Introduction

1. The Benevolent Society of Blues (“the BSB” or “we” or “us”) is a Data Controller registered with the Information Commissioner’s Office under registration number Z6342912. As a data controller we are responsible for deciding how we hold and use personal information about you.
2. The BSB is responsible for and is committed to using personal information in accordance with all applicable data protection legislation, including the UK General Data Protection Regulation (“UK GDPR”).
3. The purpose of this Privacy Policy is to explain about personal information, how the BSB meets its obligations and what your rights are. This notice is available on the BSB’s website.

What is personal data?

4. Personal information is information that relates to an identified or identifiable individual. Some categories of personal information are treated as what is known as “special categories”, which broadly comprise more sensitive personal information which may need to be treated differently.

What information do we collect?

5. Personal information collected by us can take many different forms. It may be factual information, expressions of opinion, images or other recorded information which identifies or imparts something of significance about a living individual. It may be held electronically, in hard copy paper form or held as photographic images.
6. The extent of the personal information that we collect relating to any one individual will depend upon the nature of that person’s interaction with us. We will only collect personal information that is proportionate and necessary.
7. We may collect any or all of the following:

• Contact information, including your name, address, date of birth, telephone number(s) and email address(es).
• Personal information including previous names and addresses, your nationality, your marital status, your residential status, employment status and number of dependants and your current or past relationships with Christ’s Hospital.
• Financial information, including details of assets, pensions and investments, insurances, liabilities and debts including secured and unsecured credit obligations. We may also collect detailed information about your banking arrangements.
• Budgetary information, including your income and expenditure and credit obligations.
• Medical information, including details of any relevant health conditions.
• For applications seeking assistance from us by or on behalf of a pupil currently at Christ’s Hospital, we may collect information relating to admissions, academic, disciplinary, medical and other education related records, information about special educational needs, references, examination scripts and marks.
• Background information, including any information that you give us as part of your application to us for assistance or that we obtain from publicly available sources, including through searches undertaken on the internet.
• Documentary information as is provided by you to support your application to us for assistance or for any other reason.
• Other information, including information about your electronic devices or the software it uses (i.e. its IP address) and records of communications with you, including emails, communications over social media, communications via our website and records of our discussions, advice, recommendations and decisions that we make.

8. It is sometimes necessary for us to ask for and to collect personal information relating to a dependant or someone with whom you live and/or share some or all aspects of your financial affairs. We will not collect any personal information relating to such a person unless you have confirmed to us in writing that the person concerned has consented to their personal information being shared with us. All personal information that we receive pursuant to this paragraph will be treated in the same way as all other personal information we collect.

How will you use my personal information?

9. We will use your personal information following five key principles:

• Purpose limitation principle. Personal information will be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes.
• Data minimisation principle. Personal information will be adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed.
• Accuracy principle. Personal information will be accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal information that is inaccurate, having regard to the purposes for which it is processed, is erased or rectified without delay.
• Storage limitation principle. Personal information will be kept for no longer than is necessary for the purposes for which the personal information is processed.
• Integrity and confidentiality principle. Personal information will be processed in a manner that ensures its appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

Why do you need my personal information?

10. We need to be able to collect and process personal information in order to carry out our charitable and other purposes and to promote our legitimate aims. These include the protection and promotion of BSB’s legitimate interests and objectives, including the provision of grants and loans and other assistance to those seeking our help; the publication of our website, newsletter and other publications; fundraising for charitable purposes; organisational governance and the general administration of the BSB and the maintenance of an historic archive.
11. We will only process personal information for the purpose(s) for which it was originally acquired. We will not process it for any other purpose without your permission, unless we are permitted to do so under the UK GDPR or we are required to do so by law.
12. We will where possible minimise the extent of the personal information that we collect and use. The extent to which we collect and use your personal information is likely to depend upon the purpose for which we have asked you to share your information. When we are asked to provide assistance, the information we need is likely to be extensive. This is because we must have a full understanding of your financial and personal circumstances in order for us to be able to decide if and how we are able to help you. In all other circumstances, for example those concerning members, subscribers and supporters, the extent to which we need to hold personal information will normally be limited.

Will you keep my personal information up to date?

13. It will not always be necessary for us to update and keep updated the personal information which we hold (for example, where financial or other information was provided in connection with an application for assistance which has been determined). Where it is either necessary or desirable to keep information up to date, or we have been made aware of new information by you, we will update the information we hold.
14. You should notify us promptly of any changes that are necessary to, or of any inaccuracies that you believe may exist in, the personal information we hold for you so that we can keep your information up to date and relevant.

How long will you keep my personal information?

15. We will only keep your personal information for as long as necessary. To determine the appropriate period for us to retain your personal information we consider the nature and sensitivity of the information which we hold.
16. If you have made an application to us for assistance (whether the application was successful or not) we will keep your core information for a period of six years starting with the end of your relationship with us. The six year period may need to be extended where we need to comply with legal, accounting or regulatory requirements. We do though recognise that there may be information that you provided as part of your application that we do not need to retain and we will anonymise, destroy or delete this at an earlier time.
17. If you have not made an application to us for assistance but have provided us with personal information, for example as a member, subscriber or supporter, we will retain your personal information for two years after your last interaction with us.

How will you keep my personal information safe?

18. We take the confidentiality and safety of all personal information seriously hand have put in place arrangements to ensure, as best we can, that your information is not disclosed to any third party (without your consent) or misused in any way.
19. Your personal information will only be disclosed to or shared with the Trustees of the BSB (who are all members of our Board of Directors (“the Board”)) and with our full time staff. In the case of personal information relating to an application to us for assistance, your personal information may also be disclosed to or shared with appointed members of our Grants & Loans Committee, which is responsible for determining applications for assistance received by us. Your personal information may also be disclosed to or shared with members of our Finance Committee, which is responsible for the day to day management of our funds and investments.
20. When processing personal information for the purposes set out above BSB may communicate by post, email, telephone and file sharing services. To consider applications for assistance, the Grants & Loans Committee either meets together in person or meets remotely using a dedicated proprietary cloud-computing file sharing platform.

Will you share my personal information with any third party?

21. We will sometimes consider it desirable to share your personal information with a third party. This need will normally only arise in circumstances where you have made an application to us for assistance and we have determined that the involvement of a third party or agency will assist in the provision of that assistance. We will always seek your prior agreement to our sharing your information with a third party and will agree with you the extent to which your information is to be shared.
22. All third parties with whom we share your personal information will be required by us to confirm that they will only use your information for specified purposes and in accordance with our instructions.

Your right of access to your personal information

23. You have a right to be given access to your personal information that we hold. This is known as a Subject Access Request. If at any time you wish to make a Subject Access Request, please contact us in writing or by email, making it clear that you are making such a request.
24. We aim to respond to Subject Access Requests as quickly as possible and will ensure that any information is provided within one calendar month unless an exemption from the right of access under the UK GDPR applies. If it is going to take us longer than one month to reply, we will notify you and keep you informed of progress.
25. For further information on making a Subject Access Request please visit the website maintained by the Information Commissioner’s Office where further information is available.

Other rights that you have in relation to your personal information

26. You have a right to withdraw your consent to the continued processing by us of your personal information. This will not affect what has happened up to the date on which you withdraw consent and if we are obliged by law to continue processing your personal information, we may do this.
27. In certain circumstances you have the right to ask for your personal information held by us to be deleted or destroyed.
28. If you wish to withdraw your consent to the continuing processing of your personal information, or wish to ask for the information we hold to be deleted or destroyed, you should contact us in writing or by email. Pending consideration of your request we will, as far as possible, restrict what we do with your personal information. We aim to respond to requests as quickly as possible. If it is going to take us longer than one month to reply, we will notify you and keep you informed of progress.
29. For further information on your rights under this section, please visit the website maintained by the Information Commissioner’s Office where further information is available.