Surrey Federation of Womens Institutes, a company limited by guarantee registered in England and Wales under number 02836301 which is also a charity registered with the Charity Commission for England and Wales under number 1026988, whose registered address is at 6 Paris Parklands, Railton Road, Guildford, Surrey, GU2 9JX (the Charity) processes your Personal Data in accordance with the General Data Protection Regulation (the GDPR) and the information set out in this Subject Information Statement.
1. Background
1.1. You are employed by the Charity.
1.2. The Charity has responsibility for the individual WIs operations in Surrey and in South-West London.
1.3. The Charity provides services to the WIs within its areas of operations which may include you providing services to other WIs.
1.4. The Charity is Processing your Personal Data in relation to your employment and the services provided to WIs. For the purposes of this Statement a reference to the Charity shall include the WIS which are members of the Charity.
2. Purposes and Legal Basis
2.1. The Charity Processes your Personal Data and, where you have provided it, your Personal Data which falls within Special Categories of Personal Data (formerly Sensitive Personal Data), for the following purposes:
2.1.1. the administration of your employment with the Charity;
2.1.2. where we are required to do so, confirming your suitability and your continued suitability for the work that you carry out, including any checks and updates that are required by the Charity or any other body to be made:
2.1.2.1. with the Disclosure and Barring Service which may result in the Charity retaining information about criminal convictions;
2.1.2.2. in connection with your health including screening and making decisions based on any health records which may be collected by, or transferred to, the Charity;
2.1.3. any statutory requirements relating to you, or any application or submission made by you in relation to your employment;
2.1.4. managing and administering any employment processes relating to you;
2.1.5. making the necessary disclosures to third parties with which you have a connection; and
2.1.6. retention of your Personal Data following the end of your employment to ensure that sufficient information is maintained for the purposes of confirming your employment, maintaining our records and areas of responsibility and the provision of references.
2.2. The legal basis on which the above Processing takes place is:
2.2.1. the contract between us;
2.2.2. the employment condition set out in Article 9(2)(b) of the GDPR which permits the Processing of Special Categories of Personal Data for the purpose of employment to comply with our employment law and associated obligations;
2.2.3. the protection of your vital interests, specifically in relation to health and safety and the protection of your health in accordance with Articles 6(1)(d) and 9(2)(c).
2.3. As we process your personal data for the purposes of the contract between us and for under the specific employment condition, we do not need to obtain your consent for the Processing we undertake of your Personal Data.
3. Source
3.1. Whilst you have provided some of the Personal Data which is Processed by the Charity, we have also obtained Personal Data, from your referees, former employers, employment agencies and HM Revenue and Customs (HMRC).
4. Recipients
4.1. The Charity may transfer your Personal Data to the following organisations or category of organisations:
4.1.1. HMRC;
4.1.2. National Federation of Womens Institutes (NFWI), other WI Federations and other related companies;
4.1.3. our sub-contractors providing services to us, for example payroll, pension providers, providers of employee benefits;
4.1.4. banks and other institutions requiring references;
4.1.5. central and local government and their agencies;
4.1.6. the Disclosure and Barring Service if we are required to undertake checks in relation to your suitability to undertake a designated role.
4.2. Please be aware that certain information about your role will be publicly available and will also be made available to third parties with which the Charity works, for example, donors, beneficiaries and third parties supporting the work of the Charity. Please note that this will not include confidential information relating to your employment, but will include contact information and information about your role.
5. International Transfers
5.1. It is the intention of the Charity that your Personal Data will remain within the UK, the countries forming the European Economic Area (the EEA) and countries where the UK and/or the European Union has decided that the country has adequate data protection laws in line with those in the European Union.
5.2. Your Personal Data will only be transferred outside of the EEA or a country which has been declared as having adequate data protection laws where:
5.2.1. the transfer is necessary for the performance of any contract with you;
5.2.2. you have entered the information into our Website and the information has been transmitted from your server to our server using systems based outside of the EEA;
5.2.3. we have entered into an appropriate contract protecting your rights and freedoms, which is enforceable by you or the data protection authorities; or
5.2.4. we have obtained your explicit consent.
6. Storage
6.1. We will generally store the Personal Data that we hold in relation to you for the duration of our relationship with you and for seven years after that relationship ends. However, we generally keep the following information indefinitely:
6.1.1. name of former employers;
6.1.2. the dates between which they worked for the Charity;
6.1.3. the role which was undertaken and the reason for leaving.
7. Your Rights
7.1. You have a right to obtain from the Charity conformation as to whether or not your Personal Data are being Processed and, if your Personal Data are being Processed by the Charity, to access the Personal Data and the specific information set out in Article 15 of the GDPR. To access your Personal Data please contact info@surreyfedwi.org.uk. Please note that we will not provide any Personal Data to you until you have provided evidence to us to establish your identity. This may include a copy of your passport or other identification document. We will only provide information to you at an address which we have verified as belonging to you.
7.2. You have a right to rectification of any inaccurate Personal Data which we Process about you, or where Personal Data is incomplete to have the information completed. To obtain rectification or completion, you will need to provide the correct information to the Charity. An explanation of why you believe the information is inaccurate or incomplete would also be of assistance.
7.3. Where certain grounds, as set out in Article 17(1) of the GDPR, apply, you will be entitled to have the Charity erase certain Personal Data relating to you. Where you wish to exercise your right of erasure, please contact info@surreyfedwi.org.uk setting out the grounds under which you would like the Personal Data the Charity holds about you erased.
7.4. Where certain grounds, as set out in Article 12(1) of the GDPR, apply, you will be entitled to have the Charity restrict the Processing of certain Personal Data relating to you. Where you wish to exercise your right to restrict Processing, please contact info@surreyfedwi.org.uk setting out the grounds under which you would like the Personal Data the Charity holds about you restricted.
7.5. In certain circumstances, where the legal basis of the Processing undertaken by the Charity is “consent”, you have a right to request the Charity transfers your Personal Data to a third party. If you wish to exercise your right to data portability, please contact info@surreyfedwi.org.uk.
8. Complaints
8.1. If you have any complaint about the Processing of your Personal Data undertaken by the Charity, please contact info@surreyfedwi.org.uk.
8.2. Please note that you have a right to lodge any complaint about the Processing of your Personal Data by the Charity by contacting the Information Commissioner’s Office.
8.3. The Charity is not required to have a data protection officer under the GDPR and one has not been appointed, therefore please address all communications in relation to Personal Data to info@surreyfedwi.org.uk.
9. Definitions
9.1. The following terms have the following meaning in this Statement:
9.1.1. Personal Data means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
9.1.2. Processing means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
9.1.3. Special Categories of Personal Data means Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.
10. Contact
10.1. The Charity can be contacted:
10.1.1. in writing at SWFI, 6 Paris Parklands, Railton Road, Guildford, Surrey, GU2 9JX;
10.1.2. by email at info@surreyfedwi.org.uk; or
10.1.3. by telephone by calling 01483 233230.
11. Further Information
11.1. It is not intended that the Charity will undertaking any further Processing of your Personal Data other than that which is set out in this Statement. However, if this position does change, the Charity will provide you with further information.
11.2. This Statement was last updated on 21 June 2020.
