Your Privacy Matters To Us
Below you'll find the full BPRCVS Privacy Policy for your consideration.
This privacy policy tells you what to expect BPRCVS to do with your personal data when you make contact with us or use one of our services/projects.
We’ll tell you:
BPRCVS is the controller for the personal information we process, unless otherwise stated.
There are many ways you can contact us, including by phone, email and post.
Our postal address: The CVS Centre, 62-64 Yorkshire Street, Burnley, Lancashire, BB11 3BT
Phone number: 01282 433740
Email address: info@bprcvs.co.uk
Most of the personal data, special category data and children’s data we process is provided to us directly by you for one of the following reasons:
We also receive personal data indirectly, in the following scenarios:
If it is not disproportionate or prejudicial, we’ll contact you to let you know we are processing your personal data.
Data Subject Rights - Under GDPR you have rights we need to make you aware of. The rights available to you depend on our reason for processing your information.
Your Right Of Access - You have the right to ask us for copies of your personal information. This right always applies. There are some exemptions, which means you may not always receive all the information we process. You can read more about this right here.
Your Right To Rectification - You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies. You can read more about this right here.
Your Right To Erasure - You have the right to ask us to erase your personal information in certain circumstances. You can read more about this right here.
Your Right To Restriction Of Processing - You have the right to ask us to restrict the processing of your information in certain circumstances. You can read more about this right here.
Your Right To Object To Processing - You have the right to object to processing if we are able to process your information because the process forms part of our public tasks, or is in our legitimate interests. You can read more about this right here.
Your Right To Data Portability - This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another, or give it to you. The right only applies if we are processing information based on your consent or under, or in talks about entering into a contract and the processing is automated. You can read more about this right here.
You are not required to pay any charge for exercising your rights. We have one month to respond to you.
The current practices undertaken by BPRCVS where your personal data may be collected, processed or affected or described in the following pages.
For each project, service and data collection channel we have described in detail the purpose for BPRCVS collecting and storing data, the lawful processing basis determined by BPRCVS, what data is stored, who holds the data and who can access it, how we keep your data safe, how long you can expect us to keep your data, and when and how the data is removed and destroyed.
Website
Purpose For Collecting & Storing Data
We collect and store cookie data from visitors to www.bprcvs.co.uk. This is for the purpose of improving the website by monitoring how you use it.
Basis For Processing Data
Upon visiting the website for the first time you agreed to the cookie policy of BPRCVS. By clicking ‘Ok’ you consented to BPRCVS collecting and storing cookie information.
What Data Do We Store
BPRCVS stores your IP address and details of which version of web browser you used. We also store information on how you use the site, using cookies and page tagging techniques to help us improve the website.
Who Holds The Data
The data is held on secure servers in an off-site location by Host Media Ltd., our webhosting company. On occasion whereby the data has been processed for the purposes of performance analysis the data can be held by BPRCVS on our local secure server. Host Media Ltd. are the data controller.
Who Can Access The Data
BPRCVS and Host Media Ltd. can access the data stored on secure servers.
Data Security
All personal cookie data is stored safely on secure servers in an off-site location. Read the BPRCVS Cookie Policy to see how BPRCVS processes your cookies in more detail.
https://bprcvs.co.uk/cookie-policy.html
How Long Is Data Stored For
BPRCVS stores this data securely for 12 months.
When & How Is The Data Removed & Destroyed
BPRCVS don’t remove or destroy this information unless specifically requested to do so by the Data Subject.
…………………………………………………………………
Email Marketing
Purpose For Collecting & Storing Data
We collect and store personal data for the purpose of communicating with our clients, colleagues, members of the community and external organisations via email.
Basis For Processing Data
The lawful basis for processing data for the purpose of email marketing is consent for which you have completed a double opt in procedure.
What Data Do We Store
For the purpose of sending email newsletters and other email communications via MailChimp (Intuit) we store the following personal data:
Email Address*, Name, Organisation Name, and Region.
*This is the only piece of mandatory data required, all other data is optional and provided at the data subjects discretion.
Who Holds The Data
Intuit is the data controller and BPRCVS is the data processor. You can view Intuit's privacy policy here to see how they process your data: https://www.intuit.com/privacy/statement/
Who Can Access The Data
BPRCVS and Intuit can access the data provided when you subscribed to receive any of the BPRCVS email newsletters.
Data Security
All personal data is stored safely and securely on Intuit's servers.
How Long Is Data Stored For
Data is stored for as long you remain an active subscriber to BPRCVS newsletters.
When & How Is The Data Removed & Destroyed
You are in full control of the data stored. You can access your MailChimp account settings to amend your data and preferences at any time. You can also choose to unsubscribe at any time.
When you choose to unsubscribe, your data is removed from Intuit's servers.
…………………………………………………………………
Social Media
Purpose For Collecting & Storing Data
For the purpose of communicating via social media platforms personal data is stored.
Basis For Processing Data
The lawful basis for processing data associated with social media is consent given by the individual when signing up to each respective social media platform.
What Data Do We Store
BPRCVS does not store any data in relation to your social media accounts and activity.
Who Holds The Data
Facebook, X (formerly known as Twitter) and YouTube are the data controllers.
View the Facebook privacy policy here: https://www.facebook.com/privacy/policy/version/25238980265745528
View the X privacy policy here: https://x.com/en/privacy
View the YouTube privacy policy here: https://www.youtube.com/intl/ALL_uk/howyoutubeworks/our-commitments/protecting-user-data/
Who Can Access The Data
BPRCVS cannot access your personal data. See each respective privacy policy to find out who can access your data.
Data Security
Your personal data is stored safely and securely on each respective social media platform’s server.
How Long Is Data Stored For
See the respective privacy policies to find out how long each platform stores your data for.
When & How Is The Data Removed & Destroyed
See the respective privacy policies to find out how and when each platform removes and destroys your data.
…………………………………………………………………
Training
Purpose For Collecting & Storing Data
BPRCVS collects personal data for the purpose of recording attendees and contacting them in case of cancellations or if there’s a change of which attendees need to be notified.
We also record this data for the purpose of reporting outcomes to our funders.
Basis For Processing Data
The lawful basis for processing your personal data in regard to training events with BPRCVS is contractual agreement.
What Data Do We Store
We store the following personal data: Name, organisation/group name, phone number, email address and attendance status.
BPRCVS also keeps a copy of the attendance sheet used when signing into the training event.
Evaluation forms completed at the conclusion of training contains no personal data or any means to identify a particular individual and therefore are exempt from GDPR.
Who Holds The Data
Only BPRCVS holds this data as the data controller.
Who Can Access The Data
The BPRCVS training coordinator only.
The information sent to funders when reporting contains no identifying data of individuals who attended training events with BPRCVS, nor is the data pseudonymised or an alias created from which a data subject could be identified.
Data Security
When you make a booking your personal data is stored in an appropriate electronic system.
The attendance sheet is stored in a secure, locked office.
How Long Is Data Stored For
We receive funding to deliver training to community groups and voluntary organisations in our localities. Data is stored for as long as our funder requires which is 7 years.
When & How Is The Data Removed & Destroyed
After the 7 years storage requirement as set by our funders has expired all records are removed from electronic systems and paper copies are wasted confidentially.
…………………………………………………………………
Social Prescribing Programmes
Social Prescribing Clients
Purpose For Collecting & Storing Data
BPRCVS' Social Prescribing Team uses a Referral Form and an Initial Assessment Form to collect personal data and special category data which determines a client’s suitability for the programme and enables BPRCVS Link Workers to deliver to clients.
Basis For Processing Data
The lawful basis for processing this data is consent which was obtained at the referral stage of the programme’s process.
What Data Do We Store
We collect and store the following personal data and special category data for Social Prescribing clients:
Referral Form
Date Of Referral, Referral Via, Name, Address, Telephone Number, Gender, Ethnicity, GP Name & Practice, NHS Number, Preferred Language, Date Of Birth, Lives With Status, National Data Opt Out Status (NDOO), Reason(s) For Referral, Next Of Kin Emergency Contact Details, Referrer's Contact Details, Safe To Visit Alone Status, and Risk Of Infection Status.
Initial Assessment Form
Name, Date Of Birth, Gender, Email Address, Family & Friends Support Information, Living Arrangements, Health Information, and Hobbies & Interests.
Case Studies
Background information on the case and outcomes achieved. Anonymised data is explicitly used in this instance with all identifiable data removed.
'My Story' Consent Form
Name, Address, Postcode, Date Of Birth, Signature, Signature Date, and Agencies With Whom Not To Share.
'My Story' Video Consent Form
Name, Address, Postcode, Date Of Birth, Signature, Signature Date, and Agencies With Whom Not To Share.
Who Holds The Data
Personal data will be stored on your GP surgery's EMIS system, and the surgery will be the data controller and BPRCVS the processor appointed on behalf of the surgery.
BPRCVS also store personal data on AideCRM for which BPRCVS is the data controller.
Who Can Access The Data
Social Prescribing staff can access the data. Some data is shared with Lancashire & South Cumbria Integrated Care Board (LSC ICB) as they fund the project.
GP surgeries and their staff can access any data updated on the EMIS system by Link Workers.
If a client was to move from the Burnley, Pendle or Rossendale localities into Hyndburn or Ribble Valley localities the client’ file would be transferred over to Hyndburn & Ribble Valley CVS if the client wished to remain a participant of the project.
All BPRCVS staff have access to staff calendars and therefore basic contact information of Social Prescribing clients.
Case studies are provided to funders and members of the Primary Care Networks and also shared within the public domain occasionally to help promote the service. Only anonymised data is used, and no personable identifiable data is published to protect clients' identities.
Data Security
Personal data is stored safely and securely by BPRCVS in electronic systems.
Data is extrapolated from the referral form and stored in secure data systems. These are saved on secure, off-site servers which is backed up daily.
Referral forms are stored in Outlook on a secure, off-site exchange server. Outlook calendars contain basic contact details of clients.
As Connectors/Link Workers are outreach workers conducting home visits for example, it is necessary for them to carry either a client’s case file or contact details to deliver the Social Prescribing service. When necessary these files will be kept in a secure location and removed and restored upon completion of use.
How Long Is Data Stored For
BPRCVS are required to keep all data from the Social Prescribing project for a maximum of 5 years in line with Lancashire & South Cumbria Integrated Care Board (LSC ICB) requirements.
Identifiable personal data is stored for up to 2 years.
When & How Is The Data Removed & Destroyed
After a period of 2 years all personal, identifiable data is removed and destroyed.
Upon the conclusion of the funder’s storage requirement all client data is removed from all electronic systems and any paper copies are confidentially wasted.
Social Prescribing for Children & Young People
Purpose For Collecting & Storing Data
BPRCVS' Social Prescribing Team uses a Referral Form and an Initial Assessment Form to collect personal data and special category data which determines a client’s suitability for the programme and enables BPRCVS Link Workers to deliver to clients.
Basis For Processing Data
The lawful basis for processing this data is consent which was obtained at the referral stage of the programme’s process.
What Data Do We Store
We collect and store the following personal data and special category data for Social Prescribing clients:
Referral Form
Date of Referral, Referral Via, Child’s Name, Child’s Date of Birth, Child’s Address, Gender Assigned At Birth, Gender Identity, GP Name, GP Practice, NHS Number, EMIS Reference, Preferred Language, Ethnicity, Health Issues, School Name, School Contact Name, School Contact Number, School Contact Email, Reasons For Referral, Parent/Guardian Name, Parent/Guardian Date of Birth, Parent/Guardian Address, Parent/Guardian Relationship, Parent/Guardian Health Issues, Parent/Guardian Preferred Language, Other Household Members Details (Name, Age and Relationship), Referrer’s Name, Referring Agency/Organisation, Referrer’s Number, Referrer’s Email, Safe To Visit, Infection Risks, and Additional Relevant Information.
Young Person’s Initial Assessment Form
Name of Worker, Initial Assessment Venue, Date of Initial Assessment, Young Person’s Name, Young Person's Date of Birth, School/College, Teacher’s Name, Teacher’s Contact Number, Young Person’s Interests, Clubs Accessed, Current Support Received, Support Required, Friends & Family Information, Feelings About School/College, School/College Attendance, and School/College Support.
Parent/Guardian Initial Assessment & Consent Form
Child’s Name, Child’s Address, Child’s Ethnic Origin, Child’s Date Of Birth, Emergency Contact Number, Child’s Allergy Information, Child’s Dietary Requirements, Child’s Medical Conditions, Child’s Medication, Consent To Emergency Medical Treatment, Name Of Child’s GP, GP Telephone Number, Swimming Information, Child’s Needs & Limitations, Photographic Consent, Parent/Guardian Name, Parent/Guardian Address, Parent/Guardian Email, Family Structure, Other Agencies Supporting The Family, Friends & Family Support, Child’s Education, Child’s Interests, Support Needs, and Consent.
Photo Consent
Parental/Guardian Consent, Child’s Name, Child’s Address, Child’s Phone Number, Child’s Date Of Birth, and Name Of Parent/Guardian.
Who Holds The Data
Personal data will be stored on your GP surgery's EMIS system, and the surgery will be the data controller and BPRCVS the processor appointed on behalf of the surgery.
BPRCVS also store personal data on AideCRM for which BPRCVS is the data controller.
Who Can Access The Data
Social Prescribing and Health & Wellbeing for Children & Families staff can access the data. Some data is shared with Lancashire & South Cumbria Integrated Care Board (LSC ICB) as they fund the project.
GP surgeries and their staff can access any data updated on the EMIS system by Link Workers.
All BPRCVS staff have access to staff calendars and therefore basic contact information of Social Prescribing clients.
Case studies are provided to funders and members of the Primary Care Networks and also shared within the public domain occasionally to help promote the service. Only anonymised data is used, and no personable identifiable data is published to protect clients' identities.
Data Security
Personal data is stored safely and securely by BPRCVS in electronic systems.
Data is extrapolated from the referral form and stored in secure online data systems. These are saved on secure, off-site servers which are backed up daily.
Referral forms are stored in Outlook on a secure, off-site exchange server. Outlook calendars contain basic contact details of clients.
As Connectors/Link Workers are outreach workers conducting home visits for example, it is necessary for them to carry either a client’s case file or contact details to deliver the Social Prescribing service. When necessary these files will be kept in a secure location and removed and restored upon completion of use.
How Long Is Data Stored For
BPRCVS are required to keep all data from the Social Prescribing project for a maximum of 5 years in line with Lancashire & South Cumbria Integrated Care Board (LSC ICB) requirements.
Identifiable personal data is stored for up to 2 years.
When & How Is The Data Removed & Destroyed
After a period of 2 years all personal, identifiable data is removed and destroyed.
Upon the conclusion of the funder’s storage requirement all client data is removed from all electronic systems and any paper copies are confidentially wasted.
Back On Track - Social Prescribing Volunteers
Purpose For Collecting & Storing Data
BPRCVS collects and stores personal and special category data for the purpose of matching volunteers to clients, arranging appointments and so that staff have the means to contact volunteers. Furthermore, we also collect next of kin data for the purpose of having a recognised emergency contact.
Basis For Processing Data
As a volunteer you agreed to the processing of personal and special category data by way of consent given when signing a declaration on the Volunteer Application Form.
What Data Do We Store
For volunteers to become a member of the Social Prescribing Team, BPRCVS collects and stores the following personal data:
Volunteer Application Form
Name, Address, Postcode, Telephone Number, Email Address, Date Of Birth, Volunteer Locality, Disability Status, National Insurance Number, Driver Status, Access To Car, Employment Status, Education Status, DBS Status, References Information, Days Of Availability, Details Of Convictions (Spent & Unspent) and Next Of Kin Emergency Contact Details.
Who Holds The Data
Only BPRCVS holds this data as the data processor.
Who Can Access The Data
Only BPRCVS Social Prescribing staff and the Back On Track coordinator have access to paper copies on file.
All BPRCVS staff with database access can access your personal data.
All BPRCVS staff may have access to your contact details if stored in Outlook calendars for the purpose of appointment management.
Data Security
Personal data is stored safely and securely on file in a locked filing cabinet within a locked office.
Data is extrapolated from the form/email and stored in a Microsoft Excel file to store electronic records of data. This is saved on a secure, on-site server which is backed up daily.
Forms returned via email are stored in Outlook on a secure, off-site exchange server. Outlook calendars contain basic contact details of volunteers.
How Long Is Data Stored For
For as long as you volunteer with the project and for a maximum of 7 years in line with Lancashire & South Cumbria Integrated Care Board (LSC ICB) requirements.
When & How Is The Data Removed & Destroyed
Paper files are confidentially wasted, and electronic records are deleted after 7 years.
…………………………………………………………………
DBS
Purpose For Collecting & Storing Data
BPRCVS is a DBS registered body which means we can process DBS applications on behalf of other groups and organisations. Therefore, we need to collect and store data in order to process DBS applications.
We use up to three forms to facilitate this operation: DBS Registration & Confidentiality Form; DBS Contract; and External ID Validation Check Consent Form.
Furthermore, we need to store this data for the issuing of invoices for payment of using the DBS service.
BPRCVS also stores completed DBS Applications Forms along with the Documentary Evidence Sheet and External ID Validation Check Consent Form. The purpose for this is in the instance of errors occurring so that such errors can be double checked. An External ID Validation Check can be used to validate the ID of a DBS applicant via Route 2 if that person does not have sufficient ID to validate their ID through Route 1 of the DBS identity verification process.
Basis For Processing Data
The lawful basis for processing this data is a contractual agreement within which you agree to the terms and conditions of BPRCVS in regard to processing DBS applications.
What Data Do We Store
For the purpose of delivering this service we use a number of forms which collect personal and special category data:
DBS Registration Form (Inside BPR)
Group/Organisation Name, Telephone Number, Email Address, Nominated DBS Contact Information, Address, and Contact Preferences.
DBS Registration Form (Outside BPR)
Group/Organisation Name, Telephone Number, Email Address, Nominated DBS Contact Information, Address, Registered Charity Number, Company Number, Number Of Staff, Number Of Volunteers, and Contact Preferences.
DBS Contract
The names of authorised signatories only.
DBS Applications
Name, Previous Names, Current Address, Other Addresses, Date Of Birth, Place Of Birth, Gender, National Insurance Number, Driving Licence Number, Passport Number, Telephone Number, and Email Address.
For the purpose of delivering this service we may be required to undertake an external ID validation check using a third-party provider.
To facilitate this check we use two forms which collect personal and special category data:
External ID Validation Check Form
Name, Gender, Title, Date Of Birth, Address, Date Lived At Current Address From.
External ID Validation Check Consent Form
Full Current Name, and Date Of Birth.
Who Holds The Data
Only BPRCVS holds the data from the DBS Registration & Confidentiality Form and the DBS Contract.
BPRCVS and the DBS hold data from the DBS Application Form. DBS are the data controller and BPRCVS the data processor.
View the DBS privacy policy here: https://www.gov.uk/government/publications/dbs-privacy-policies
BPRCVS and Mayflower Disclosure Services Ltd hold data from the External ID Validation Check. Mayflower Disclosure Services Ltd are the data controller and BPRCVS the data processor.
View the Mayflower Disclosure Services Ltd privacy policy here: http://dbsdirect.co.uk/privacy-policy.php
Who Can Access The Data
Only three members of BPRCVS staff responsible for processing DBS applications and services can access this data.
Please refer to the respective privacy policies of DBS and Mayflower Disclosure Services Ltd to see who can access the data each holds.
Data Security
All data obtained relating to DBS is stored safely and securely on file in a locked office.
All data is shared with Mayflower Disclosure Services Ltd via secure password protected online forms.
How Long Is Data Stored For
Copies of submitted DBS Application Forms are stored for up to 6 months after submission.
All other DBS related data is stored for as long as the group or organisation uses the DBS service.
When & How Is The Data Removed & Destroyed
Copies of DBS Application Forms are destroyed after 6 months via secure confidential shredding services.
All data is stored for as long as you use the DBS service.
We will conduct an audit on an annual basis to determine whether any organisations no longer wish to use the DBS service at which point all files and records will be deleted and confidentially wasted.
All copies of DBS Application Forms are confidentially wasted at the end of the 6-month storage policy.
Mayflower Disclosure Services Ltd store External ID Validation Check data only for as long as it requires it to fulfil their service – refer to their privacy policy.
…………………………………………………………………
Volunteering for Wellbeing & Community Hub (from June 2023)
Volunteer Brokerage Services
Purpose For Collecting & Storing Data
BPRCVS’ Volunteering for Wellbeing & Community Hub requires the collection of relevant data to deliver our volunteer brokerage services and assist with the recruitment of volunteers, and the promotion of voluntary opportunities.
Basis For Processing Data
The lawful basis for processing this data is consent which is obtained upon completing the Volunteer Brokerage Initial Enquiry Form.
What Data Do We Store
For BPRCVS to effectively operate the Hub’s services in relation to volunteer brokerage, we need to collect and store the following data:
Volunteer Brokerage Initial Enquiry Form
Volunteer Coordinator Name, Contact Number, Email, Organisation/Group Name, Address, Organisation/Group Number (if different), Organisation/Group Email (if different), Operational Locality, Volunteer Role Title, Role Description, DBS Requirements, Driving Requirements, English As First Language Requirements, Access To Own Vehicle, Support Needs, and Any Other Information.
