Introduction

Wamumbi Orphan Care Foundation (WOCF) as Data Controllers recognise our duties and obligations under the Data Protection Act 2018 (‘The Act’) and the General Data Protection Regulation (‘GDPR’) effective 25 May 2018.  The Act establishes a framework of rights and duties designed to safeguard personal data, balancing the legitimate needs of organisations to collect and use personal data for business and other purposes against the rights of individuals to privacy and protection of their personal data. 

- collected fairly and processed lawfully; 

- obtained for specific and lawful purpose; 

- adequate, relevant, and not excessive; 

- accurate and kept up to date; 

- held for no longer than is necessary; 

- processed in accordance with the rights of the data subjects; 

- stored, handled, and disposed of securely; 

- kept within the European Economic Area (EEA). 

Responsibilities 

Overall responsibility for personal data within WOCF rests with the WOCF Board of Trustees.  WOCF trustees are responsible for ensuring that personal data is handled and processed in line with this policy.  Data protection training will be provided to WOCF trustees to help them understand their responsibilities under The Act. 

Types of Data Processed 

WOCF processes the following personal data.  We do not collect any Special Categories of personal data, nor do we collect any information about criminal convictions and offences. 

Storage & Retention 

WOCF will ensure that personal data is kept secure at all times against unauthorised access, loss, or disclosure.  We will achieve this by: 

- storing paper and other hard copy records containing personal data in locked cabinets; 

- using encrypted portable storage devices (e.g. Laptop, USB) to store and access personal data; 

- using strong passwords for email accounts and other shared systems where personal data may be stored; 

- refreshing passwords on a regular basis; 

- storing personal data for no longer than is necessary; 

- disposing of personal data appropriately and securely e.g. by secure shredding or data wiping services; 

- reviewing information security measures on a regular basis. 

- WOCF Trustee documents: for duration of trusteeship +6 years 

- Gift Aid Declaration forms: 6 years 

- Enquiry data: once enquiry has been serviced 

Subject Access Requests 

All data subjects have the right to obtain a copy of the information that is held about them by data controllers.  This is known as a Subject Access Request (SAR).  Any person wishing to make a request of WOCF should apply in writing to info@wamumbiorphancare.org.uk  

The following information should be included with your request: 

- your full name, address, and contact telephone number; 

- any other information that would help us to identify you; and 

- details of the specific information you require and the relevant dates. 

Definitions 

Data Controller: The person who (either alone or with others) decides the purposes for and the manner in which personal data is to be processed. 

Processing: The collecting, amending, handling, storing, or disclosing of personal information. 

Personal Data: Information relating to a living individual who can be identified – e.g. name and postal address.  Special Category personal data includes race, ethnicity, sexual orientation, religious beliefs, political opinions, trade union membership, health and genetic and biometric data. 

Data Subject: Individual who is the subject of personal data. 

Further Information 

Please contact info@wamumbiorphancare.org.uk with any queries about this policy. 

For general information and guidance on data protection please visit the Information Commissioner’s Office website www.ico.org.uk