We want to make sure that you feel confident about how your data will be collected and reasonably used as part of the Trustee recruitment, selection and appointment process. If you have any questions about how we use your personal data or believe any of your rights have been infringed, please contact our Data Protection Officer by emailing dataprotection@nct.org.uk.

This privacy notice (v2.0) was updated July 2026.

Who we are

NCT is a registered charity (in England and Wales, no. 801395 and in Scotland, no. SC041592), and a company (in England and Wales, no.2370573). Our registered address is 27 Old Gloucester Street, London, WC1N 3AX.

We are registered with the Information Commissioner’s Office (ICO) as an organisation that collects and uses personal data (a “Data Controller”).

Personal data we collect about you and how we obtain it

Personal data is any identifiable information about you. NCT will obtain your personal data when you have given it to us (directly) or when someone else has given it to us (indirectly).

When applying to become an NCT Trustee, we will need to collect and use some or all the personal data listed below:

  • Name
  • Contact details (which may include all or a combination of postal address, telephone numbers (landline and mobile) and email address)
  • Date of birth
  • Place of birth
  • Nationality
  • National Insurance number
  • National Identity Card number
  • NCT membership number
  • Occupation, including your qualifications
  • Candidate statement (which includes your skills and experience)
  • Details of any conflicts of interest
  • Photograph of yourself

We will carry out background checks of all applicants as part of our statutory due diligence measures to only appoint “fit and proper persons”. This will include obtaining information about you from official registers, including:

  • the Register for Disqualified Directors;
  • the Register of Removed Trustees;
  • the Insolvency Register;
  • any other official register as is necessary.

Why we need your personal data and the legal basis we rely on

We need your personal data to allow us to:

  • Send candidates the Trustee Nomination Pack;
  • Validate the membership status of candidates and nominees;
  • Undertake formal vetting, e.g. disqualification from acting as a trustee; 
  • Determine the eligibility of candidates and advise candidates of the outcome;
  • Include relevant candidate details in the Candidate Information Pack which will be made available to the voting membership;
  • Facilitate voting by the membership via the Simply Voting platform; 
  • Place candidate information on NCT’s website;
  • Verify the outcome of the voting results on the Simply Voting platform; 
  • Confidentially share the election outcome with candidates;
  • Announce the election results at the AGM;
  • Formalise the appointment of new Trustees;
  • Induct Trustees into their role.

Our legal basis to process your personal data is:

Personal Data

  • Contractual Obligation - so we can carry out our duties in relation to our appointment of Trustees, including pre-appointment, such as recruitment and selection.
  • Legal Obligation - so we can comply with our legal obligations in relation to the appointment of Trustees, such as official background checks.

Special Category Personal Data

  • Explicit consent – if no other legal basis applies, we will obtain your explicit consent to process your personal data. 
  • Substantial public interest – when the processing is necessary for reasons of substantial public interest and meets one of the conditions set out in the Data Protection Act 2018 (see below):

Data Protection Act 2018 Condition

  • Schedule 1 Part 2 Sections 8, 9 and 11 – processing of data is necessary in relation to substantial public interest to: 
    • ensure equality of opportunity or treatment for Trustees, 
    • monitor racial and ethnic diversity at senior levels, protect the public against dishonesty.

Am I under a Contractual or Legal obligation to provide my personal data?

Where we need your personal data to fulfil a contractual or legal obligation, if you fail to provide that data when requested, we may not be able to process your application to become a Trustee, or we may be prevented from undertaking official background checks on public registers.

If our purposes of processing change

We will only use your personal data for the purposes set out above, unless we reasonably consider that we need to use it for another purpose that is compatible with any of the above. If we need to use your personal data for unrelated purposes, we will always inform you about this and explain the GDPR legal basis which allows us to do so.

How long we will keep your personal data 

We only keep your personal data for as long as is necessary for us to fulfil the purposes we originally collected it for.  Our retention of personal data for the appointment of Trustees is:

  • Unsuccessful applicant – filing of vacancy and notifying applicants plus 12 months.
  • Successful applicant – time in post as Trustee plus 6 years.

There may be times when we anonymise personal data, this means you can no longer be identified.  We retain anonymised personal data for longer so that we can use it for long term trend analysis and reporting.

Data Sharing

We will share your personal data with other organisations where we are required to do so by law.  For example, HMRC and the Charity Commission, who undertake checks of Trustees.

Data Processors

There may be times when we need to use other businesses to help us undertake the recruitment and appointment of Trustees. These other businesses are known as “data processors” as they are acting on our behalf and under strict instruction from us on what they can and cannot do with the personal data.

When we do use other businesses to process personal data on our behalf we always ensure we have appropriate UK GDPR compliant contracts in place with each one. We also undertake due diligence checks of these businesses before entering into a contract and throughout the contract lifecycle.

Some of your personal data will be processed and stored on systems by the following data processors:

  • Simply Voting - to facilitate the voting by members.  
  • Microsoft 365

Transferring personal data outside of the UK 

Sometimes it is not possible for us to process and store your personal data solely in the UK. When your personal data does need to be transferred or stored outside of the UK we make sure we comply with the specific requirements set out in UK GDPR for us to undertake this. We will only transfer personal data outside of the UK when one of the following provisions are in place to safeguard your personal data:

  • An “adequacy decision” is in place with the country where the personal data is being transferred to. 
  • An “appropriate safeguard” as set out in UK GDPR is in place. These include using Standard Contractual Clauses and the UK’s International Data Transfer Agreements.
  • An “exception” as set out in UK GDPR can be relied on if there is no adequacy decision or appropriate safeguard in place. For example, we could rely on your explicit consent to make the transfer of personal data.

Your rights

Depending on the purpose and legal bases we rely on for processing your personal data, there are various rights available to you. You can:

  • request access to the personal data we keep about you and be given specific information about the processing. This right always applies regardless of the processing activity we undertake.
  • request we rectify personal data we hold about you if you believe it to be inaccurate. This right always applies regardless of the processing activity we undertake.
  • request us to delete your personal data. This right only applies in specific circumstances, this means we don’t always need to comply with this type of request.
  • request a restriction of the processing of your personal data. This right only applies in specific circumstances, this means we don’t always need to comply with this type of request.
  • object to the processing when we have relied on the “legitimate interest” lawful ground to undertake the processing activity and you believe we have infringed your rights. We don’t always have to comply with such objections if we can demonstrate compelling grounds to continue with the processing.
  • transfer your personal data from us to another service provider or give it to you. This right only applies to personal data you have given to us, the processing is based on your consent or contractual obligation, and the processing is automated.

We do not undertake any solely automated decision making, including profiling, about you.

To find out more about the rights that apply to individuals under GDPR please refer to the guidance on the Information Commissioner’s Office website - https://ico.org.uk/for-the-public/.

If you want to exercise one of your rights, please contact our Data Protection Officer by emailing dataprotection@nct.org.uk. We shall respond to a valid request within one month of receiving it.

How to make a data protection complaint

If you are not happy with how we are processing your personal data, or you believe we have not dealt with one of your rights correctly you are entitled to make a data protection complaint.

You must first make your complaint to NCT and allow us the opportunity to deal with your complaint. Our Complaints Policy which includes how to lodge a complaint is on our website here - Complaints Policy

If we have not been able to deal with your complaint to your satisfaction you can then raise this with the UK Regulator for data protection, the Information Commissioners Office (ICO). Full details on how to make a complaint to the ICO is on their website.

Changes to our Privacy Notice

We keep our Trustees (Appointment of) Privacy Notice under review to ensure it remains accurate and up to date and we reserve the right to modify it at any time.