Volunteer Enquiry Form
Name, Gender, Date of Birth, Postcode, Phone, Email, Driving Licence, CVS/Gannow Role Applied For, Other Opportunities, Consent, and Date.
Volunteer Application Form
Name, Gender, Date of Birth, Address, Phone, Email, Driving Licence, Access To Car, Employment Status, Education Status, DBS, DBS Number, Disability/Illness/Condition Information, Name of Referee, Referee Email, Referee Phone, Referee Relationship, Organisation Applied To, Role Applied For, Locality, Day & Time Availability, Most Recent Employer Name, Employer’s Address, Role, Date Started, Date Finished, Reason For Leaving, Conviction Status, Where You Heard About BPRCVS, Emergency Contact Name, Emergency Contact Phone, Emergency Contact Email, Emergency Contact Relationship, Any Further Information, and Date.
Volunteer Reference Form
Referee’s Name, Volunteer’s Name, Voluntary Role, Length Of Time Knowing The Volunteer, In What Capacity They Are Known, Personal Attributes, and Personal Characteristics.
Volunteer & Brokerage Feedback Form
Group/Organisation Name, Project Name, Period Of Support, Support Received, Volunteer Questionnaire Responses, and Brokerage Questionnaire Responses.
Photograph, Video & Case Study Consent Form
Name, Date, and Any Agencies Not To Share Information With.
Who Holds The Data
Only BPRCVS holds this data as the data controller.
Who Can Access The Data
Only BPRCVS staff can access the data.
Data Security
Forms returned via email are stored securely in Outlook on a secure, off-site Exchange server.
Data extrapolated from forms is stored in AideCRM which is a secure online database hosted off-site on a secure server.
How Long Is Data Stored For
Data will be stored for 7 years in line with funder’s requirements.
The exception to this is any volunteer who is no longer active in their role, or never became active within 12 months. If the former, upon confirmation of no longer being active, your personal data will be removed at that point, and if the latter, all personal data will be removed from all systems upon the conclusion of 12 months of inactivity.
Active volunteers will have their personal data stored for as long as they remain active volunteers and therefore could exceed the 7-year retention period.
When & How Is The Data Removed & Destroyed
Upon conclusion of the funder’s storage requirements, or when a volunteer becomes inactive all personal data is removed from electronic systems and any paper copies are securely destroyed using confidential waste.
If a volunteer registered with the Hub never becomes active, after 12 months all data is removed from electronic systems and any paper copies are securely destroyed using confidential waste.
Volunteer Centre (old)
Organisation Registration
Purpose For Collecting & Storing Data
BPRCVS collect and store data from organisations who wish to register with the BPRCVS Volunteer Centre for the purpose of promoting voluntary opportunities and recruiting volunteers.
Basis For Processing Data
Consent was given by completing a form and signing a declaration to allow BPRCVS to collect and store the data provided for the purposes of volunteering brokerage.
What Data Do We Store
For BPRCVS to effectively run the Volunteer Centre services we collect and store the following information:
Volunteer Centre Organisation Registration Form
Organisation/Group Name, Contact Name, Telephone Numbers, Email Address, Address, Website, Mission Statement, Aims Of Organisation, Volunteer Policy, Equal Opportunities Policy, Health & Safety Policy, and Public Liability Insurance.
Volunteer Centre Vacancy Info Sheet
Volunteer Vacancy, Organisation/Group Name, Address, Days & Hours Required, Volunteer Duties, Training Requirements, Preferred Skills, Qualities & Experience, Contact Person Name, Contact Telephone Number, Contact Email Address, Other Useful Information, and Additional Information.
Who Holds The Data
BPRCVS and the Do-it Trust hold this data. Do-it Trust are the data controller and BPRCVS the data processor.
Read the Do-it privacy policy to see how they process your data: https://do-it.org/about/privacypolicy
Who Can Access The Data
BPRCVS Volunteer Centre staff and Do-it have access to the data.
Data Security
The data provided from the Organisation Registration Form and Vacancy Info Sheet is stored in Outlook which is securely installed on on-site servers.
This data is also stored on the Do-it website and in the V Base database. Do-it stores data safely and securely on their own servers and the V Base database is stored safely and securely on BPRCVS on-site servers.
Any paper copies of forms not yet processed are stored securely in a locked filing cabinet in a locked office.
How Long Is Data Stored For
Forms returned via email and stored in Outlook are only kept for as long as the organisation remains active.
Data is stored on Do-it and in the V Base database and is publicly available for as long the opportunities remain active. When opportunities are no longer available they are marked as inactive and therefore are no longer visible publicly. Such data is stored until an audit is undertaken to determine which data needs to be removed. An audit is undertaken annually.
When & How Is The Data Removed & Destroyed
Paper copies are confidentially wasted when the data has been processed.
Emails stored in Outlook are deleted when the audit has been completed providing there are no remaining opportunities listed as active.
Data stored on Do-it and in the V Base database is removed upon completion of the annual audit providing there are no active opportunities.
Application Form
Purpose For Collecting & Storing Data
BPRCVS collect and store personal data and special category data from individuals who wish to register with the BPRCVS Volunteer Centre for the purpose of volunteering.
Basis For Processing Data
Consent was given by completing a form and signing a declaration to allow BPRCVS to collect and store the data provided for the purposes of volunteer recruitment.
What Data Do We Store
For BPRCVS to effectively arrange suitable voluntary positions for you we need to collect and store the following information:
Name, Address, Postcode, Telephone Number, Email Address, Date Of Birth, Volunteer Locality, Disability Status, National Insurance Number, Driver Status, Access To Car, Employment Status, Education Status, DBS Status, References Information, Days Of Availability, Details Of Convictions (Spent & Unspent) and Next Of Kin Emergency Contact Details.
Who Holds The Data
BPRCVS and V Base Cloud produced and supported by Veda NFP Consulting Ltd on behalf of Do-it Trust hold this data. Do-it Trust are the data controller and BPRCVS the data processor.
Read the Do-it privacy policy to see how they process your data: https://do-it.org/about/privacypolicy
Who Can Access The Data
BPRCVS Volunteer Centre staff and Do-it have access to the data.
Suitable voluntary groups/organisations will be given your personal data for the express purpose of contacting you in relation to their voluntary positions.
Data Security
Application Forms are stored in a locked filing cabinet within a locked office.
The V Base Cloud is hosted on secure servers off-site.
How Long Is Data Stored For
BPRCVS store volunteer application forms for as long as a volunteer remains interested in volunteering. BPRCVS will conduct an audit at least once annually to ensure volunteers wish to remain on our database for future opportunities and openings.
When & How Is The Data Removed & Destroyed
Upon completion of volunteering your data is removed from all electronic systems and any paper copies are confidentially wasted.
…………………………………………………………………
Strengthening Communities – Volunteering In Lancashire (SCVL)
Purpose For Collecting & Storing Data
This project uses a variety of documents to collect and store data necessary for the running of the project. The purpose of these documents is to determine involvement with the project; to enter participants into the project; to monitor and provide support to participants; to record participant progress; and to record participant wellbeing.
Basis For Processing Data
Consent is given by you when joining the project by completing and signing a declaration giving permission to collect and store the required data for the purpose of the SCVL project.
What Data Do We Store
This project uses a number of different forms to collect personal data that we are required by our funder to store for processing.
Participant Entry Form
Full Name, National Insurance Number, Participant Reference Number, Project Start Date, Referral Information, Additional Information, Gender, Date Of Birth, Address, Telephone Numbers, Email Address, Ethnicity, Eligibility, Employment Status, Benefits Information, Qualifications, Housing Information, Parenting Information, Offender Information, and Health Information.
Basic Engagement Form
Full Name, National Insurance Number, Date Of Birth, Address, Telephone Numbers, Email Address, Ethnicity, Support Needed Information, and Circle Of Support Scores.
Circle Of Support Action Plan
Full Name, Circle Of Support Scores, Action Plan, and Additional Case Notes.
Ways To Wellbeing Survey
Full Name, Date Of Birth, VIEWS Reference Number, GP Surgery, Medical Appointment History, and Wellbeing Information.
Participant Exit Form
Full Name, National Insurance Number, Participant Reference Number, Project Leaving Date, Achievements, Education/Training Information, Employment Information, Qualifications, Job Search Information, Employment Status, and Feedback.
Who Holds The Data
BPRCVS and Views hold the data for participants involved in the project. Views are the data controller and BPRCVS are the data processor.
Who Can Access The Data
BPRCVS, Views and Community CVS can access the data through the shared cloud portal.
Data Security
All data contained in paper records are stored safely and securely in lockable BPRCVS file storage within a locked office.
We use Views CRM Database to store electronic records of data. This is a secure cloud-based database hosted on secure, off-site servers.
How Long Is Data Stored For
All data collected, stored and processed for the SCVL project is stored for as long as the funder requires it. This is 11 years after the project end date.
When & How Is The Data Removed & Destroyed
Upon completion of the funder’s storage requirements all electronic records are to be deleted and all paper files are to be confidentially wasted.
…………………………………………………………………
Group Support
Purpose For Collecting & Storing Data
In order for BPRCVS to support groups and organisations effectively we need to collect and store some personal data from each respective group or organisation.
Basis For Processing Data
Where personal data is stored, consent is sought and given by completing and signing a consent form.
We may also store other groups and organisations in our database if they are publicly listed or having removed all personal data from the record.
What Data Do We Store
We typically collect and store the following data: Group/Organisation Name, Contact Name, Contact Email, Contact Telephone Number, Address, Area Of Operation, Registered Charity Number, Company Number, Number Of Volunteers & Hours, Number Of Staff, and Who The Group/Organisation Works With.
Additionally for the purposes of internal monitoring we record activities undertaken with a group or organisation by a given member of staff.
Who Holds The Data
Only BPRCVS holds this data as the data controller.
Who Can Access The Data
All BPRCVS staff can access an organisation’s or group’s data.
Data Security
We use a safe and secure CRM database to store all data. Any paper copies are stored safely and securely in a locked drawer or filing cabinet in a locked office.
Data is extrapolated from the form/email and stored in AideCRM to store electronic records of data. This is saved on a secure, on-site server which is backed up daily.
Forms returned via email are stored in Outlook on a secure, off-site exchange server.
How Long Is Data Stored For
The data is stored for up to 7 years in line with our funder’s requirements.
When & How Is The Data Removed & Destroyed
After 7 years has expired all electronic and paper records will be permanently deleted and all paper copies confidentially wasted unless ongoing support is still being provided and such documents hold relevance.
