Bountiful Bridges is committed to protecting the privacy, confidentiality, integrity, and security of personal information entrusted to us.
We recognise our responsibility to process personal data fairly, lawfully, transparently, and securely in accordance with:This policy applies to all staff, volunteers, trustees, contractors, consultants, and anyone acting on behalf of Bountiful Bridges.
The purpose of this policy is to:
This policy applies to:
The policy applies whether information is stored on-site, remotely, or through authorised third-party systems.
Bountiful Bridges will comply with the following UK GDPR principles.
Personal data shall be:Lawfulness, Fairness and Transparency
Processed lawfully, fairly, and transparently.Purpose Limitation
Collected only for specified, legitimate purposes.Data Minimisation
Limited to what is necessary.Accuracy
Kept accurate and up to date.Storage Limitation
Retained only as long as necessary.Integrity and Confidentiality
Protected through appropriate security measures.Accountability
Managed in a way that demonstrates compliance.Bountiful Bridges may process:
Personal Data
Volunteer Information
Staff Information
Service User Information
Donor Information
In certain circumstances, Bountiful Bridges may process sensitive information including:
Special category data will only be processed where a lawful basis exists and appropriate safeguards are in place.
Bountiful Bridges processes data under one or more of the following legal bases:
Consent
Where individuals have given clear permission.Contract
Where processing is necessary to fulfil an agreement.Legal Obligation
Where required by law.Vital Interests
To protect someone’s life or safety.Public Task
For community and charitable activities.Legitimate Interests
Where processing is necessary for organisational operations and does not override individual rights.Personal information will only be collected where:
Individuals will be informed about:
Bountiful Bridges will implement appropriate security measures including:
Physical Security
Electronic Security
Organisational Security
Access to personal information will be restricted to authorised individuals who require the information for legitimate organisational purposes.
Access rights will be:Personal information will only be shared where:
Any sharing will be limited to the minimum information required.
Where third-party providers process information on behalf of Bountiful Bridges, we will ensure:
Examples include:
Personal information will be retained only as long as necessary.
Retention periods will consider:At the end of the retention period, data will be securely deleted, destroyed, or anonymised.
Individuals have the right to:
A data breach includes:
Any suspected breach must be reported immediately to organisational leadership.
Where required, breaches will be reported to:A breach register will be maintained.
Photographs and recordings may be used for:
Appropriate consent will be obtained where required.
Special care will be taken when children and vulnerable adults are involved.
Safeguarding records require enhanced protection.
Such records shall:Safeguarding responsibilities may override confidentiality where there is risk of harm.
All staff and volunteers must:
Failure to comply may result in disciplinary action.
Bountiful Bridges will provide:
Training records will be maintained.
Compliance with this policy will be monitored through:
Corrective action will be taken where required.
This policy will be reviewed:
