Privacy notice for Peer Support Volunteers

Who we are

NCT is a registered charity (in England and Wales, no. 801395 and in Scotland, no. SC041592), and a company (in England and Wales, no.2370573). Our registered address is 27 Old Gloucester Street, London, WC1N 3AX. 

We are registered with the Information Commissioner’s Office (ICO) as an organisation that collects and uses personal data (a “Data Controller”).

Personal data we collect about you and how we obtain it

Personal data is any identifiable information about you. NCT will obtain your personal data when you have given it to us (directly) or when someone else has given it to us (indirectly).

In your role as a Peer Support Volunteer, we will need to collect and use some or all the personal data listed below:

• Name
• Postal address
• Email address
• Phone number
• Date of birth
• Gender
• Ethnicity
• Languages spoken (including if English is your first language)
• Country of origin
• Employment status
• Education history
• Mental health information
• Learning needs
• References
• Bank details
• Emergency contact information
• Photographs for ID verification
• Images (e.g. photographs and videos) for social media, training use, etc.
• Criminal conviction information
• DBS checks information
• Right to work checks information
• Safeguarding information
• Any other personal information you wish to disclose to us during your time with NCT as a Peer Support Volunteer

Why we need your personal data and the lawful basis for collection

Special Category Personal Data

We will only collect and use “special category personal data”, which includes your health data, your racial and ethnic origin, your religious or philosophical beliefs, and your sexual orientation when:

• you have given your explicit consent for us to use it; or
• we have legal obligations to comply with in relation to your contract;
• there is an emergency, and we need to share it with emergency services

If our purposes of processing change

We will only use your personal data for the purposes set out above, unless we reasonably consider that we need to use it for another purpose that is compatible with any of the above. If we need to use your personal data for an unrelated purpose, we will always inform you about this and explain the GDPR lawful ground which allows us to do so.

Am I under a Contractual or Legal obligation to provide you with my personal data?

Where we rely on contractual or legal obligation to process your personal data, you must provide the specific information we require for those purposes. If you cannot provide the necessary information we may have to terminate our relationship with you.

Data Sharing

NCT will share your personal data with other organisations when we are required to by law or when GDPR allows us to do so. 

As a Peer Support Volunteer, we will need to share some of your personal data with:

• DBS & ID check companies – during your recruitment process we will need to carry out DBS and ID checks. We use specialist companies to undertake these checks.
• London OCN – because they provide the training and accreditation for you to be a Peer Support Volunteer.
• NHS Trusts – only when duties are undertaken in hospitals. Each hospital has different reasons for needing some of your data, but generally they require this for security, access and health and safety reasons. They will store your data on their systems. You will have access to some of the systems a Trust uses to carry out your duties, e.g. Badgernet, CarePartner. 

Data Processors

There may be times when we need to work with other trusted businesses to help us process your personal data. These other businesses are known as “data processors” as they are acting on our behalf and under strict instruction from us on what they can and cannot do with the personal data.

When we do use other businesses to process personal data on our behalf, we always ensure we have appropriate UK GDPR compliant contracts in place with each one. We also undertake due diligence checks of these businesses before entering into a contract and throughout the contract lifecycle.

Some of your personal data will be processed and stored on systems by the following data processors:

• Microsoft 365Upshot
• Talent LMS
• Babble
• Dot Digital
• WhatsApp
• OCN London
• Google Documents
• 3CX (telephone system)
• Purchase Management (travel costs)

Transferring personal data outside of the UK

Sometimes it is not possible for us to process and store your personal data solely in the UK. When your personal data does need to be transferred or stored outside of the UK, we make sure we comply with the specific requirements set out in UK GDPR for us to undertake this. We will only transfer personal data outside of the UK when one of the following provisions are in place to safeguard your personal data:

• An “adequacy decision” is in place with the country where the personal data is being transferred to.
• An “appropriate safeguard” as set out in UK GDPR is in place. These include using Standard Contractual Clauses and the UK’s International Data Transfer Agreements.
• An “exception” as set out in UK GDPR can be relied on if there is no adequacy decision or appropriate safeguard in place. For example, we could rely on your explicit consent to make the transfer of personal data.

How long we will keep your personal data

We will only keep your personal data for as long as we need it to fulfil the reasons we originally collected it for. The length of time will vary depending on the reason we are using your personal data, for example the following retention periods apply:

• Recruitment and volunteer records – 6 years from the end of the volunteering period
• Expense claims – 6 years from the end of the financial year the claim was made
• Safeguarding records – 21 years from the date of the safeguarding incident We may also need to retain some of your personal data to comply with the contractual obligations NCT has with commissioning Local Authorities.

We retain anonymised personal data for longer so that we can use it for long term trend analysis and statistical reporting. Anonymised personal data means you can no longer be identified.

Your rights

Depending on the reasons and GDPR lawful grounds we rely on for processing your personal data, there are various rights available to you. You can:

• request access to the personal data we keep about you and be given specific information about the processing. This right always applies regardless of the processing activity we undertake.
• request we rectify personal data we hold about you if you believe it to be inaccurate. This right always applies regardless of the processing activity we undertake.
• request us to delete your personal data. This right only applies in specific circumstances, this means we don’t always need to comply with this type of request.
• request a restriction of the processing of your personal data. This right only applies in specific circumstances, this means we don’t always need to comply with this type of request.
• object to the processing when we have relied on the “legitimate interest” lawful ground to undertake the processing activity and you believe we have infringed your rights. We don’t always have to comply with such objections if we can demonstrate compelling grounds to continue with the processing.
• transfer your personal data from us to another service provider or give it to you. This right only applies to personal data you have given to us, the processing is based on your consent or contractual obligation, and the processing is automated.

We do not undertake any solely automated decision making, including profiling, about you.

To find out more about the rights that apply to individuals under GDPR please refer to the guidance on the Information Commissioner’s Office website - https://ico.org.uk/for-the-public/.

If you want to exercise one of your rights, please contact our Data Protection Officer by emailing dataprotection@nct.org.uk. We shall respond to a valid request within one month of receiving it.

How to make a complaint about us to the Information Commissioner’s Office

If you are not happy with how we are processing your personal data, or you believe we have not dealt with one of your rights correctly you are entitled to make a complaint to the Information Commissioners Office (ICO). The ICO has several ways in which you can get in touch with them, including post, email, and online forms. For full details how to make a complaint please refer to their website - https://ico.org.uk/make-a-complaint/.

Changes to our Privacy Notice

We keep this Privacy Notice under review to ensure it remains accurate and up to date and we reserve the right to modify it at any time.