…………………………………………………………………
Health & Wellbeing For Children & Families
Purpose For Collecting & Storing Data
BPRCVS must collect and store personal and special category data about children, parents/guardians and families to register children onto the Health & Wellbeing For Children & Families project.
Basis For Processing Data
The lawful basis for processing this data is consent which was obtained at the referral stage of the project.
What Data Do We Store
The Health & Wellbeing For Children & Families project stores a range of data and collects this data via a number of different forms.
Referral Form (old)
Referrer’s Name, Referrer’s Address, Referrer’s Contact Numbers, Referrer’s Email Address, Child’s Name, Child’s Address, Child’s Phone Number, Child’s Email Address, Child’s Date Of Birth, Care Receiver’s Name, Care Receiver’s Date Of Birth, Care Receiver’s Relationship, Care Receiver’s Care Situation, Ethnicity, School Contact Information, Other Household Member’s Name, Other Household Member’s Relationship, Other Household Member’s Date Of Birth, and Tasks Carried Out By Young Carer.
Referral Form (from May 2024)
Date of Referral, Referral Via, Child’s Name, Child’s Date of Birth, Child’s Address, Gender Assigned At Birth, Gender Identity, GP Name, GP Practice, NHS Number, EMIS Reference, Preferred Language, Ethnicity, Health Issues, School Name, School Contact Name, School Contact Number, School Contact Email, Reasons For Referral, Parent/Guardian Name, Parent/Guardian Date of Birth, Parent/Guardian Address, Parent/Guardian Relationship, Parent/Guardian Health Issues, Parent/Guardian Preferred Language, Other Household Members Details (Name, Age and Relationship), Referrer’s Name, Referring Agency/Organisation, Referrer’s Number, Referrer’s Email, Safe To Visit, Infection Risks, and Additional Relevant Information.
Initial Assessment Form (old)
Child’s Name, Child’s Phone Number, Child’s Email Address, Name Of Person Cared For, Health Condition Of Cared For Person, Names Of Other Household Members, Age Of Other Household Members, Relationship To Other Household Members, Names Of Other Care Providers, Caring Jobs Completed, Family/Friends Information, School/College Information, and Further Referrals Needed.
Parent/Guardian Information Form (old)
Parent/Guardian Name, Parent/Guardian Address, Parent/Guardian Date Of Birth, Parent/Guardian Diagnosis, Names Of Other Family Members, Date Of Birth Of Other Family Members, Relationship To Other Family Members, Contact Details Of Other Professional Agencies, Friends & Family Support Information, Child’s Caring Role, Child’s Health Information, Child’s Education Information, Child’s Interests & Hobbies, Parental/Guardian Consent, Ethnic Origin, and Preferred Language/Means Of Communication.
Young Person’s Initial Assessment Form (from May 2024)
Name of Worker, Initial Assessment Venue, Date of Initial Assessment, Young Person’s Name, Young Person's Date of Birth, School/College, Teacher’s Name, Teacher’s Contact Number, Young Person’s Interests, Clubs Accessed, Current Support Received, Support Required, Friends & Family Information, Feelings About School/College, School/College Attendance, and School/College Support.
Parent/Guardian Initial Assessment & Consent Form (from May 2024)
Child’s Name, Child’s Address, Child’s Ethnic Origin, Child’s Date Of Birth, Emergency Contact Number, Child’s Allergy Information, Child’s Dietary Requirements, Child’s Medical Conditions, Child’s Medication, Consent To Emergency Medical Treatment, Name Of Child’s GP, GP Telephone Number, Swimming Information, Child’s Needs & Limitations, Photographic Consent, Parent/Guardian Name, Parent/Guardian Address, Parent/Guardian Email, Family Structure, Other Agencies Supporting The Family, Friends & Family Support, Child’s Education, Child’s Interests, Support Needs, and Consent.
Photo Consent
Parental/Guardian Consent, Child’s Name, Child’s Address, Child’s Phone Number, Child’s Date Of Birth, and Name Of Parent/Guardian.
Who Holds The Data
BPRCVS holds this data as the data controller.
Who Can Access The Data
Only BPRCVS Health & Wellbeing For Children & Families project staff have access to this data.
Data Security
All paper copies of files, forms and records are stored safely and securely in a locked filing cabinet within a locked office.
All electronic records are stored in our AideCRM database which is saved on a secure off-site server.
How Long Is Data Stored For
All data is stored for as long as a young person is an active project participant and in line with our funder’s requirement which is 5 years.
When & How Is The Data Removed & Destroyed
Upon exiting from the project all electronic records are deleted and paper copies are archived in file storage. After the conclusion of the funder’s storage requirements all paper records are then confidentially wasted.
…………………………………………………………………
Young Carers/We Count/Female Empowerment Project (FEP)
Purpose For Collecting & Storing Data
BPRCVS must collect and store personal and special category data about children, parents/guardians and families to register children onto the Young Carers project.
Basis For Processing Data
The lawful basis for processing the majority of this data is the contractual agreement to which was entered when registering for the project.
However, upon initial assessment and discussions with parents/guardians consent is sought in the initial instance.
What Data Do We Store
The Young Carers project stores a range of data and collects this data via a number of different forms.
Referral Form
Referrer’s Name, Referrer’s Address, Referrer’s Contact Numbers, Referrer’s Email Address, Young Carer’s Name, Young Carer’s Address, Young Carer’s Phone Number, Young Carer’s Email Address, Young Carer’s Date Of Birth, Care Receiver’s Name, Care Receiver’s Date Of Birth, Care Receiver’s Relationship, Care Receiver’s Care Situation, Ethnicity, School Contact Information, Other Household Member’s Name, Other Household Member’s Relationship, Other Household Member’s Date Of Birth, and Tasks Carried Out By Young Carer.
Initial Assessment Form
Young Carer’s Name, Young Carer’s Phone Number, Young Carer’s Email Address, Name Of Person Cared For, Health Condition Of Cared For Person, Names Of Other Household Members, Age Of Other Household Members, Relationship To Other Household Members, Names Of Other Care Providers, Caring Jobs Completed, Family/Friends Information, School/College Information, and Further Referrals Needed.
Parent/Guardian Information Form
Parent/Guardian Name, Parent/Guardian Address, Parent/Guardian Date Of Birth, Parent/Guardian Diagnosis, Names Of Other Family Members, Date Of Birth Of Other Family Members, Relationship To Other Family Members, Contact Details Of Other Professional Agencies, Friends & Family Support Information, Child’s Caring Role, Young Carer’s Health Information, Young Carer’s Education Information, Young Carer’s Interests & Hobbies, Parental/Guardian Consent, Ethnic Origin, and Preferred Language/Means Of Communication.
Parent/Guardian Consent Form
Young Carer’s Name, Young Carer’s Address, Young Carer’s Phone Number, Young Carer’s Date Of Birth, Emergency Contact Number, Young Carer’s Allergy Information, Young Carer’s Dietary Requirements, Young Carer’s Medical Conditions, Young Carer’s Medication, Consent To Emergency Medical Treatment, Name Of Young Carer’s GP, GP Telephone Number, Swimming Information, Young Carer’s Needs & Limitations, Photographic Consent, and Parent/Guardian Name.
Photo Consent
Parental/Guardian Consent, Young Carer’s Name, Young Carer’s Address, Young Carer’s Phone Number, Young Carer’s Date Of Birth, and Name Of Parent/Guardian.
Who Holds The Data
BPRCVS holds this data as the data controller.
Who Can Access The Data
Only BPRCVS Young Carers/ We Count/Female Empowerment Project (FEP) project staff have access to this data.
Data Security
All paper copies of files, forms and records are stored safely and securely in a locked filing cabinet within a locked office.
Data is extrapolated from the form/email and stored in a Microsoft Excel file to store electronic records of data. This is saved on a secure, on-site server which is backed up daily.
Forms returned via email are stored in Outlook on a secure, off-site exchange server.
How Long Is Data Stored For
All data is stored for as long as a young person is an active project participant and in line with our funder’s requirement which is 5 years.
When & How Is The Data Removed & Destroyed
Upon exiting from the project all electronic records are deleted and paper copies are archived in file storage. After the conclusion of the funder’s storage requirements all paper records are then confidentially wasted.
…………………………………………………………………
Community Transport
Communicars
Communicars Passengers
Purpose For Collecting & Storing Data
BPRCVS collects and stores personal data and special category data for the purpose of registering passengers onto the Communicars service.
Basis For Processing Data
The lawful basis for processing your data is contractual agreement to which you agreed when registering with the service.
What Data Do We Store
We store the following personal data for all passengers:
Name, Address, Telephone Number, Date Of Birth, Disabilities/Health Conditions, Blue Badge Holder, and Emergency Contact.
Who Holds The Data
BPRCVS and Shaunsoft hold this data. BPRCVS are the controller of this data. Shaunsoft are the data processor.
Who Can Access The Data
BPRCVS Communicars staff have access to this data and the Shaunsoft cloud-based database staff have access too.
Data Security
Your personal data is stored in a secure cloud-based database.
How Long Is Data Stored For
We only keep your personal data for as long as you remain a Communicars passenger.
If you have not used the service in 12 months we will automatically delete your personal data. This does not affect your statutory rights and you are able to register again in the future.
When & How Is The Data Removed & Destroyed
Upon your exit from the service BPRCVS delete all records from the Shaunsoft cloud-based database.
Communicars Drivers
Purpose For Collecting & Storing Data
BPRCVS collects and stores personal data and special category data for the purpose of registering people as volunteer drivers for the Community Transport service.
Basis For Processing Data
The lawful basis for processing your data is contractual agreement to which you agreed when registering with the service.
We also have a legal obligation to store some personal data, in particular related to you and your vehicle such as driving licence, insurance and tax documents, and MOT certificates.
What Data Do We Store
From the Volunteer Driver Application Form, we store the following data:
Name, Address, Telephone Number, Email Address, Date Of Birth, Car Registration Number, Car Make, and Car Model.
We also store the following driver documents:
Who Holds The Data
BPRCVS and Shaunsoft cloud-based database hold this data. BPRCVS are the controller of this data. Shaunsoft are the data processor.
Who Can Access The Data
BPRCVS Community Transport staff have access to the paper copies and Excel workbook of this data and the Shaunsoft cloud-based database staff have access to the driver’s data stored on the cloud.
Data Security
BPRCVS store the original paper copies of the Volunteer Driver Application Form and driver documents in a secure, locked drawer within a locked office.
BPRCVS also store driver’s personal data on a cloud-based database and an Excel workbook.
How Long Is Data Stored For
BPRCVS only keep your data stored for as long as you remain a Community Transport Volunteer Driver.
When & How Is The Data Removed & Destroyed
Upon your exit from the service all paper copies of your data are confidentially wasted and your data is removed from the cloud based database and Excel workbook.
Minibus
Purpose For Collecting & Storing Data
BPRCVS collected and stores personal data relating to minibus bookings for the purpose of operating the Community Transport Minibus service.
Basis For Processing Data
The lawful basis for processing your data is contractual agreement to which you agreed when placing your minibus booking.
What Data Do We Store
To effectively operate the minibus service we are required to store the following data:
Group/Organisation Name, Group/Organisation Contact Name, Phone, Destination, Date of Journey, Group/Organisation Address, Pickup Address, Return Collection Point, Guide Dog Numbers, Frame/Rollator Numbers, Contribution Costs, and Date.
Who Holds The Data
Only BPRCVS holds this data.
Who Can Access The Data
BPRCVS Community Transport staff have access to the paper copies, Outlook booking calendar, and Excel workbook of this data.
Data Security
All paper copies are stored securely in locked file storage in a locked office. All electronic records are stored securely in Microsoft Excel and Outlook which is backed up daily and stored on a secure, off-site server.
How Long Is Data Stored For
Data is stored for up to a maximum of 5 year.
When & How Is The Data Removed & Destroyed
All paper copies are securely destroyed in confidential waste. All electronic records are deleted. This is done in the event of a cancellation, and upon the conclusion of the 5 year retention period.
…………………………………………………………………
UK Shared Prosperity – People & Skills: Steps To Employment
Purpose For Collecting & Storing Data
The purpose for collecting and storing personal data for this project is to enable registration with, and delivery of the project’s service.
Basis For Processing Data
The lawful basis for processing your data is consent provided when registering with the service.
What Data Do We Store
Several forms are used for the processing of your personal data. Below is a breakdown of what personal data we store:
Participant Entry Form
Organisation, Participant Name, Customer Reference Number, Project Start Date, Gender, Date of Birth, Address, Phone Number, Email, Ethnicity, Eligibility Criteria, Alternative Credible Evidence, Employment Status, Education Status, Education Details, Self-Declaration, Household Situation, Offender Status, Disabilities, Date, and Signature.
Participant Progress Form
Organisation, Participant Name, Customer Reference Number, Project Start Date, Progress Form Date, Activities Undertaken, Date, Time Spent, Signature, Development Objectives, Review Date, and Other Comments.
Participant Expenses Form
Organisation, Participant Name, Customer Reference Number, Expense Description, Date, Amount, Declaration, and Signature.
Participant Exit Form
Organisation, Participant Name, Customer Reference Number, Project Exit Date, Job Start Date, Company Name, Job Title, Hours, Contract Type, Outcomes, Declaration, and Signature.
Who Holds The Data
Views is the electronic database system used to store your data and as such Views is the data controller. BPRCVS is the data processor.
Who Can Access The Data
Only BPRCVS project staff have access to personal data for this project. However, as the lead organisation in the partnership, Calico also have access to the same personal data.
Data Security
All paper forms are stored in locked file storage in a secure, locked office. All electronic records are stored in a secure, online database which is hosted on off-site servers and backed up regularly.
How Long Is Data Stored For
Data will be stored for 6 years after the conclusion of the project on 31st March 2025.
When & How Is The Data Removed & Destroyed
Upon completion of the project and at the end of the retention period, all paper records are destroyed using confidential waste and all electronic records are deleted from the database.
…………………………………………………………………
Room Bookings – The CVS Centre & Gannow Community Centre
Purpose For Collecting & Storing Data
BPRCVS collects and stores data for the purpose of processing room bookings at The CVS Centre and Gannow Community Centre. It is also necessary to store this data for the purpose of issuing invoices to cover charges and payments.
Basis For Processing Data
The lawful basis for processing this data is contractual agreement which you agreed to when completing the Room Booking form.
What Data Do We Store
For both centres we store the following personal data:
Name, Organisation Name, Address, Telephone Number, Email Address, and Invoice Name & Address.
Who Holds The Data
Only BPRCVS holds the data as the data controller.
Who Can Access The Data
Reception staff at BPRCVS and the finance department has access to this data.
All BPRCVS staff have access to the Outlook calendar which forms part of the room booking system.
Data Security
Room Booking forms are stored on file in a secure, locked filing cabinet.
Contact details are stored in an Outlook calendar which forms part of our room booking system. Outlook is stored on a secure off-site exchange server.
How Long Is Data Stored For
BPRCVS store this data for up to a maximum of 12 months after your booking.
When & How Is The Data Removed & Destroyed
After 12 months from the date of your booking the form is removed from file storage and confidentially wasted.
…………………………………………………………………
Tenancy
Purpose For Collecting & Storing Data
BPRCVS collects and stores data for the purpose of processing tenancy at The CVS Centre. It is also necessary to store this data for the purpose of issuing invoices to cover charges and payments.
Basis For Processing Data
The lawful basis for processing this data is contractual agreement which you agreed to when completing the Tenancy Agreement.
What Data Do We Store
The Tenancy Agreement only contains a date and signature. We do however need to store additional details for the purpose of invoicing. This includes:
Group/Organisation Name, Contact Name, Contact Details, and Address.
Who Holds The Data
Only BPRCVS holds this data as the data controller.
Who Can Access The Data
The centre manager, reception staff and the finance department have access to this data.
Data Security
Tenancy Agreements are stored on file in a secure, locked filing cabinet within a locked office.
Invoices are stored on file in a secure, locked filing cabinet within a locked office.
How Long Is Data Stored For
BPRCVS store this data for up to a maximum of 12 months after your tenancy expires.
Invoices are stored for a maximum of 7 years from the date of issue.
When & How Is The Data Removed & Destroyed
After 12 months from the date your tenancy expires all records are removed from file storage and confidentially wasted.
…………………………………………………………………
Payroll
Purpose For Collecting & Storing Data
It is necessary to collect and store this data to enable BPRCVS Payroll Service to complete payroll functions on behalf of your organisation.
Basis For Processing Data
The lawful basis for processing this data is contractual agreement which you agreed to when completing the Payroll Service Agreement.
What Data Do We Store
For the purpose of processing payroll on behalf of your organisation it is essential that we store the following personal data:
Employer
Organisation/Group Name, Address, Telephone Number, Fax Number, Email Address, Contact Person Name & Telephone Numbers, Secondary Contact Name, Secondary Contact Telephone Numbers, Tax District & Reference Number, Accounts Office Reference, and Authorised Signatories.
Employee
Organisation/ Group Name, Name, Address, Date Of Birth, Employment Start Date, Tax Code, National Insurance Number, Marital Status, Gender, Salary, Pension Contribution, P11, P45, and P46.
Who Holds The Data
Only BPRCVS holds this data as the data processor. The respective organisations are the data controller.
Who Can Access The Data
The BPRCVS finance department are the only staff who have access to this data.
Data Security
The data is stored and processed using secure payroll software installed on a secure, on-site server.
Completed paper forms are stored in file storage in a locked filing cabinet in a locked office.
Some completed documents are stored on hard drives of finance department computers which are connected to a secure, on-site server and password protected.
How Long Is Data Stored For
Personal data is stored for as long as an organisation uses the BPRCVS Payroll Service.
We also keep copies of accounts from each organisation on-site. We store 12 months’ worth before asking each organisation to come and collect their records.
Account summary reports are stored indefinitely in case queries or issues are raised.
When & How Is The Data Removed & Destroyed
Personal data relating to both employers and employees stored on paper forms will be confidentially wasted upon leaving the Payroll Service.
Personal data stored electronically is deleted upon leaving the Payroll Service.
…………………………………………………………………
The CVS Centre Volunteer Application Form
Purpose For Collecting & Storing Data
BPRCVS collects and stores personal data obtained from prospective volunteers applying for reception opportunities at The CVS Centre. This enables us to conduct interviews and recruit volunteers.
Basis For Processing Data
The lawful basis for processing this data is contractual agreement.
What Data Do We Store
BPRCVS collects and stores the following data:
Name, Gender, Date Of Birth, Address, Telephone Numbers, Email Address, Availability, Skills, Disabilities Or Significant Illnesses, Personal Reference Details, Employment Status, Ethnicity, and Prosecutions Pending Or Unspent Convictions.
Who Holds The Data
Only BPRCVS holds this data as the data controller.
Who Can Access The Data
Only the BPRCVS volunteer coordination team can access this information.
Data Security
All applications received are stored safely and securely on file in a locked filing cabinet within a locked office.
How Long Is Data Stored For
The data is only stored for as long as the individual remains a volunteer for BPRCVS.
When & How Is The Data Removed & Destroyed
Upon a volunteer’s exit from the company the paper files are confidentially wasted.
…………………………………………………………………
BBO Projects
Purpose For Collecting & Storing Data
For individuals to participate in any of the BBO projects it is necessary to collect and store personal, and in some cases, special category data. The data collected enables BPRCVS and other project partners to determine whether a participant is viable for the project based on pre-determined criteria.
Basis For Processing Data
The lawful basis for processing this data is contractual agreement to which you agreed.
What Data Do We Store
BPRCVS needs to collect and store the following data for each respective project.
BBO1 – Age Of Opportunity
For this BBO project BPRCVS only collects the individuals name, address and contact details for the purpose of referring to Age UK. All other BBO1 project forms are completed by Age UK with the exception of the form below.
Life Circle
The purpose of this form is to determine eligibility for the project. The only personal and identifiable data collected and stored in this form is the Participant Name. The form collects data associated with personal opinions on the following topical areas: Education & Training, Motivation, Self-Care, Money & Budgeting, Support Networks, Wellbeing, Physical Health, Housing, Confidence, and Employment.
BBO3 – Changing Futures
Participant File
We collect and store your Name, National Insurance Number and a Customer Reference Number used to identify you.
Annex H – Participant Entry Form
We collect and store the following data:
Participant Name, National Insurance Number, Customer Reference Number, Start Date, Previous Involvement With Another BBO Project, Gender, Date Of Birth, Address, Telephone Numbers, Email Address, Ethnicity, Eligibility, Employment Status, Education, Qualifications, Household Situation Details, Criminal Convictions, Disabilities & Long-Term Health Conditions, Sexual Orientation, and a Declaration.
Annex I – Participant Progress Form
We collect and store the following data:
Participant Name, National Insurance Number, Customer Reference Number, Start Date, Details Of Activities Undertaken, and a Development Action Plan.
Annex J – Participant Exit Form
We collect and store the following data:
Participant Name, National Insurance Number, Customer Reference Number, Leaving Date, Project Exit Results, Education & Training Details, Employment Or Self-Employment Details, Job Search Details, Employment Status On Leaving, and a Declaration.
Annex N – Participant Expenses, Allowances & Incentives Form
We collect and store the following data:
Participant Name, National Insurance Number, Customer Reference Number, Expense Details, Expense Evidence, Allowances & Incentives, and a Declaration.
Confirmation Of Starting Employment (Result) Form
We collect and store the following data:
Employer Name, Employer Address, Employee Name, Started Work Date, Position, and Signatory.
Confirmation Of Starting Education Or Training (Result) Form
We collect and store the following data:
College/Training Provider Name, College/Training Provider Address, Student Name, Started Learning Date, Course Title, and Signatory.
Confirmation Of Employment Status (3rd Party) Form
We collect and store the following data:
Participant Name, Participant Address, Name Of Third Party, Address Of Third Party, Occupation Of Third Party, Organisation Represented, Capacity In Which Applicant Is Known, Length Of Time Applicant Has Been Known, and a Declaration.
Confirmation Of Employment Status (Self-Certification) Form
We collect and store the following data:
Participant Name, Participant Address, Participant Declaration, and the Reasons For Self-Declaration.
Life Circle
The only personal and identifiable data collected and stored in this form is the Participant Name. The form collects data associated with personal opinions on the following topical areas: Education & Training, Motivation, Self-Care, Money & Budgeting, Support Networks, Wellbeing, Physical Health, Housing, Confidence, and Employment.
BBO4 – ReachIT
The only data BPRCVS store is the names of persons identified to partake in Digital Champion training. Contact the organisation you registered as a participant with for how they collect and store your data.
Who Holds The Data
BPRCVS are the processors of this data. Age UK also process BBO1 – Age Of Opportunity Data. The controllers of this data are Selnet (BBO1 – Age Of Opportunity & BBO3 – Changing Futures) and WEA (BBO4 – ReachIT).
Who Can Access The Data
Selnet, Age UK and BPRCVS can access the data collected and stored for the BBO1 – Age Of Opportunity project.
Selnet and BPRCVS can access the data collected and stored for the BBO3 – Changing Future project.
WEA and BPRCVS can access the data collected and stored for the BBO4 – ReachIT project.
Big Lottery Fund and the E.U. may also be privy to some of the data collected as partner organisations are required to report in-depth about the project.
Data Security
All paper copies are filed away safely and securely in a locked filing cabinet within a locked office. All electronic records are stored safely and securely on an off-site server using a CRM program called Views for BBO1 and BBO3. BBO4 files are stored using a different CRM system called I-Web Storage.
How Long Is Data Stored For
The data is stored in line with funder’s requirements for a maximum of 11 years after the conclusion of the project as determined by the EU.
When & How Is The Data Removed & Destroyed
Upon conclusion of the 11-year storage period for E.U. funded projects all paper copies stored on file will be confidentially wasted and all electronic records permanently deleted from the Views CRM.
…………………………………………………………………
ESOL
Purpose For Collecting & Storing Data
BPRCVS are not responsible for the collection of data associated with this project, but we do store basic contact details for each family. BPRCVS make take photos of events and activities undertaken as part of the project. In this instance BPRCVS will seek consent prior to processing photos.
Basis For Processing Data
The basis for processing this data is contractual agreement.
When processing photos of events, etc. the basis for this processing is consent.
What Data Do We Store
BPRCVS only stores names, addresses and contact details for each family on the project. We may also store a photo consent form containing a signature and date.
Who Holds The Data
BPRCVS holds this data along with Calico. BPRCVS are the data processor and Calico are the data controller.
Who Can Access The Data
Calico are the data controller and BPRCVS the data processor for this project. As such Calico have access to all data provided for this project. Only BPRCVS ESOL workers have access to the personal data stored.
Data Security
All personal data is stored safely and securely on file in a locked office.
How Long Is Data Stored For
The data will be stored for 11 years after the project end date.
When & How Is The Data Removed & Destroyed
Upon completion of the project BPRCVS will remove all records from our files. All paper copies will be confidentially wasted, and any electronic records permanently deleted.
…………………………………………………………………
Job Applications
Purpose For Collecting & Storing Data
It is essential that BPRCVS collect and store personal and special category data for the purpose of reviewing and assessing candidates, contacting for interviews and recruiting into post.
Basis For Processing Data
The lawful basis for processing job applications is contractual agreement.
What Data Do We Store
For the purpose of processing job applications, we store the following data:
Name, Address, Telephone Numbers, Email Address, Present/Most Recent Employer Name Details Including Salary, Education History, Qualifications, Training, Past Employment Details, Driving Licence, References Details, Disabilities Or Significant Illnesses, Criminal Convictions, and Equal Opportunities Information Including Sexual Orientation, and Disability & Ethnicity.
Who Holds The Data
Only BPRCVS holds this data as the data controller.
Who Can Access The Data
Only BPRCVS HR staff can access this data for processing.
Data Security
All applications are stored safely and securely in a locked filing cabinet within a locked office.
How Long Is Data Stored For
BPRCVS stores all job applications for 5 years.
When & How Is The Data Removed & Destroyed
Upon completion of the 5-year storage period all job applications are confidentially wasted.
If you have selected the option to not to be stored beyond the deadline of the job for which you have applied your application will be confidentially wasted after the recruitment process has been completed.
…………………………………………………………………
Membership Applications
Purpose For Collecting & Storing Data
BPRCVS are a member-led organisation and as such we are required to store the details of all members of our organisation. In addition to this some of our services are member only and we need to store details as proof of access to such services. Furthermore, we require the contact details of all members to invite them to the AGM.
Basis For Processing Data
Consent has been given by completing and signing a declaration on the Membership Application form.
What Data Do We Store
For the purpose of recording BPRCVS members we require to store the following data:
Group/Organisation Name, Membership Contact Person, Membership Contact Details, Group/Organisation Address, Contact Preferences, Area Of Operation, Registered Charity Number, Company Number, Number Of Volunteers & Hours, Number Of Staff, Services Provided, and the Group/Organisation’s Aims.
Who Holds The Data
Only BPRCVS store this data as the data controller.
Who Can Access The Data
BPRCVS administrative staff are processors of this data.
Data Security
All data is stored safely and securely using the following methods:
Paper copies are stored on file in a secure office that is locked when empty.
Data is extrapolated from the form and stored in a database. The database is hosted on a secure, on-site server. Regular backups are taken for additional security. These backups are stored securely on removable media which are stored off-site.
Forms returned via email are stored in Outlook on a secure, off-site exchange server.
How Long Is Data Stored For
BPRCVS stores membership data for a minimum of 2 years; 1 year active and 1 year lapsed.
The maximum amount of time depends on how long you remain a member of BPRCVS.
Basic electronic records are kept after expiration of membership for the purpose of internal monitoring.
When & How Is The Data Removed & Destroyed
If membership is not renewed after the lapsed year the paper copy is destroyed in confidential waste and any non-required data is removed from the database.
Database records will be deleted upon a periodic audit completed every 5-7 years in line with funder's requirements.
Upon completion of processing the form any emails containing Membership Application data will be deleted.
Membership Renewals
Purpose For Collecting & Storing Data
BPRCVS collects and stores membership renewal data for the purpose of determining whether you are an active or lapsed member.
Moreover, the annual renewal process enables BPRCVS to maintain accurate records.
Basis For Processing Data
Consent has been given by completing and signing a declaration on the Membership Renewal form.
What Data Do We Store
For the purpose of recording BPRCVS membership renewals we require to store the following data:
Group/Organisation Name, Membership Contact Person, Membership Contact Details, Group/Organisation Address, Contact Preferences, Area Of Operation, Registered Charity Number, Company Number, Number Of Volunteers & Hours, Number Of Staff, Services Provided, and the Group/Organisation’s Aims.
Who Holds The Data
Only BPRCVS store this data as the data controller.
Who Can Access The Data
BPRCVS administrative staff are processors of this data.
Data Security
All data is stored safely and securely using the following methods:
Paper copies are stored on file in a secure office that is locked when empty.
Data is extrapolated from the form and stored in a database. The database is hosted on a secure, on-site server. Regular backups are taken for additional security. These backups are stored securely on removable media which are stored off-site.
Forms returned via email are stored in Outlook on a secure, off-site exchange server.
How Long Is Data Stored For
BPRCVS stores membership data for a minimum of 2 years; 1 year active and 1 year lapsed.
The maximum amount of time depends on how long you remain a member of BPRCVS.
When & How Is The Data Removed & Destroyed
If membership is not renewed after the lapsed year the paper copy is destroyed in confidential waste and the record is removed from the database.
Upon completion of processing the form any emails containing Membership Renewal data will be deleted.
…………………………………………………………………
Organisation Directory
Purpose For Collecting & Storing Data
BPRCVS store organisation and group contact details for the ease of accessing contact details in one central location. This enables BPRCVS to easily contact groups and organisations with whom we may work. Furthermore, storing this data enables BPRCVS to signpost potential clients, service users, customers, etc. to your organisation, group, project or service.
Some contact details are publicly listed and therefore no consent has been sought as long as there is no personal data in the record. Where personal data exists BPRCVS seeks consent to store the data. BPRCVS also seek consent to signpost persons to your organisation or group.
Basis For Processing Data
Consent has been given by completing and signing a declaration on the Organisation Registration form.
What Data Do We Store
Group/Organisation Name, Membership Contact Person, Membership Contact Details, Group/Organisation Address, Contact Preferences, Area Of Operation, Registered Charity Number, Company Number, Number Of Volunteers & Hours, Number Of Staff, Services Provided, and the Group/Organisation’s Aims.
Who Holds The Data
Only BPRCVS store this data as the data controller.
Who Can Access The Data
All BPRCVS staff are able to access the data.
Data Security
All data is stored safely and securely using the following methods:
Paper copies are stored on file in a secure office that is locked when empty.
Data is extrapolated from the form and stored in a database. The database is hosted on a secure, on-site server. Regular backups are taken for additional security. These backups are stored securely on removable media which are stored off-site.
Forms returned via email are stored in Outlook on a secure, off-site exchange server.
How Long Is Data Stored For
As storing organisation and group details is a crucial aspect of BPRCVS’ business operations we store all records that contain no personal data indefinitely, unless a periodic audit determines that the organisation or group is no longer in operation or suitable for BPRCVS to work with.
Records where personal data exists will be audited annually. The Organisation Registration form will be distributed to all organisations and groups found in the database. Upon receipt of this form your record will be amended where necessary.
Forms returned via email and stored in Outlook will be kept in this location until processing occurs.
When & How Is The Data Removed & Destroyed
You, the data subject, can request to have data amended, or removed and destroyed at any time by submitting a data subject access request.
From the annual audit, if we don’t receive the Organisation Registration form back from you by the date given this will lead to your record being permanently removed from the database. This also applies to paper copies stored on file. Paper copies are destroyed in confidential waste.
Upon completion of processing the form any emails containing Organisation Registration data will be deleted.
