Criminal Convictions Data
We may process criminal convictions data about you because:
- We are required by law to screen volunteers who apply for certain volunteer roles for relevant criminal convictions;
- In relation to our Steward Volunteer (COVID-19 Vaccinations) and Non-Clinical Support role, when applying you will be asked to confirm whether you have any unspent convictions and, if you confirm that you do, for details of those convictions and certain related information. We will then use that information to undertake a risk assessment to help us determine whether you can be accepted as a Vaccination Steward and Non-Clinical Support volunteer. Our risk assessment will be based on internal guidance which reflects best practice relating to the rehabilitation of offenders.
It is also possible that we may obtain criminal convictions data about you after you have been accepted as an NHS Volunteer Responder (e.g. if you respond to a new recruitment drive for Community Response Plus Volunteers). If so, we may use such criminal convictions data to assess your general suitability as an NHS Volunteer Responder (which could result in your role as an NHS Volunteer Responder being terminated). Where we use criminal convictions data for this purpose, we will again do so in accordance with our internal guidance which reflects best practice relating to the rehabilitation of offenders.
Whenever we need to process criminal convictions data about you, in addition to having a lawful basis for processing (as set out in the above table), we are also required to satisfy one or more additional conditions under UK data protection law. We will rely upon one of the following conditions:
- The fact that it is necessary for us to process criminal convictions data for the purpose of enabling us to carry out our obligations in the field of employment and social protection law;
- That we need to process criminal convictions data for the purpose of crime prevention; or
- That we need to process criminal convictions data for safeguarding purposes.
We are required to have ‘appropriate policy document’ in relation to our processing of criminal convictions data. If you would like to see a copy of our appropriate policy document, please contact us.
Ethnicity & language data
We may process ethnicity and/or language data about you because:
- We would like a means of measuring whether or not we are successful in attracting applications from volunteers who are from an ethnic minority background;
- We would like to “match” you with Individuals who have expressed a preference for support in a particular language.
Whenever we need to process ethnicity or language data about you, in addition to having a lawful basis for processing (as set out in the above table), we are also required to satisfy one or more additional conditions under UK data protection law. We will rely upon the following condition:
- Article 9(2)(g) – processing is necessary for reasons of substantial public interest on the basis of EU or UK law. Schedule 1 Part 2 Paragraph 8 of the DPA 2018 – Equality of opportunity or treatment.
We are required to have an ‘appropriate policy document’ in relation to our processing of ethnicity and language data. If you would like to see a copy of our appropriate policy document, please contact us.
Religion & gender identity data
We may process religion and/or gender identity data about you because:
- We would like to identify where any barriers to participation exist and to monitor the impact of our accessibility workstream.
Whenever we need to process religion or gender identity data about you, in addition to having a lawful basis for processing (as set out in the above table), we are also required to satisfy one or more additional conditions under UK data protection law. We will rely upon the following condition:
- Article 9(2)(g) – processing is necessary for reasons of substantial public interest on the basis of EU or UK law. Schedule 1 Part 2 Paragraph 8 of the DPA 2018 – Equality of opportunity or treatment.
We are required to have an ‘appropriate policy document’ in relation to our processing of religion and gender identity data. If you would like to see a copy of our appropriate policy document, please contact us.
We will only use your personal data (i.e. your name, telephone number, email address and/or postal address) to communicate with you about other volunteering opportunities with Royal Voluntary Service if you have given us your express consent to do so (for example, if you agreed to this at the time you applied to become an NHS Volunteer Responder or if, at the end of the Scheme, you give us permission to provide you with information about our other volunteering roles).
As a general rule, we will not share your personal data with other organisations for promotional or marketing purposes or contact you with promotional information about other organisations. However, when applying to become an NHS Volunteer Responders, some individuals will have been asked:
- If they consent to Royal Voluntary Service contacting them about other volunteering opportunities with NHSE; and
- If they consent to GoodSAM contacting them about becoming a GoodSAM cardiac volunteer responder.
