Tackling Malnutrition in Older people Living at Home in Scotland


Privacy Policy


Food Train is required to collect, store and process certain personal data to carry out our day to day charitable activities, meet our aims and vision and comply with legal obligations.

Food Train is committed to ensuring your personal data is dealt with in line with the EU General Data Protection Regulation (GDPR). To comply with the law and your right to be informed, this policy outlines why we need your personal data, what we do with your data, how long we will retain the data for and how you can exercise your rights in relation to our handling of your data.

Data Protection Principles

Personal data must be processed in accordance with six 'Data Protection Principles'. It must:

  • be processed fairly, lawfully and transparently;
  • be collected and processed only for specified, explicit and legitimate purposes;
  • be adequate, relevant and limited to what is necessary for the purposes for which it is processed;
  • be accurate and kept up to date. Any inaccurate data must be deleted or rectified without delay;
  • not be kept for longer than is necessary for the purposes for which it is processed;
  • be processed securely.

We are accountable for these principles and must be able to show that we are compliant.

Who we collect personal data from

Members (service users)

If you are a Food Train member (service user), the data we will collect and hold includes your name, home address, telephone number, date of birth and emergency contact. Our lawful basis for collecting and processing this information is to allow us to fulfil our contractual obligation in providing you with a service.

We will also ask for some basic information about your health, access and support needs to ensure the service we are providing you with is appropriate and tailored to your needs. Our lawful basis for collecting and processing this information is also to fulfil our contractual obligation. Processing is necessary to provide you with a social care service.

We may also ask your permission to take, store and use photographs of you taken during the course of service delivery for the purposes of service promotion or evaluation. Our lawful basis for collecting and processing this data is consent. At the time of providing your consent, we will ensure you are notified of how we plan to use the photographs and how long we plan to continue using them.

From time to time, we may ask you how our services have helped you. This is for the purpose of service evaluation and to allow us to improve our services. This information will only be gathered with your consent.

All member data is stored electronically on a membership database, accessed only by approved staff and volunteers. Hard copy referral forms are stored in local offices in locked cabinets with restricted access to keys.

Your details will be removed immediately upon cessation of membership, unless appropriate and justifiable reason exists to retain for a limited period. An example of a justifiable reason may be the need to reconcile your account following the end of your service; this may take a number of weeks to complete.

Volunteers

If you are a Food Train volunteer, the data we will collect and hold includes your name, home address, telephone number, email address, date of birth, driving license details, PVG scheme record number and personal referee information. Our lawful basis for collecting and processing this information is to allow us to fulfil our contractual obligation of volunteer employment with you.

We will ask you for basic information about your health, access and support needs relevant to your volunteering role. This information allows us to assess the suitability of the role to you and to put in place any appropriate support that will help you to conduct your role. Our lawful basis for collecting and processing this information is also to fulfil our contractual obligation. Processing is necessary for assessing your work capacity.

We may also ask your permission to take, store and use photographs of you taken during the course of service delivery or while involved in other Food Train activities, such as training or volunteer meetings. Our lawful basis for collecting and processing this data is consent. At the time of providing your consent, we will ensure you are notified of how we plan to use the photographs and how long we plan to continue using them for promotional or service evaluation purposes.

From time to time, we may ask you how volunteering with Food Train has impacted on your life. This is for the purpose of service evaluation and to allow us to improve our services. This information will only be gathered with your consent.

All volunteer data is stored electronically on a membership database, accessed only by approved staff and volunteers. Hard copy referral forms are stored in local offices in locked cabinets with restricted access to keys.

Protecting Vulnerable Groups Scheme records are kept in accordance with the law and destroyed securely within the timeframe set out by Disclosure Scotland.

Your details will be removed immediately upon cessation of volunteering, unless appropriate and justifiable reason exists to retain for a limited period. An example of a justifiable reason might be your expressed uncertainty around the possibility of returning to your volunteer role after a short break.

Prospective staff

If you apply for a job at Food Train, we will request certain personal data from you to process your application and assess your suitability for the role. Data collected during the recruitment process includes name, contact details, educational achievements, employment history, referee contact details, and shortlisting and interview records. Our lawful basis for collecting and processing this information is the necessity to undertake this step to enter into a contract of employment.

We will ask you for basic information about your access and support needs. This information allows us to put appropriate support in place during the interview stage of recruitment. Our lawful basis for collecting and processing this information is also the necessity to undertake this step to enter into a contract of employment.

Processing is necessary for carrying out our obligations under employment law. Recruitment files for non-appointed applicants are stored for 6 months in accordance with best practice, then securely destroyed.

Directors

If you are a Food Train Director, the data we hold about you includes your name, home address, telephone number, email address, date of birth, current directorships, employment status, a short biography and board meeting attendance. Our lawful basis for collecting and processing this information is to comply with our legal obligations in relation to charity law.

All director data is stored electronically within a director register, accessed only by approved staff and volunteers. Hard copy application forms are stored at Head Office in locked cabinets with restricted access to keys.

Director data is held for 7 years (after retirement) in accordance with company law, after which it is securely destroyed.

Donors

If you are a Food Train donor, the data we hold about you includes your name, home address, donation method, donation amounts, Gift Aid eligibility and your reasons for donating. Our lawful basis for collecting and processing this information is consent.

All donor data is stored electronically on a donor database, accessed only by approved staff and volunteers.

Hard copy records for Gift Aid purposes are stored securely in Head Office and destroyed following the time lapse in accordance with Company Law

Professionals/ individuals working with older people

If you are a professional/individual working with older people and have an interest in hearing about the work of Food Train for the further benefit of the older people you support, the data we hold about you might include your name, job title, postal address, email address, and telephone number. This data is used purely for sharing relevant information, news, developments and opportunities in relation to supporting older people at home. Our lawful basis for collecting and processing this information is usually consent but on occasion, we may also rely on your legitimate interest to further support the individuals you work with and our legitimate interest to further support our existing members (service users).

All contact details are stored electronically within a contacts database, accessed only by approved staff and volunteers. Hard copy consent forms are stored in locked cabinets with restricted access to keys.

Your data will be held for as long as we require it for the purpose listed above. You have the right to request a stop to any further communication from us at any time and the deletion of your contact details. Any electronic newsletters sent by Food Train will contain an unsubscribe button/link within the email.

We may also ask your permission to take, store and use photographs of you taken during the course of our professional involvement with you or whilst attending a Food Train event. This would be for the purposes of service/ project promotion, information sharing or evaluation. Our lawful basis for collecting and processing this data is consent. At the time of providing your consent, we will ensure you are notified of how we plan to use the photographs and how long we plan to continue using them.

Grant applicants/ holders

If you have applied for an Eat Well Age Well grant, the personal data we hold about you will include your name, preferred name, position in organisation (if relevant), postal address, email address, telephone number and names of any social media accounts or websites owned by you. If you are successful in securing a grant (and have applied as an individual rather than as a representative of an organisation), we may also ask you for your bank details to allow for the transfer of funds, as well as two forms of personal identification with address details. This data is only held for the purpose of administering your grant application/award. Our lawful basis for collecting and processing this information is to allow us to fulfil our contractual obligation as a grants administrator.

Your data is stored electronically on the Eat Well Age Well website and on our grants administration database, accessed only by approved staff. Hard copy files in relation to each grant holder are stored within locked filing cabinets, with key access restricted to authorised staff.

Your data will be held for the duration of our relationship with you during the funding period and for 7 years beyond in accordance with company law.

For the purpose of grant scheme evaluation and assessing the impact of our grant awards in achieving our Eat Well Age Well objectives, we will ask you to report on the outcomes of your funded activity. We will encourage you where possible to anonymise any personal data in relation to your project beneficiaries and if this is not possible, to confirm that you have sought the consent of your beneficiaries to share their data with us. Data we collect may be shared with our project funder (Big Lottery), shared on our website or social media pages or used in publicly available reports/leaflets to demonstrate our impact.

Any personal data gathered about your beneficiaries for the purposes of impact assessment will be stored electronically within our Team Site and within hard copy grant holder files, as above. This data will be held for the duration of your relationship with us and for 7 years beyond, as above.

How we collect data

Data is collected in a number of ways at Food Train, including face-to-face (e.g. volunteer interviews), telephone (e.g. customer referrals), email (e.g. job applications), and via our websites (e.g. donations, enquiries). At every data collection point, we will make you aware, prior to you providing any personal data, why we are asking for your data, how your data will be used and how long we will keep it for. A copy of our full up-to-date privacy policy will also be provided.

Food Train hosts 3 websites:

Our websites use cookies and Google analytics to allow us to provide an improved experience for the user. Please see our full Cookies Policy for further information.

How we keep your data secure

The security of your data is of paramount importance to us. Every category of data held at Food Train is given individual consideration and appropriate security measures are in place to ensure we are keeping it as secure as possible. In general, across the organisation, we take the following steps to ensure all personal data is kept secure at all times against unauthorised or unlawful loss or disclosure:

  • All electronic data is cloud hosted on a secure Team Site only accessible to approved Food Train employees and volunteers through approved passwords
  • All electronic data is backed up and stored by our IT provider
  • Restrictions and guidance on using the Team Site from mobile devices and home computers is in place for all staff and volunteers and any breach of this by paid staff is viewed and treated as misconduct and may be subject to disciplinary action
  • All hard copy files are stored in lockable cupboards with restricted access to keys
  • Personal data is not moved off site (paper copies and memory sticks) for any other purpose other than when being taking to Head Office for storage
  • Hard copy service delivery documents are created, utilised, stored and/or destroyed upholding the principles of GDPR, the responsibility for ensuring the security of such paper records lies with all Food Train employees and volunteers
  • A clear desk policy applies to all Food Train employees, ensuring all confidential information is stored and/or filed securely and other paperwork on desks is kept to an appropriate and reasonable minimum

Sharing your data

Sometimes Food Train contractors or partner agencies may have access to your personal data while assisting us to conduct our business or provide a service to you. Such a contractor is our IT support provider. We require any contracted companies to keep your personal data confidential and secure and to protect it in accordance with the law and our policies. They are only permitted to process your data for the lawful purpose for which it has been shared and in accordance with our instructions.

We might share your personal data with partners, contractors and agents to carry out our obligations under our contract with you or to meet our legal obligations. Contractors and agents include:

  • Health and social care professionals (to further support our members)
  • Disclosure Scotland (staff and volunteers for criminal record checks)
  • HMRC (staff and donors for tax purposes)
  • Our pension provider (staff only)
  • Our legal advisers

Food Train does not send any personal data outside the European Economic Area where data protection legislation differs.

Your rights

Unless subject to an exemption [under the GDPR], you have the following rights with respect to your personal data:

  • The right to request a copy of your personal data (a subject access request (SAR)) which Food Train holds about you;
  • The right to request that Food Train corrects any personal data if it is found to be inaccurate or out of date;
  • The right to request your personal data is erased where it is no longer necessary for Food Train to retain such data or you feel we are not entitled under the law to process it;
  • The right to withdraw your consent to the processing at any time [where we rely on consent as the lawful basis for processing];
  • The right, where there is a dispute in relation to the accuracy or processing of your personal data, or whilst we are dealing with an application from you to correct or erase your data, to request a restriction is placed on further processing;
  • The right to object to the processing of your personal data (where we rely on legitimate interest for processing, or process the data for direct marketing, research or statistical purposes)

Contacting us

If you are a Food Train member (service user), volunteer or donor to a local branch and wish to simply correct or update the information we hold about you, you may do so via the local office/ Regional Manager/ Project Manager.

For all other contact in relation to exercising your rights, enquiries/suggestions about Food Train's data protection practices, requests to access the data we hold about you (a Subject Access Request) or to complain about how your data has been handled, please contact our Data Protection Officer - email dpo@thefoodtrain.co.uk, or telephone 01387 270800.

Complaints

If you have any concerns about how Food Train has used your personal data, our Data Protection Officer would like to hear about this. Please contact using the details above.

Should you have continued reason to be unhappy about how Food Train has collected or handled your personal information, you have the right to complain to the UK's Information Commissioner. You can do this by contacting the Information Commissioner's Office directly.

The Information Commissioner's Office can be contacted on 0303 123 1113. The www.ico.org.uk website has further information on your rights and our obligations.

Data breaches

Food Train has robust measures in place to minimise and prevent data breaches taking place. In the event that any personal data becomes lost or shared inappropriately by Food Train, we have a data breach management procedure in place to ensure any associated risk is minimised as soon as possible. If a significant breach occurs that is likely to risk the rights and freedoms of individuals, we will notify the Information Commissioner's Office within 72 hours of the breach being discovered.