Date: 07/11/2023
Baby Bank Alliance Privacy Policy
Who Processes your Information?
The founding Baby Bank Alliance (BBA) board members are Baby Bank Network Bristol, Little Village, Save the Children and Purposeful Ventures; we will soon be expanding our board and Advisory Group to include additional baby bank leaders, ensuring that the Alliance is always run by and for the baby bank community. The Baby Bank Alliance is jointly incubated by Purposeful Ventures and Save the Children UK; Purposeful Ventures is the legal entity in which the Baby Bank Alliance operates.
The aim of the BBA is to share best practice, raise the profile of baby banks in the UK and attract funding, in kind donations and corporate partners that can’t be secured alone. This should help baby banks support more families on low incomes with material and practical support, draw attention to the issue of child poverty nationally and promote reuse of baby kit and clothing as a positive choice for all families.
Whilst working on setting up the BBA, Purposeful Ventures will be acting as the Data Controller of the personal and organisational data which is collected and used by those working for the BBA for the purposes described in this notice. We will only collect and process your data when necessary to provide our services and support, as part of our legitimate interests as an organisation. The personal data we process may be shared with third parties, where it is necessary for us to do so and we have a lawful basis to do so. We will never sell, rent or distribute your personal information. All personal data is held in compliance with UK Data Protection Act 2018, the UK General Data Protection Regulation and with all other laws concerning the protection of personal information, including the Privacy & Electronic Communications Regulations 2003. Our compliance with the above legislation means that it is likely that we are compliant with the data protection and user privacy legislation set out by many other countries and territories as well.
If you have any questions about this notice or the processing of your personal data, please contact Liora Wulf using [email protected].
We may change this policy from time to time, so do check our website for the most up-to-date version.
- How we get Personal Data
- The personal information we process is provided to us directly by you via our form and is necessary for us to operate our service. In these situations, we will provide you with information about why we need this data and how we will use this data to provide you with the requested service. The organisational information we process is provided to us directly by you via a form, email, conversation, or indirectly from:
- Your website or social media channels
- The charity commission website
- Information gathered indirectly is publicly available information that we can use to complete or check our records. For example, adding your Facebook page to the information available on the map or finding your public email address if you have signed up or emailed us from a personal email account.
- The personal information we process is provided to us directly by you via our form and is necessary for us to operate our service. In these situations, we will provide you with information about why we need this data and how we will use this data to provide you with the requested service. The organisational information we process is provided to us directly by you via a form, email, conversation, or indirectly from:
- The Type of Information We Collect
- Personal information:
- Contact information from key people at the organisation (trustees, staff or volunteers) such as:
- name, role, email address, and phone number. The BBA do not collect or use sensitive personal data about individuals as part of our processing.
- Contact information from key people at the organisation (trustees, staff or volunteers) such as:
- Organisational information:
- Information about your baby bank or similar service such as:
- name, location, website address, contact details such as email addresses, social media handles, your registered charity or company number (if appropriate).
- Data on your organisation such as:
- the number of staff and volunteers, your costs, the number of families you help, the number of items you have given to families.
- We may also collect appropriate records of communications with individuals relevant to either the individual or the baby bank they represent:
- Notes of conversations you have had (in person, over the phone/online) which are relevant to the running of your organisation, such as who you help or processes you have in place. This is to help us to tailor what we offer to both individual baby banks and the network as a whole, and so that we can build a picture of how different baby banks operate.
- Your responses to surveys we have shared or data collection that we have carried out
- Your responses to any anonymous surveys that we have shared
- This information is used internally by our team.
- Information about your baby bank or similar service such as:
- Personal information:
- How We Use Your Information
- The personal information collected is used for the following reasons:
- To provide you with a service
- To receive information on the national baby bank network
- To tell us how we can improve our offering and best help baby banks across the UK
- The organisational information collected is used for the following reasons:
- To add your information to the BBA map and list of baby banks in the UK
- For impact monitoring and evaluation purposes of baby banks across the UK
- To deliver services to you
- To make decisions about how to operate the network and improve our offer
- To let you know about our work, guidance, and events.
- Publicly available organisational information appears on the BBA map (if you have consented to having your baby bank’s information included).
- We may also use your information to:
- Carry out our business and keep up to date records
- Seek your views and comments on our service
- Notify you of any changes to our services
- Send you communications that you have requested or those necessary for the delivery of our service
- Keep you up to date with our news and other relevant news and opportunities
- The personal information collected is used for the following reasons:
- Who has access to the information that we collect
- The personal and organisational information we hold is only accessible by named users from two of the four partner organisations (Purposeful Ventures, Save the Children) who are working within their capacity and directly on the setup and administration of the Baby Bank Alliance. The named users who are directly working on the setup and administration of the Baby Bank Alliance will be able to access the personal and organisational data listed above in order to carry out their roles.
- Other representatives from these organisations who are working within their capacity for the BBA, may have access to the information they require to carry out their role or perform a specific function, for example:
- Send a newsletter
- Perform impact analysis
- Invite you to an event
- Access will be limited to only the data that they require to carry out their role. Only authorised employees and data processors (software suppliers and those working on behalf of the BBA to deliver our products and services) will have access to your data. All parties who have access to your data are required to process/use that data in accordance with the provisions of current data protection legislation and our Data Protection Policy and only for the purposes of the BBA. Under the UK General Data Protection Regulation (UK GDPR), the lawful bases we rely on for processing this information are:
- (a) Your consent
- (b) We need it to perform a public task.