If you have consented to Royal Voluntary Service contacting you about other volunteering opportunities with NHSE, from time to time Royal Voluntary Service will use your name, telephone number, email address and/or postal address to provide you with information about other NHSE volunteering opportunities which are brought to our attention by NHSE as a result of our partnership with NHSE in relation to the Scheme. If you consent to GoodSAM contacting you about becoming a GoodSAM cardiac volunteer responder, we will share your name and email address with GoodSAM and GoodSAM will subsequently get in touch with you directly.
Please note that if you decide to volunteer for NHSE or GoodSAM, you will be doing so independently of your relationship with Royal Voluntary Service and any use of your personal data by NHSE or GoodSAM will not be controlled or overseen by Royal Voluntary Service and will be subject to the privacy notices used by those organisations.
You have the right to withdraw your consent to us contacting you about Royal Voluntary Service or NHSE volunteering opportunities at any time. To do so, please contact us in any of the ways set out in the section ‘How to contact us’ below. However, if you consent to us sharing your name and email address with GoodSAM but you subsequently change your mind about becoming a GoodSAM cardiac responder, you will need to contact GoodSAM directly to withdraw your consent.
Our and your relationship with GoodSAM
The effective operation of the Scheme relies upon technology made available to NHSE, Royal Voluntary Service and you by GoodSAM.
- To apply to become an NHS Volunteer Responder, you will need to fill out the online application form on the GoodSAM Website;
- If you are accepted as an NHS Volunteer Responder, you will need to download, install and use the GoodSAM App so that we can notify you of volunteering tasks in your area and you can accept and perform volunteering tasks; and
- We will use a software platform made available to us by GoodSAM (which will interface with the GoodSAM App) to help us run the Scheme.
This means that we will need to share your personal data with GoodSAM. It also means that you will provide some personal data to GoodSAM directly. Consequently, GoodSAM’s role under UK data protection law will vary depending on what personal data it is processing and why. In this section, we provide more information about our and your relationship with GoodSAM.
GoodSAM as our data processor
In relation to the following personal data, GoodSAM will act as our data processor and process your personal data on our behalf:
- GoodSAM’s use of the personal data you provide to us when you apply to become an NHS Volunteer Responder;
- Other personal data about you which is input into the GoodSAM software platform as a result of your dealings with us as an NHS Volunteer Responder; and
- Personal data relating to the acceptance and performance by you of volunteering tasks which we obtain as result of the interface of the GoodSAM software platform with the GoodSAM App.
Where GoodSAM processes your personal data as our data processor, GoodSAM will be subject to contractual obligations to us only to process your personal data in accordance with our instructions, not to use your personal data for other purposes and to keep your personal data safe and secure.
GoodSAM as joint controller
If you are accepted as an NHS Volunteer Responder, to enable GoodSAM to create an account for you on the GoodSAM App, Royal Voluntary Service will need to make available to GoodSAM your full name and email address (‘Shared Data’).
GoodSAM and Royal Voluntary Service will then become joint controllers of the Shared Data. This means that both Royal Voluntary Service and GoodSAM will have certain rights to use the Shared Data but must also comply with the obligations and restrictions set out in UK data protection law.
For the duration of the Scheme, GoodSAM will be subject to contractual obligations to us only to use the Shared Data for the purposes of providing and running the technology which underpins the Scheme. However, once the Scheme has come to an end, GoodSAM’s use of the Shared Data will be in accordance with its privacy notices and policies (subject to its obligation to use the Shared Data in accordance with UK data protection law). GoodSAM should be able to provide you with a copy of such notices and policies.
While the Scheme is ongoing, you may submit a request to exercise any of the rights referred to in the section ‘Your rights’ below in relation to the Shared Data to either GoodSAM or Royal Voluntary Service.
GoodSAM as sole controller
In relation to your use of the GoodSAM Website and the downloading, installation and use by you of the GoodSAM App, you will have a direct relationship with GoodSAM. This means that, in relation to GoodSAM’s collection and use of the following personal data, GoodSAM will be acting as sole controller:
- Personal data automatically collected from you by GoodSAM as a result of your use of the GoodSAM Website (for example, your IP address and cookie data);
- Personal data collected from you by GoodSAM when you download, install and use the GoodSAM App (other than personal data that relates to your volunteering role in relation to the Scheme). For example, data relating to your mobile phone or other device, location data and any profile you create on the GoodSAM App.
GoodSAM will use such personal data (referred to from here on as ‘GoodSAM Data’) in accordance with its own privacy policies and notices (subject to compliance by GoodSAM with the requirements of UK data protection law). Such policies and notices should be available on GoodSAM’s website and when you download and install the GoodSAM App. Any requests to exercise any of the rights referred to in section ‘Your rights’ below will need to be made to GoodsAM and any claims you have for misuse of the GoodSAM Data will need to be made against GoodSAM.
Our expenses system
As an NHS Volunteer Responder, you will be able to submit claims to us for the reimbursement of certain expenses (we will email you with details of what expenses you can claim and how to do this). To assist us with the administration and processing of expenses claims and payments, we will use an expenses system provided by Concur Holdings (Netherlands) B.V. (‘SAP Concur’).
The expenses system will work in the following way:
- Once you have completed your first volunteering task, we will share your name, email address and your unique volunteer identification number with SAP Concur. This will enable SAP Concur to create a user account for you on its expenses system;
- Before you can submit any claims for expenses, you will need to have downloaded and installed the SAP Concur App onto your mobile phone or other device. Once you have done so, to access your account on the SAP Concur App, you will need to verify your email address and unique volunteer identification number;
- To submit an expenses claim you will need to access your account on the SAP Concur App and input details about the expenses you are claiming. The details will vary depending on what expenses you are claiming (for example, to make a mileage claim you will need to enter the start and end point of your journey and to claim for hand sanitiser you will need to upload a photograph of your sales receipt). In most cases, you will also need to provide the job identification number to which the claim relates. In addition, you will be asked to input details of the bank account into which you require any payment to you to be made.
- If your expenses claim is accepted, we will pay the amount of expenses you are entitled to directly into your bank account.
We have entered into an agreement with SAP Concur relating to the provision of its expenses system. Under that agreement, SAP Concur will process any personal data relating to you which comes into its possession as a result of: (i) us sharing information with SAP Concur so that an account can be created for you; and (ii) you making an expenses claim (‘Expenses Data’) as the processor of Royal Voluntary Service. This essentially means that SAP Concur will be required to process Expenses Data strictly in accordance with our instructions and for no other purposes.
Under our agreement, SAP Concur has authorisation to share Expenses Data with sub-contractors that it uses to provide its expenses system, but any such sharing by SAP Concur must be on and subject to equivalent terms to those set out in our agreement with SAP Concur and will therefore restrict the processing of Expenses Data by such sub-contractors.
SAP Concur will retain Expenses Data for a period of 6 months following the end of our agreement with SAP Concur. After the expiry of this period, SAP Concur will erase your personal data.
Sharing of your personal data with other third parties
As well as GoodSAM and SAP Concur, we will also need to share your personal data with certain other trusted organisations who are providing essential services to us in relation to the Scheme. This includes:
- Ventrica Limited, the organisation which operates our NHS Volunteer Responder call centre, helps us to check the identity and DBS certificates of members of the public who apply to become NHS Volunteer Responders and undertakes certain other work on our behalf;
- Our mailing partner, The Woods Group Limited;
- The organisations which host our websites and software systems;
- Our insurers and our banks; and
- Our professional advisers (such as lawyers and accountants).
We only allow our service providers to handle your personal information if we are satisfied they take appropriate measures to protect your personal information. We also impose contractual obligations on service providers relating to ensure they can only use your personal information to provide services to us and to you.
We may also disclose and exchange information with law enforcement agencies and regulatory bodies to comply with our legal and regulatory obligations.
If you are accepted for our Steward Volunteer (COVID-19 Vaccinations) and Non-Clinical Support role and agree to attend a vaccination site, we will share your name, date of birth and address details with NHSE and/or other organisations that are running vaccination sites on its behalf. This will be to assist with the safe running of a vaccination site including for example any identity checks on arrival at a vaccination site.
As stated above (see ‘How and why we use your personal data’), we will use information we obtain about your journey as an NHS Volunteer Responder to create anonymous statistics about the Scheme. For example, statistics about how many people have volunteered as NHS Volunteer Responders or how often our NHS Volunteer Responders use the GoodSAM App. We will include such statistics in reports we share with NHSE and other government bodies (who may, in turn, share those reports more widely). No personal data about you will be included in any such reports.
How long your personal information will be kept
In the event that we are unable to accept your application to become an NHS Volunteer Responder, we will delete your application form from our system as soon as reasonably practicable. This will include any copy documentation you have provided to us to verify your identity and any copies of DBS certificates. We will, however, retain your name and email address for the duration of the Scheme (this is necessary for our general record keeping and audit purposes and so that we can compile statistics relating to the total number of applications received).
Please note, should you navigate past the first page of the application form without completing and submitting it, we will retain your name and email address for a period of 1 month, to give us the option of contacting you to enquire as to whether you require support in completing the form.
If you apply for our Steward Volunteer (COVID-19 Vaccinations) and Non-Clinical Support role, although we will delete your application form if your application is unsuccessful, we will need to retain any information you provide to us relating to unspent convictions and a copy of any risk assessment we carry out. We will do so for the duration of the Scheme plus an additional period of 6 months.
If you are accepted as an NHS Volunteer Responder, our general retention policy will be to retain your personal data for the duration of the Scheme plus an additional period of 6 months. While the Scheme is still operational, we need to retain your personal data to enable us to run the Scheme effectively. Retention for a further period of 6 months after the Scheme has ceased to operate is necessary for our general business purposes (including audit and processing expenses claims) and to enable us to deal with any ad hoc queries and/or complaints which arise.
Please note that it is currently envisaged that the Scheme will run until the end of March 2021. However, it is possible that NHSE will extend the duration of the Scheme and if this happens, we will review our general retention policy and evaluate whether any personal data which is no longer required can be deleted at this stage.
Our general retention policy referred to above is subject to the following exceptions:
- If you submit an expenses claim to us (see section above ‘Our expenses system’) we will retain Expenses Data for a period of 7 years from the end of the financial year in which the claim is submitted. This is necessary to enable us to comply with statutory requirements relating to accounting and taxation.
- We may need to retain your personal data for a longer period to deal with any complaints, grievances, investigations or legal claims or actions involving or relating to you. In this situation, situation, we will retain such personal data as is necessary to deal fully with the relevant complaint, grievance, investigation or legal claim or action;
- If a safeguarding concern arises, we will retain such personal data relating to you as may be necessary to deal with the issue and/or meet our obligations in relation to safeguarding (including any regulatory or legal obligations); and
- We will retain information relating to the Scheme for the purposes of archiving in the public interest and historical research. Such information may include your personal data. Any such retention and subsequent processing of your personal data will be in accordance with the National Archives Guide to Archiving Personal Data 2018.
In addition, if, at the end of the Scheme, you agree to take up a broader volunteering role for us, we will retain such of your personal data as is necessary to register you as a general Royal Voluntary Service Volunteer. Subsequently, our use and retention of your personal data will be in accordance with our general privacy notice and retention policy (you can find links to these documents on our main Royal Voluntary Service website).
Deletion of personal data
Once it is no longer necessary for us to retain your personal data, we will ensure that it is permanently and securely deleted or anonymised.
Our retention Schedule
Further details about our retention policy can be found in our retention schedule relating to the Scheme. Please contact us if you would like to be provided with a copy of this.
Where your personal information is held
Your personal data will be held in the UK on the GoodSAM software platform. It will not be transferred by us or GoodSAM outside the UK and/or EEA.
However, in relation to the GoodSAM Data, it is possible that GoodSAM may store or transfer your personal data outside the UK and/or EEA. Where GoodSAM does so, GoodSAM should make available to you information about how it safeguards your personal information.
If we need to store any criminal convictions data about you or copies of any risk assessments, this information will be stored in secure location within our own IT system.
Under data protection law, you have a number of different rights which you can exercise free of charge. These are described in the table below. Some of the rights only apply in certain circumstances and not all of the rights will be relevant in relation to our use of your personal data: