UK (Personal Data)
What we use it for: To ensure that you are legally entitled to work in the United Kingdom

Data we collect and whether this is personal or sensitive data: Criminal Records Check (Personal Data)
What we use it for: For some roles, the organisation is obliged to seek information about criminal convictions and offences. Where the organisation seeks this information, it does so because it is necessary for it to carry out its obligations and exercise specific rights in relation to employment. This check will only be completed for the following reasons, and will not be completed without your explicit consent:
If the role is a regulated activity within the meaning of the Safeguarding Vulnerable Groups Act 2006. If we are legally required by the Charity Commission to carry out criminal records checks for those carrying out the role.
If the role requires a high degree of trust and integrity and we would like to ask you to seek an Enhanced disclosure of your criminal records history.

Data we collect and whether this is personal or sensitive data: Equal opportunities information (Sensitive Data)
What we use it for: This is for equal opportunities monitoring purposes to ensure meaningful equal opportunity monitoring and reporting where it may be needed in the public interest.

Data we collect and whether this is personal or sensitive data: Information on special requirements, health or medical conditions. (Sensitive Data)
What we use it for: To allow us to make any reasonable adjustments to allow you to effectively carry out the duties of your role, and to ensure we are meeting any health and safety obligations. This is not mandatory and will not affect any offer of employment.

Data we collect and whether this is personal or sensitive data: IP Addresses (Personal Data)
What we use it for: As an extra cyber security measure, we may log the IP address of the computer used to email us an application form as part of our registration process. This type of data does not normally identify an individual in the UK.

We collect the majority of this information directly from you during the application and recruitment process. We also sometimes collect additional information from third parties including former employers and other background check agencies including:
The Disclosure and Barring Service;
Publicly accessible data from the Insolvency Service, Companies House and/or the Charity Commission.

We only ever use your personal information if we are satisfied that it is lawful and fair to do so. We will never sell your personal information or share it with third parties who might use it for their own commercial purposes.

We will only disclose your personal information to third parties:

• Where you have given us consent to share the information with the specific third party;
• When we transfer personal information to Maitland Medical our occupational health provider;
• Or to ONE Westminster, our DBS provider

Data Storage

Data will be stored in a range of different places, including on your application record, manual files and on other IT systems (including email).
If your application is unsuccessful, the organisation will keep your personal data on file for a period of 6 months to 1 year, and then this will be securely destroyed. You are free to withdraw your consent to this data being held at any time.
We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal information without your knowledge or consent where this is required or permitted by law. We will not transfer your personal information outside the European Economic Area (EEA) and all of our third party suppliers store information on servers located within the EEA.
In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use and share such information without further notice to you.

We only keep your personal information in a secure environment. Personal Data will only be used as set out in this Privacy Policy.

• We hold data electronically in our secure document management system and on our on-site file servers, which are protected by both hardware and software firewalls.
• We have off-site back-up servers in secure locations.
• We encrypt all data stored on our servers with an industry standard encryption method that encrypts the data between your computer and our server so that in the event of your network being insecure no data is passed in a format that could easily be deciphered.
• We regularly back up and encrypt all of the data we hold.
• We store papers in lockable cabinets in our offices when not being actively used and we have a secure off-site document storage facility for archived papers.
• Our offices are secure and only personnel holding appropriate security passes can access areas where personal data are stored.
  When necessary, we dispose of or delete your data securely.
• We ensure that our employees, agents and contractors are aware of their privacy and data security obligations and we take reasonable steps to ensure that employees of third parties working on our behalf are aware of their privacy and data security obligations.
• We limit access to your personal information to those employees, agents, contractors and other third parties who have a need to know.

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Details of retention periods for different aspects of your personal information are contained in our retention policy which is available from Caroline Summerfield, Human Resources Manager.

These retention periods may be extended or reduced if required by applicable law or we deem it necessary, for example, to defend legal proceedings or if there is an on-going investigation relating to the information.
We review the personal data (and the categories of personal data) we hold on a regular basis to ensure the data we are holding is still required and is accurate. If we discover that certain data we are holding is no longer necessary or accurate, we will take steps to correct or delete the data.

Under certain circumstances, by law you have the right to:

• Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it;
• Ask us to correct personal information that we hold about you which is incorrect, incomplete or inaccurate;
• Ask us to erase your personal information from our files and systems where there is no good reason for us continuing to hold it;
• Object to us using your personal information to further our legitimate interests (or those of a third party) or where we are using your personal information for direct marketing purposes;
• Ask us to restrict or suspend the use of your personal information, for example, if you want us to establish its accuracy or our reasons for using it;
• Ask us to transfer your personal information to another person or organisation.

You also have rights in relation to automated decision making which has a legal effect or otherwise significantly affects you. You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces significant legal effects concerning you.

If you have any questions about this privacy policy or how we handle your personal information, please contact Caroline Summerfield, Human Resources Manager, 12 Adelaide Street, London, WC2N 4HW, or telephone 020 7925 7891.

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.

Privacy Notice for Volunteering Candidates

This document explains how and why The Connection at St Martin-in-the-Fields uses your personal information during and after you volunteer with us.

When we refer to “we” or “us” in this document we are referring to The Connection at St Martin-in-the-Fields. We are listed on the Information Commissioner’s register of data controllers under Registration Number Z7919091.

When we use the term personal information we mean any information that relates to you from which you can be identified. This might include your name, your home address, your personal email contact details, or your telephone number. Personal information does not include information where it is not possible to identify you (i.e. anonymous data).

We use the term special categories of personal information to mean information about your race, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health and sexual orientation.

This notice does not form part of any contract of employment or other contract to provide services. We may update this notice at any time but if we do so, we will provide you with an updated copy of this notice as soon as reasonably practical.

Why we collect and use information about you

The majority of information we collect comes directly from you. There are some situations, where we collect it from different sources. These include:

• The Disclosure and Barring Service;
• Persons providing you with a reference;
• Information collected in the course of your activities, depending on your role within CSTM.

Below is the list of the types of information we collect about you and the reasons why we do it:

Data we collect: Contact information, including your name, address, telephone number and email address.
What we use it for: To contact you about your volunteering and your involvement with the Connection at St Martin’s, including to circulate information via our volunteer newsletter.

Data we collect: Recruitment information (references and other information collected as part of the application process).
What we use it for: Making a decision about your recruitment as a volunteer.

Data we collect: The information you’ve given us about your interests and your reasons for applying, your start date, end date and record of attendance, as well as record of induction and training you have received and meetings with your supervisor.
What we use it for: To manage our relationship with you as a volunteer and to be able to provide references about you if you request us to do so.
To allow us to meet our legal obligations, for example in relation to health and safety.
To help us monitor the quality of our Volunteering programme.
To enable us to establish or defend legal claims.

Data we collect: DBS check (if appropriate for the role).
What we use it for: To make a decision about your recruitment as a volunteer.
Once the check has been completed we hold a record of the result but do not hold on to any details of your criminal history.

Data we collect: Information about your race or ethnicity, religious beliefs, and sexual orientation collected as an optional question only.
What we use it for: For equality and diversity monitoring.

Data we collect: Information about your health, including any medical condition.
What we use it for: To comply with our health & safety obligations and enable any reasonable adjustments to be made.

Data we collect: CCTV images.
What we use it for: To manage the security of our property and the safety of persons using our building. For prevention and detection of crime.

Data we collect: Photos and case studies.
What we use it for: Photos are used for creating and maintaining your ID card. With your explicit consent, we may use your photos and story for fundraising purposes.

Data we collect: Swipe card records, if you are issued with one.
What we use it for: To manage the security of our building.

The lawful grounds on which we use information about you

We will only use your personal information when the law allows us to. We process your personal information for the above purposes relying on one or more of the following lawful grounds:

• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. In broad terms our legitimate interest is fulfilling the charitable purpose of CSTM, which involves contacting our volunteers to plan and administrate activities, taking steps to ensure and monitor compliance with our legal obligations and internal standards and procedures, assessing suitability of volunteers for potential roles and keeping records of volunteer activities and performance.
• Where it is necessary for us to comply with a legal obligation, e.g. compliance with Health and Safety legislation
• Where you have consented; for example, to us using your image in our fundraising materials.
• Where it is necessary to protect your vital interests or those of others

When we process your special category and criminal offence data we do it:

• Where you have consented,
• It’s necessary to protect your vital interests (or those of someone else) in an emergency
• We have a need to use such information in connection with a legal claim
• It is necessary in public interest; for example safeguarding adults and children

Who has access to your information

Your information will be shared internally with people involved with managing our relationship with you. This includes members of the Recovery and Opportunities Team, volunteer supervisors in the service where the role is based, internal and external IT systems support staff, and business insight teams if access to the data is necessary for the performance of their roles.