- (c) We have a legitimate interest.
- How we store your information
- Personal data is processed using a combination of cloud-based information management systems, cloud storage and sharing facilities. In accordance with data protection legislation, it is only retained for as long as is necessary to fulfil the purposes for which it was obtained, and not kept indefinitely.
- ‘Third party data processors’
- Whilst in its infancy, Purposeful Ventures is acting as the ‘Data Processor’ of the personal data we collect and process to provide our services. The data shared is only accessed by named individuals within Purposeful Ventures and Save the Children for the purposes of and who are performing a task for and on behalf of the BBA. Your data is not shared or used by Purposeful Ventures to process for their own purposes.
- We use a number of other data processors to help us deliver our services to you. These are called ‘third party data processors’. Each processor has their own data protection and privacy policies that you should be aware of. We only use third party data processors that are compliant with the highest data protection legislation ensuring secure data storage and transfer. Where data is stored outside of the EU, third party processors will have relevant technical and organisational measures in place using Standard Contractual Clauses. Please be reassured that we will not sell, trade, rent, exchange or otherwise share your personal information to third parties for them to use for their own purposes, unless you have requested us to do so, or we are required to do so by law, for example, by a court order or for the purposes of prevention of fraud or other crime.
- We use:
- Salesforce to store your personal and organisational information which is password protected and only accessible by named users from the four partner organisations.
- Microsoft 365: Forms for collecting data, Excel sheets for analysing data and Sharepoint for filing documents, Microsoft Outlook for work emails
- Google: Looker Studio for analysing data, forms for collecting data
- Microsoft Teams for calls
- YouTube for hosting recordings of BBA shared learning calls
- All personal and organisational data is currently processed within Excel. No data is stored on any other third-party processor platform.
- Transfer outside of the European Economic Area (EEA)
- We do not normally transfer your information to a different country outside the EEA. However, some of our external third-party support partners are based outside the EEA so their processing of personal data will involve a transfer of data outside the EEA. Whenever we transfer personal data out of the EEA, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented, including:
- We will only transfer personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission.
- Where we use certain service providers, we may use specific contracts approved by the European Commission which give personal data the same protection it has in Europe and/ Standard Contractual Clauses.
- Data Retention
- Individuals from baby banks are invited to opt in to being included in the map and contacted by us. You can withdraw your consent at any time and information on how you can do this is included in all correspondence sent by the BBA.
- We keep organisational information for as long as the BBA is in operation. This is so that we have a record that your baby bank exists.
- We will hold your personal information on our systems for as long as is necessary for the relevant activity, or as long as is set out in any contracts we enter into with you.
- If you opt in to having your baby bank included on the map or for us to be able to contact you, then we will keep your organisational information until you opt out or for as long as the BBA is in operation.
- If you opt out of having your baby bank included on the map, we will keep a record of your organisational information, along with any notes we have made about our conversations with you.
- If you opt out of us being able to contact you, we will keep your name and the baby bank you are affiliated with but delete your contact details. We keep a ‘do not contact’ list of anyone who opts out.
- We do not normally transfer your information to a different country outside the EEA. However, some of our external third-party support partners are based outside the EEA so their processing of personal data will involve a transfer of data outside the EEA. Whenever we transfer personal data out of the EEA, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented, including:
- Other Websites or Resources
- We may at times share links to other websites or resources that may be of interest to representatives from other baby banks. These sites are not governed by this privacy notice and you will be subject to those third party controls and notices. Please check the respective policies of the visited site for more information.
- How can you access and update your information?
- You can request a copy of the information we have about you at any time, and we will provide you with a full copy within one calendar month free of charge. If you change any of your contact detail and would like these to be updated on our system, please email [email protected].
- You can withdraw consent at any time for your data to be processed and used by us. At your request your data will be no longer processed and securely disposed of in line with our data retention schedule.
- What will we do if there is a data breach?
- If there is a data breach, we will investigate and where it is deemed to be likely there is a risk to the rights or freedoms of data subjects, you will be contacted, in addition to contacting the Information Commissioner’s Office.
- Your Data Protection Rights
- Under data protection law, you have rights including:
- Right of Access
- You have the right to ask us for copies of your personal information.
- Right to Rectification
- You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
- Right to Erasure
- You have the right to ask us to erase your personal information in certain circumstances
- Right to Restriction of Processing
- You have the right to ask us to restrict the processing of your personal information in certain circumstances
- Right to Object to Processing
- You have the the right to object to the processing of your personal information in certain circumstances
- Right to Data Portability
- You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.
- You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you. Please contact us at [email protected]
- Right of Access
- Under data protection law, you have rights including:
- Changes to This Policy
- As our service changes and develops, we may need to update this policy. Our updated policy will be available on our website. Please check this policy regularly to ensure you understand how we use your information. It is a condition of using the sites and our services that you agree to this policy and how we use your data for legitimate purposes as described in more detail above.
- How to complain
- If you have any concerns about our use of your personal information, you can make a complaint to us at [email protected]
- You can also complain to the Information Commissioner’s Office (ICO) if you are unhappy with how we have used your data. The ICO’s address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk