Privacy Notice
This is the privacy notice of Cornerstone CIC, company number 11005429 (‘we’, ‘our’, or ‘us’).
Our registered office is at Cornerstone House, Unit B, 31-33 High Street, Bargoed CF81 8RW.
Introduction
This notice describes how we collect, store, transfer and use personal data. It tells you about your privacy rights and how the law protects you.
In the context of the law and this notice, ‘personal data’ is information that clearly identifies you as an individual or which could be used to identify you if combined with other information. Acting in any way on personal data is referred to as ‘processing’.
Cornerstone CIC’s legal obligations regarding your data
GDPR means EU Regulation 2016/679 of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the General Data Protection Regulation) which has been directly imported into the law of England and Wales, Scotland and Northern Ireland (UK Law) by virtue of section 3 of the European Union (Withdrawal) Act 2018 as amended by the Data Protection, Privacy and Electronic Communications (Amendment Etc.) (EU Exit) Regulations 2019.
We are registered as a ‘Data Controller’ with the Information Commissioners Office (ICO). The ICO is the regulator with the responsibility for protecting the personal data rights of people within the UK, under the General Data Protection Regulations 2016/679 and Data Protection Act 2018 (DPA). Our Registration No. is ZA5455259. As a Data Controller we decide what information we collect, how we collect it, the purpose for which we collect it and what we do with it. This means we have specific responsibilities in relation to the personal data we collect.
What information do we collect?
We may collect your:
- Name
- Address and previous three addresses
- Email address
- Telephone number (mobile)
- Contact preference
- Gender identity
- Racial or ethnic origin
- Religious or philosophical beliefs
- General health, physical and mental health information
- Sexual orientation
- Actual or alleged criminal offences
- Employment details
- References and disciplinary history
- Work history
- Education history, including school, college etc. and qualifications
- Unique learner reference number
- Outcome of initial assessments
- Current housing status and housing history
- Information in relation to your hobbies and interests
- Details of your next of kin
- Bank account details
- Debit/credit card details
- Date of birth
- Biographical details
- National Insurance Number
- Identification details, such as passport, driving licence etc.
- NHS number
- Next of kin/emergency contact information
- Health care providers (GP, Dentist etc.)
- Key worker information from external support agencies
- Immigration status
- Language requirements
- Survey responses
- Vehicle information
- Trade union membership
- Political opinions
- Records of your engagement and communication with us
- Your photo and CCTV image
- Any content featuring you that has been produced for our website, publications, social media, articles, and blog posts
- Donation information and Gift Aid details
- Photographs and video recordings, and
- Information you have entered on to our website
What’s the purpose of collecting your information?
Cornerstone CIC processes your personal data and special category data, where you have provided it, for the following purposes:
- To provide and administer Cornerstone CIC’s services
- To respond to enquiries
- To further our charitable aims
- To process personal details to administer training courses
- To comply with all statutory and regulatory compliance
- To process any enquiries or complaints raised by you and responding to any communications from you
- To share your information to third parties with whom we have a relationship under which your personal data is protected
- To processes donations, grants received, sponsorship and administer Gift Aid
- To administer events
- To communicate with you about our fundraising, campaigns, and the work that Cornerstone CIC does
- To manage your communication preferences
- To process job applications, and/or volunteering opportunities and manage the recruitment process
- To undertake research, conduct surveys and gather feedback
- To undertake research to find out more about the background and interests of our supporters and prospective supporters
- To ensure we comply with our contractual obligations to our funders, and
- To undertake profiling and analysis of your information, for example, by aggregating your information with other donor’s information, and that from other fundraising platforms, to understand where our donors come from, what you do and what you care about.
The latter informs our fundraising and marketing campaigns, helps us to effectively communicate with our donors and to fundraise. You can object to your personal information being used for this or any other purpose, by contacting our data protection officer by emailing dpo@cornerstonecic.co.uk.
Processing your data
In order to process personal data the law says Cornerstone CIC must have a legal basis to do so. The lawful basis on which the above processing takes place is legitimate interests shared by Cornerstone CIC, and you as set out below, processing is necessary for the performance of a contract, to process donations, to comply with legal obligations and, to protect your vital interests or those of another person.
The lawful basis which permits the processing set out above to take place are:
- You are accessing our services
- You have made an application to become a volunteer, trustee, or employee at Cornerstone CIC
- You have made a donation, or sponsorship
- We need to comply with regulatory requirements
- That the processing is reasonable in relation to the activities to which they relate
- The processing is such as you would reasonably expect to be undertaken by Cornerstone CIC in respect of the management of our operations
- That the processing is necessary in respect of the activities that are undertaken and is in the interests of Cornerstone CIC and the relevant third parties and does not limit your interests or fundamental freedoms guaranteed by the Data Protection Language
- That if you sought to terminate your consent to Cornerstone CIC processing your personal data, we would still be required to retain some information for a time that is reasonable to fulfil the purpose in this notice, meaning that consent is not freely available.
When you made contact with Cornerstone CIC you created a relationship between us. Where you have opted in to receiving electronic communications from us, we have treated your action as consent to send you communications electronically (commonly called “a soft opt in”). As the lawful basis of the processing, Cornerstone CIC undertakes in relation to electronic communications is your consent, please note that you may withdraw this consent at any time.
Where do we get your personal data from?
We may receive your personal data from:
- You directly, by completing forms, by contacting our helpline and webchat, by face to face or email conversations with a member of Cornerstone CIC’s staff
- Digital forms completed through our website and online surveys
- From our social media pages
- From your social media pages
- Local authorities who have referred you to one of our services
- Local agencies who have referred you to one of our services, and
- Third party companies and websites.
How do we share and/or transfer your personal data?
Cornerstone CIC may transfer your personal data to the following organisations or category of organisations:
- Service providers in order to provide you with the services you have requested. For example, web hosting providers, telephone system providers, cloud storage providers, marketing companies, payment companies for the processing of donations and payments
- Third parties with whom we have a relationship including our sub-contractors providing services to us and other charities combatting homelessness
- Regulatory organisations and quality mark organisations to undertake inspections and audit activities, to ensure the quality of our work and to improve the delivery of the services we provide
- Data analysis companies and agents who undertake analysis and profiling activities to help us measure and improve the effectiveness of our marketing, communication, and fundraising activities
- Police, Probation and Social Care Services where we have a legal duty to share information for the purposes of safeguarding, or the prevention and detection of crime
- Local Authorities to report performance indicators on homelessness and to cross reference funding and outcomes for our clients
- Welsh Government for reporting broader housing or homelessness related data.
- Healthcare related organisations and partners i.e. GP, community health teams etc. in circumstances where we believe we have a duty of care.
It is the intention of Cornerstone CIC that your personal data will remain within the countries forming the European Economic Area (the EEA) and countries where the European Union (EU) has decided that the country has adequate data protection laws in line with those in the UK.
Your personal data will only be transferred outside of the EEA or a country which has been declared as having adequate data protection laws, where:
- The transfer is necessary for the performance of any contract with you;
- You have entered the information into our website and the information has been transmitted from your server to our server using systems based outside of the EEA;
- We have entered into an appropriate contract protecting your rights and freedoms, which is enforceable by you or the data protection authorities; or
- We have obtained your explicit consent.
Generally, we do not expect that your personal data will be transferred outside of the EEA.
How long do you keep my personal data?
We will generally store the personal data that we hold in relation to you, for the duration of our relationship with you unless a longer retention period is permitted. We will store personal data in accordance with our data retention policy and procedures.
What are my personal data rights?
- You have a right to obtain from Cornerstone CIC confirmation as to whether or not your personal data is being processed and, if your personal data is being processed by Cornerstone CIC, to access your personal data.
- This is usually referred to as a Subject Access Request (SAR).
- To invoke this right you can email dpo@cornerstonecic.co.uk, or write to The Data Protection Officer, Cornerstone CIC, Cornerstone House, Unit B, 31-33 High Street, Bargoed CF81 8RW.
- You have the right to access your personal data from Cornerstone CIC via a Subject Access Request (SAR) as above.
- Please note that we will not provide any personal data to you until you have provided evidence to us to establish your identity. This may include a copy of your passport or other identification document.
- We will only provide information to you at an address which we have verified as belonging to you.
- You have a right to rectification of any inaccurate personal data which we process about you, or where personal data is completed to have the information completed.
- To obtain rectification or completion of your personal data you will need to provide the correct information to Cornerstone CIC, an explanation of why you believe the information is inaccurate would also be of assistance.
- You are entitled to have Cornerstone CIC erase certain personal data relating to you, on certain grounds. Where you wish to exercise your right of personal data erasure, please contact the Data Protection Officer setting out the grounds under which you would like the personal data Cornerstone CIC holds about you erased.
- Certain grounds apply when we need to use legal, contract or vital interests as lawful bases for processing your data.
- Where certain grounds apply you will be entitled to have Cornerstone CIC restrict the processing of certain personal data relating to you.
- Where you wish to exercise your right to restrict processing, please contact the Data Protection Officer setting out the grounds under which you would like the personal data Cornerstone CIC holds about you restricted.
- You have the right to object to your information being processed, for example, for automated decision making, direct marketing and profiling activities.
- You have the right to data portability – that is – you can ask us to transfer your personal data electronically, to another organisation but only in certain circumstances. Those circumstances include where the lawful basis for processing your data includes contract, legal or vital interests.
- If you have any queries or concerns on any data protection related issue, please contact dpo@cornerstonecic.co.uk where the officer will be happy to help.
How do I complain?
If you have any complaint(s) about the processing of your personal data undertaken by Cornerstone CIC, please contact our Data Protection Officer (DPO).
Please note that you also have a right to lodge a complaint about the processing of your personal data by Cornerstone CIC by contacting the Information Commissioner’s Office of Wales (ICO).
The ICO can be contacted at: Information Commissioner’s Office – Wales, 2nd Floor, Churchill House, Churchill Way, Cardiff, CF10 2HH.
Phone: 0330 414 6421 or 029 2067 8400
Email: wales@ico.org.uk
Third party websites
Our website may include hyperlinks to, and details of, third party websites.
We have no control over, and are not responsible for, the privacy policies and practices of third parties.