Members of the team you are based in will be able to access basic information about you, including your name and date of birth and your contact details to enable them to record the hours you spent volunteering with them and to contact you in case of emergency.

Google may use your personal data if given consent by you on our website. Find more out here.

Less commonly, we may share your information where you have given us specific consent to do so, or where we have to comply with our legal obligations, where we have a legitimate interest to do so, such as administering our relationship with you, conducting quality audits or protecting our property.

How long do we hold on to your information?

If your application to volunteer is successful, personal data gathered during the recruitment process will be transferred to your volunteering file. All information in this file is retained during the time you are volunteering with us and for seven years after.

Your rights as a Data Subject

The Data Protection legislation specifies the rights you have in relation to the information we process about you. Below is the information what they are and how to exercise them.

• Right of Access – we have an obligation to provide you with a copy of your information if you request it.
• If the information we hold about you is incorrect, you have the right to have it corrected.
• In some circumstances you have the right to have your information deleted – this right applies only when we do not have a good reason for keeping information about you, for example where we rely on your consent to keep it and you have withdrawn the consent.
• You can object to us using your personal information to further our legitimate interests (or those of a third party) or where we are using your personal information for direct marketing purposes.
• You can ask us to restrict or suspend the use of your personal information, for example, if you want us to establish its accuracy or our reasons for using it.
• Ask us to transfer your personal information to another person or organisation.
• If you have given us consent for processing your information, you can withdraw this consent at any time.

Queries and Complaints

If you have any questions about this privacy policy or how we handle your personal information, please contact your supervisor, the Volunteer Coordinator, call us on 02077665544 or email data.protection@cstm.org.uk.

You also have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.

Last updated 02.06.2021

We use social media platforms, such as Facebook, Instagram and Twitter, to stay in touch with people interested in our work and give updates about our activities. We also use it as a cost effective way to raise funds and promote our events.
We use the available tools provided by these platforms, such as Custom Audiences and Lookalike Audiences, to better target our adverts. These are based on:

• the information you have provided directly to the social media site;
• your interactions with our content on these sites;
• your visits to our websites, via Facebook Pixel;
• purchases you have made from our shops Show Your Connection and Poster Bakes

This information is then used to identify others who may be interested in supporting the work we do, as well as to target or exclude you from seeing our ads. It also enables us to see how effective our adverts are and if they provide value for money.
You can find more information here:

Meta custom audiences

Meta lookalike audiences

Twitter

Our legal basis for us using your information in this way is our legitimate interest to raise funds for our work in the most cost effective way. Where we use information the social media provider already has about you, we are acting as joint controllers.
Please bear in mind that we do not have a direct access to the personal data used for the purposes outlined above and don’t hold any copies.

Your Data Rights

You can opt out of receiving adverts from us as well as from your information held by the social media platform being used by advertisers, by using the ads settings provided by the platform provider. You can also exercise your other data rights, such as access, deletion, correction and portability on those platforms, as explained in their respective privacy notices.
We set the Facebook Pixel only if you give us consent via the cookie banners on our websites. If you do not wish to be tracked in that way, please change your settings via the banner on the website you visited.

If you have any concerns about how we use your data, or have any questions, please contact us on data.protection@cstm.org.uk. If we don’t resolve the issue, contact the Information Commissioner. On contacting the ICO, please use the registration ID as listed above this notice. See how to contact them via their website: www.ico.org.uk

What we will do with your data if you bought items from The Connection

This notice relates to personal data we collect when you shop with us. If you purchased any goods from us before 06/02/2024, your data has been transferred to The Connection at St Martin’s (CSTM) due to the dissolution of our trading subsidiary Show Your Connection. CSTM is now the Controller for this data and is responsible for its lawful use and security.

How and why do we use your personal data?

To process orders made via our websites, by phone or in person.

The information you give us when ordering goods online is shared with the website platform providers Shopify, so that they can provide website services to us.

As you go through checkout, the site may auto-complete your shipping and billing address by sharing what you type with the Google Places API and returning suggestions to you to improve your checkout experience.

When you make a payment, you give your information directly to the payment processor, e.g. ShopPay, Stripe or PayPal for online purchases and SumUp for in-person purchases. Note that these providers may send information to countries outside of the UK/EEA.

We may pass your details to Evri, who delivers the products on our behalf.

We will keep all the details of your purchase afterwards for as long as it takes us to fulfil any contractual obligations, such as refunds, etc.

Lawful basis: Contract, Legitimate interest (when fulfilling orders made by someone else but sent to your address)

To send you information about your order

We may email you with messages about your order or account activity. For example, we may email you to tell you that:

You’ve created a customer account

Your customer account password has been reset or updated

You’ve made a purchase (order confirmation)

Your order has shipped

It’s not possible to unsubscribe from these messages.

We share your contact information with Shopify, our website hosting providers, as well as the shipping provider (Evri), so they can send these emails to you on our behalf.

Lawful basis: Contract

To respond to your queries, refund requests and complaints.

We will use the information you send us, as well as your contact details and purchase history to enable us to deal with your query or complaint. We will keep a record of it to keep track of our communication with you and to help make our services better.

Lawful basis: Contract, Legitimate interest (service improvement)

Direct marketing

We will send you emails about new products based on your marketing preferences, along with news and updates about The Connection. You can unsubscribe from those emails at any time by clicking the link within the email.

We use Mailchimp to send these emails, which is a service based in USA. As this is a country with less strict data protection laws than the UK, we have in place additional contractual measures to ensure your data remains protected.

If you have previously bought goods from us through Poster Bakes or Show Your Connection, but have not subscribed to The Connection’s Newsletter, we will not send you any updates unless you ask us to by subscribing here: Subscribe to The Connection Newsletter

Lawful basis: Consent

Marketing research

We use the personal information that you provide, sometimes together with data obtained elsewhere, to manage our fundraising efficiently and effectively so we can raise more to make a difference to the lives of homeless people in London. We use the information we collect about you to effectively target and tailor our communications, for example, so we can make appropriate requests to donors who may be able to support us at a higher level.

We also use publicly available information such as Companies House, Charity Commission and other charity registers, Who’s Who and Debrett’s guides, Electoral Roll, reputable newspaper articles, publications, company websites and biographies on professional networking sites, as well as geographic and demographic information based on your postcode, to find new potential supporters and invite them to be involved in supporting our cause through tailored communications which may be of interest to them or to gain a better understanding of our supporters.

We may share your information with our sister charities: St Martin-in-the-Fields Trust, St Martin-in-the-Fields Limited, The St Martin-in-the-Fields Charity and The Friends of The Connection when we ask them to contact you about fundraising related activities and to process payments on our behalf, or when we join our forces to build fundraising strategies.

If you would prefer us not to use your data in this way please contact the Fundraising Team on fundraising@cstm.org.uk or 020 7766 5555.

Lawful basis: Legitimate interest – Marketing research

Fraud prevention

We will use the information provided in the course of your purchase to investigate orders we think may be fraudulent.

Lawful basis: Legitimate interest – fraud prevention

To fulfil our legal obligations

We will also use your personal data to fulfil legal obligations, such as those around accounting and data protection.

Lawful basis: Legal obligation

Transferring your data overseas

UK data protection law requires organisations transferring personal data to a country that does not offer a similar level of protection to put measures in place ensuring your rights are respected. When we do so, for example to make use of IT services based abroad, we put contractual measures in place such as the International Data Transfer Addendum.

How long we will keep your information

We regularly delete the information we no longer need, or make it anonymous. The time we keep it depends on legal obligations and business needs.

Your data protection rights

Under data protection law, you can:

Request access to your personal data (also known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you

Ask us to correct personal data that we hold about you which is incorrect, incomplete or inaccurate

Ask us to erase your personal data from our files and systems but if there is no good reason for us continuing to hold it.

Object to us using your personal data for a legitimate interest (e.g. if you don’t want us to use your data for marketing research or for service improvement).

Ask us to restrict or suspend the use of your personal data, for example if you want to stop us from deleting it

Ask us to transfer your personal data to another person or organisation

Withdraw consent to any processing based on consent. We will always honour your request. This does not affect the lawfulness of processing before your consent was withdrawn.

If you want to do any of the above, please email our Data Protection Officer at data.protection@cstm.org.uk.

If you have any concerns about our use of your personal information, you can make a complaint to us at data.protection@cstm.org.uk.

You can also complain to the ICO if you are unhappy with how we have used your data.

The ICO’s address:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk

Last updated 19.02.2022