…………………………………………………………………
Funding
Purpose For Collecting & Storing Data
When applying for funding from any BPRCVS administered funding programme it is necessary to collect and store personal data in order to determine the award of funding based on the respective criteria.
Basis For Processing Data
The basis for processing data is a contractual agreement which you entered when applying for funding. This applies to all BPRCVS administered funding programmes.
What Data Do We Store
In order to process applications for funding it is necessary to collect and store personal data:
Lancashire & South Cumbria Integrated Care Board (LSC ICB) Social Prescribing Funding Programme (formerly known as East Lancashire Clinical Commissioning Group Prescription For Wellbeing Funding Programme, and East Lancashire Clinical Commissioning Group Social Prescribing Small Grants Programme)
Group/Organisation Name, Group/Organisation Address, Numbers Of Staff, Numbers Of Volunteers, Legal Status, Charity Number, CIC Number, Names Of People In Group/Organisation, Contact Name, Contact Address, Contact Preferences, Bank Details, and Project Related Details.
Gannow Big Local Community Fund
Group/Organisation Name, Group/Organisation Address, Numbers Of Staff, Numbers Of Volunteers, Names Of People In Group/Organisation, Contact Name, Contact Address, Contact Preferences, Bank Details, Project Related Information, and Financial Details.
Gannow Big Local Community Event Fund
Group/Organisation Name, Group/Organisation Address, Numbers Of Staff, Numbers Of Volunteers, Names Of People In Group/Organisation, Contact Name, Contact Address, Contact Preferences, Bank Details, Event Information, and Financial Details.
Eric Wright Charitable Trust Grant
Group/Organisation Name, Group/Organisation Address, Numbers Of Staff, Numbers Of Volunteers, Annual Turnover, Names Of People In Group/Organisation, Contact Name, Contact Address, Contact Preferences, Bank Details, Project Details, and Financial Details.
Cliviger Community Benefit Fund
Group Name, Project/Activity Name, Address, When Group Was Established, How Many People Are Involved In The Group Including Volunteers, Staff, Committee & Members, Details Of Larger Organisation (if part of), Information Regarding Previous Grant From Cliviger Fund, Contact Name, Contact Address, Contact Telephone Numbers, Contact Email, Bank/Building Society Name & Address, Project Details, Financial Details, and Declaration Signatories.
The Distress Fund
Parents Names, Children’s Names, Address, Dates Of Birth, and Personal Circumstances.
UK Shared Prosperity Fund – Burnley Community Grant Scheme
Organisation/Group Name, Project Name, Amount Requested, Previous Funding Report Received, Success Status, Organisation/Group Address, Establishment, Number of People Involved, Part of a Larger Organisation, Legal Status, VAT Registration Number, Name of Signatories, Signatories Position, Contact Name, Contact’s Position, Contact’s Address (if different), Preferred Contact, Bank/Building Society Name, Bank/Building Society Address, Cheques Payable To, Project Details, Contingency Plans, Groups/Individuals Targeted, Engagement, Beneficiaries, Community Consultation, Interventions, Locality, Delivery Date, Sessional Information, Additional Information, and Financial Details.
Population Health Management
Group/Organisation Name, Address, Establishment, Number of People Involved, Part of a Larger Organisation, Legal Status, Name of Signatories, Signatories Position, Contact Name, Contact’s Position, Contact’s Address (if different), Preferred Contact, Bank/Building Society Name, Bank/Building Society Address, Cheques Payable To, Project Details, Contingency Plans, Beneficiaries, Community Consultation, Locality, Delivery Date, Sessional Information, Additional Information, Themes, Financial Details, and Amount Applied For.
Lancashire County Council Over 50s Social Isolation Grant
Group/Organisation Name, Project Name, Date Received, Amount Requested, Successful Status, Locality, Previous Reports Received, Address, Established, Number of People Involved, Part of a Larger Organisation, Legal Status, Signatories Name, Signatories Position, Contact Name, Contact’s Position, Contact’s Address (if different), Preferred Contact, Bank/Building Society Name, Bank/Building Society Address, Cheques Payable To, Project Details, Contingency Plans, Beneficiaries, Community Consultation, Delivery Details, Sessional Details, Additional Information, Financial Details, Project Cost, and Additional Funding.
Who Holds The Data
Only BPRCVS holds the data as the data controller for all funds except the Distress Fund, of which Lancashire County Council is the data controller.
Who Can Access The Data
Only the BPRCVS funding team has complete access to this data except the Distress Fund, which is accessible by BPRCVS’ finance department. Lancashire County Council and our accountants, Ashworth Moulds, also have access to Distress Fund data.
Burnley Borough Council has access to UK Shared Prosperity applications.
Lancashire & South Cumbria Integrated Care Board has access to Population Health Management applications.
Where funding applications are awarded via a panel, the members of the panel will have temporary access to the data.
Data Security
All application data on paper, successful or otherwise, is stored safely and securely in a locked filing cabinet within a locked office.
Some limited personal data is recorded in electronic systems such as email and databases, both of which are stored on secure servers.
Distress fund applications are received from referral agencies via secure encrypted email. Personal data is stored on a secure Lancashire County Council database. BPRCVS do not store any of this data electronically.
How Long Is Data Stored For
The data is only stored for as long as each funder requires, of which:
Lancashire & South Cumbria Integrated Care Board (LSC ICB) Social Prescribing Funding Programme (formerly known as East Lancashire Clinical Commissioning Group Prescription For Wellbeing Funding Programme, and East Lancashire Clinical Commissioning Group Social Prescribing Small Grants Programme) – is stored for a maximum of 7 years
Gannow Big Local Community Fund – is stored for a maximum of 10 years up to 2025
Gannow Big Local Community Event Fund – is stored for a maximum of 10 years up to 2025
Eric Wright Charitable Trust Grant – is stored for a maximum of 7 years
Cliviger Community Benefit Fund – is stored for a maximum of 10 years up to 2036
Distress Fund – is stored for a minimum of 2 years and up to a maximum of 7 years.
UK Shared Prosperity – is stored for a maximum of 7 years.
Population Health Management – is stored for a maximum of 7 years.
L.C.C. Over 50s Social Isolation Grant – is stored for a maximum of 7 years.
When & How Is The Data Removed & Destroyed
All Distress Fund data accessible by BPRCVS via the Lancashire County Council database are automatically deleted periodically.
All paper copies of Distress Fund applications are removed and confidentially wasted after 7 years.
Data from unsuccessful Distress Fund applications is removed and deleted from our email system upon the unsuccessful outcome.
For all other funding applications where the outcome was unsuccessful the paper and electronic records containing personal data are removed, deleted and confidentially wasted at the end of each calendar year.
When the funding application is successful the records are removed, deleted and confidentially wasted in line with our funder’s requirements.
…………………………………………………………………
Events
Purpose For Collecting & Storing Data
When we organise and/or host events it can be necessary to collect, process and store personal data in relation to the event.
Basis For Processing Data
Depending upon the event in question the lawful basis for processing will either be consent or contractual agreement. Please refer to the original document you completed associated with the respective event for the specific lawful basis; if consent is not being asked for you can automatically assume the lawful basis as contractual agreement, unless otherwise stated.
What Data Do We Store
The data we collect and store for processing will vary depending upon the type and nature of the event.
Typically, we would collect the following personal data (not all data will be collected for every event):
Name, Address, Date Of Birth, Phone Number, Email Address, Locality, Group/Organisation Name, Group/Organisation Address, and Group/Organisation Contact Details.
If you have any specific queries relating to data being stored from a BPRCVS event please contact the event organiser via the contact details on the sign-up forms, registration documents, marketing materials or other promotional materials and content.
Who Holds The Data
BPRCVS store this data as the data controller.
Third parties, such as Eventbrite and Ticketsource, may also be a data controller and data processor.
Who Can Access The Data
The relevant BPRCVS event staff are able to access the data.
Third parties, such as Eventbrite and Ticketsource, may be able to access your data.
Data Security
All data is stored safely and securely using one or more of the following methods:
Paper copies are stored on file in a secure office that is locked when empty.
Data is extrapolated from the form/email and stored in a Microsoft Excel file to store electronic records of data. This is saved on a secure, on-site server which is backed up daily.
Forms returned via email are stored in Outlook on a secure, off-site exchange server.
For how third parties, such as Eventbrite and Ticketsource, keep your data secure please refer to their respective policies.
How Long Is Data Stored For
BPRCVS store personal data associated with events for as long as our funders require it. This can vary and will be dependent upon the funder in question. Typically, this will range from 5-7 years.
If it is not directly associated with one of our funders then BPRCVS store all records pertaining events for a period of 5 years.
For how long third parties, such as Eventbrite, store your data for please refer to their policies.
When & How Is The Data Removed & Destroyed
Upon conclusion of the either the funder’s or BPRCVS’ storage requirements all records, paper and electronic, will be confidentially wasted and removed from any electronic storage solutions.
…………………………………………………………………
Gannow Food Share
Purpose For Collecting & Storing Data
To record the numbers of food parcels collected and the areas to which we're providing support to compare with areas of deprivation.
Basis For Processing Data
The basis for processing data is consent agreed upon collection.
What Data Do We Store
For the purpose of Food Share we only record the name, address and how many children there are in the family when relevant.
Who Holds The Data
Only BPRCVS store this data as the data controller.
Who Can Access The Data
The relevant BPRCVS staff are able to access the data.
Data Security
All data is stored safely and securely in a database file stored on a secure server.
How Long Is Data Stored For
BPRCVS store personal data associated with Food Share for 2 years.
When & How Is The Data Removed & Destroyed
All personal data is deleted after being stored for 2 years.
…………………………………………………………………
Burnley Together Food Parcels
Purpose For Collecting & Storing Data
To record the numbers of food parcels to be collected and by whom.
Basis For Processing Data
The basis for processing data is consent agreed via registration with Burnley Together.
What Data Do We Store
For the purpose of issuing Burnley Together Food Parcels we receive and store the following data:
Name, House Number, Number of Adults, Number of Children, Collection Point, Date, and Dietary Requirements.
Who Holds The Data
Burnley Together store this data as the data controller. BPRCVS are the data processor.
Who Can Access The Data
Only BPRCVS reception and Gannow Community Centre staff/volunteers are able to access the data.
Data Security
All data is stored safely and securely in a locked office.
How Long Is Data Stored For
BPRCVS store this data until the food parcel has been collected at which point the collector takes the paper record with them.
When & How Is The Data Removed & Destroyed
In the event they don’t take the paper record, it is immediately securely destroyed in confidential waste.
…………………………………………………………………
ESIF Passport To Employment
Purpose For Collecting & Storing Data
This project uses a variety of documents to collect and store data necessary for the running of the project. The purpose of these documents is to determine involvement with the project; to enter participants into the project; to monitor and provide support to participants; to record participant progress; and to record participant wellbeing.
Basis For Processing Data
Consent is given by the participant when joining the project by completing and signing a declaration giving permission to collect and store the required data for the purpose of the ESIF project.
What Data Do We Store
This project uses a number of different forms to collect personal data that we are required by our funder to store for processing.
Evidence Requirements
Passport, Right To Work Card, Birth Certificate, Adoption Certificate, Phone/Utility/Energy Bill, Current Tenancy Agreement, DWP Letter, and Jobcentre/Universal Credit Journal.
Participant Entry Form
Full Name, National Insurance Number, Participant Reference Number, Project Start Date, Referral Information, Additional Information, Gender, Date Of Birth, Address, Telephone Numbers, Email Address, Ethnicity, Eligibility, Employment Status, Benefits Information, Qualifications, Housing Information, Parenting Information, Offender Information, and Health Information.
Basic Engagement Form/Client Progress Record
Full Name, National Insurance Number, Date Of Birth, Address, Telephone Numbers, Email Address, Ethnicity, Record Of Actions Completed and Journey Undertaken, and Support Needed Information.
ONS4 Wellbeing Survey
Full Name, Date Of Birth, VIEWS Reference Number, GP Surgery, Medical Appointment History, and Wellbeing Information.
Participant Exit Form
Full Name, National Insurance Number, Participant Reference Number, Project Leaving Date, Achievements, Education/Training Information, Employment Information, Qualifications, Job Search Information, Employment Status, and Feedback.
Who Holds The Data
BPRCVS and Views hold the data for participants involved in the project. Views are the data controller and BPRCVS are the data processor.
Who Can Access The Data
BPRCVS, Views and Community CVS can access the data through the shared cloud portal.
Data Security
All data contained in paper records are stored safely and securely in lockable BPRCVS file storage within a locked office.
We use Views CRM Database to store electronic records of data. This is a secure cloud-based database hosted on secure, off-site servers.
How Long Is Data Stored For
All data collected, stored and processed for the ESIF project is stored for as long as the funder requires it. This is 11 years after project completion.
When & How Is The Data Removed & Destroyed
Upon completion of the funder’s storage requirements all electronic records are to be deleted and all paper files are to be confidentially wasted.
…………………………………………………………………
Emergency Assistance/Winter Grant Scheme
Purpose For Collecting & Storing Data
These grant schemes required data to be collected to enable BPRCVS to issue grants to those who qualified. The purpose of these documents is to determine qualifying criteria and record the recipient's contact information.
Basis For Processing Data
Consent is given by the recipient by completing and signing a declaration giving permission to collect and store the required data for the purpose of these grants schemes.
What Data Do We Store
Both schemes use a form to collect personal data that we are required by our funder to store for processing. Depending on when the referral was made, two different forms have been used.
This is the data we store using the earliest version of the form:
Name, Date Of Birth, Address, Email Address, Contact Number, Ethnicity, Gender, NHS Number, GP Name, GP Practice, Date Of Referral, Reason For Referral, Specific Support Required, Name Of Agency Referring, Name Of Agent Completing The Form, Agent's Telephone Number, Agent's Email Address, and Next Of Kin/Emergency Contact Details.
This is the data we store using the second version of the form:
Name, Date Of Birth, Address, Email Address, Contact Number, Ethnicity, Gender, Reason For Referral, Specific Support Required, Name Of Agency Referring, Name Of Agent Completing The Form, Agent's Telephone Number, and Agent's Email Address.
Who Holds The Data
BPRCVS holds the data for this scheme as the data controller.
Who Can Access The Data
Only BPRCVS can access the data.
Data Security
All data contained in paper records are stored safely and securely in lockable BPRCVS file storage within a locked office.
We use Microsoft Excel to store electronic records of data. This is saved on a secure, on-site server which is backed up daily.
How Long Is Data Stored For
All data collected, stored and processed for the grant schemes is stored for up to a maximum of 7 years.
When & How Is The Data Removed & Destroyed
Upon completion of the funder’s storage requirements all electronic records are to be deleted and all paper files are to be confidentially wasted.
…………………………………………………………………
Household Support Scheme
Purpose For Collecting & Storing Data
This grant scheme requires data to be collected to enable BPRCVS to issue grants to those who qualify. The purpose of these documents is to determine qualifying criteria and to record the recipient's contact information.
Basis For Processing Data
Consent is given via a checkbox on referral forms, or by the recipient verbally over the phone by agreeing to a declaration giving permission to collect and store the required data for the purpose of these grants schemes.
What Data Do We Store
We use a form to collect personal data that we are required by our funder to store for processing.
This is the data we store:
Name, Date Of Birth, Address, Email Address, Contact Number, Ethnicity, Gender, Family Status, Reason For Referral, Specific Support Required, Name Of Agency Referring, Name Of Agent Completing The Form, Agent's Telephone Number, and Agent's Email Address.
Who Holds The Data
Burnley Household Support Scheme - Burnley Borough Council are the data controller and BPRCVS the appointed data processor on behalf of Burnley Borough Council.
Pendle Household Support Scheme - BPRCVS and Pendle Borough Council are joint data controllers and BPRCVS is the appointed data processor on behalf of Pendle Borough Council.
Rossendale Household Support Scheme - Rossendale Borough Council are the data controller and BPRCVS the appointed data processor on behalf of Rossendale Borough Council.
Please see your respective council's privacy policy for your rights as a data subject.
Who Can Access The Data
Only BPRCVS and your respective local council can access the data.
Data Security
All data contained in paper records are stored safely and securely in lockable BPRCVS file storage within a locked office.
We use Microsoft Excel to store electronic records of data. This is saved on a secure, on-site server which is backed up daily.
How Long Is Data Stored For
All data collected, stored and processed for the grant schemes is stored for up to 7 years.
When & How Is The Data Removed & Destroyed
Upon completion of the funder’s storage requirements all electronic records are to be deleted and all paper files are to be confidentially wasted.
…………………………………………………………………
Launch Into Your Future
Purpose For Collecting & Storing Data
The purpose for collecting and storing data is to enable the project to recruit suitable candidates into employment.
Basis For Processing Data
The lawful basis for processing data is contractual agreement.
What Data Do We Store
Name, Date of Birth, Address, Phone, Email, National Insurance Number, Employment History, and Benefits.
Who Holds The Data
BPRCVS holds the data as the data controller for this project. Community CVS (project partner) also have access to this data.
Who Can Access The Data
Only the Launch Into Your Future coordinator has access to this data.
Data Security
All paper files are stored in secure file storage in a locked office. All electronic records are stored securely using appropriate systems.
How Long Is Data Stored For
Stored for 11 years after project completion date.
When & How Is The Data Removed & Destroyed
Upon completion of the project’s record retention period, the data will be removed from file storage and confidentially wasted, and all electronic systems will have records deleted.
…………………………………………………………………
ESIF Upskilling Project
Purpose For Collecting & Storing Data
The purpose for collecting and storing data is to enable the project to recruit candidates into skills-based training.
Basis For Processing Data
The lawful basis for processing data is contractual agreement.
What Data Do We Store
This project utilises several forms to collect and store data:
Organisational Diagnostic Form
Organisation Name, Address, Phone, Contact Name, Contact Role, Contact Phone, Legal Status, Registration Numbers, HMRC Registration, About The Organisation Details, Marketing & Communications Details, Financial Details, Future Proofing & Sustainability Information, Self-Assessment, Organisational Structure, State Aid De Minimis Regulations Declaration, and Signatory.
Entry Form
Participant VIEWS Number, Project Join Date, Name, Gender, Date of Birth, Address, Phone Numbers, Email, Eligibility, Organisation Name, Organisation Address, Equality Information, Disability Information, Household Situation, Religion/Belief, Sexual Orientation, Additional Information, and Education.
Organisation Training & Development Plan
Advisor Name, Date, Organisation Name, Contact Name, Address, Phone, Email, Website, Registration Numbers, Notes, About The Organisation, Other Observations, Training Action Plan, Confirmed Training Plan, and Signatories.
Personal Development Plan
Name, Date, Organisation Name, Job Title, Responsibilities, Achievements and Qualifications, Upskilling Opportunities, Strengths, Area for Development, Short Term Employment Goals, Long Term Career Goals, and Signatories.
Who Holds The Data
BPRCVS holds the data as the data controller for this project.
Who Can Access The Data
Only the ESIF Upskilling coordinator has access to this data.
Data Security
All paper files are stored in secure file storage in a locked office. All electronic records are stored securely using appropriate systems.
How Long Is Data Stored For
Stored for 11 years after project completion date.
When & How Is The Data Removed & Destroyed
Upon completion of the project’s record retention period, the data will be removed from file storage and confidentially wasted, and all electronic systems will have records deleted.
…………………………………………………………………
Children’s Personal Health Budget
Purpose For Collecting & Storing Data
Personal data is collected and stored for the purpose of awarding grants to individuals to assist with their physical health and wellbeing.
Basis For Processing Data
The lawful basis for processing data is contractual agreement.
What Data Do We Store
For the purposes of issuing grants we are required to store the following data:
Date of Referral, Name, Date of Birth, Address, Phone Number, Email, Parent/Guardian Name, Parent/Guardian Relationship, Support Plan Details, Consent Declaration, Consent Date, and Name of Representative.
Who Holds The Data
ELCAS holds the data as the data controller for this project. BPRCVS receives data for the purposes of processing.
Who Can Access The Data
Only the Children & Families team, Chief Officer, and finance team have access to the information stored by BPRCVS.
ELCAS as the data controller can also access the data.
Data Security
All paper files are stored in secure file storage in a locked office. Emails are stored on a secure Exchange server, and the Excel database used to record this data is stored on a secure on-site server which is backed up daily.
How Long Is Data Stored For
We store this data for up to a maximum of 7 years.
When & How Is The Data Removed & Destroyed
Upon completion of the retention period, all data records are removed from file storage and securely deleted or destroyed. Paper files are destroyed using confidential waste.
…………………………………………………………………
Adult’s Personal Health Budget
Purpose For Collecting & Storing Data
Personal data is collected and stored for the purpose of awarding grants to individuals to assist with their physical health and wellbeing.
Basis For Processing Data
The lawful basis for processing data is consent obtained at the referral stage.
What Data Do We Store
For the purposes of issuing grants we are required to store the following data:
Date Of Referral, Referral Via, Name, Address, Telephone Number, Gender, Ethnicity, GP Name & Practice, NHS Number, EMIS Reference Number, Preferred Language, Date of Birth, Lives With Status, National Data Opt Out Status (NDOO), Reason(s) For Referral, Next Of Kin Emergency Contact Details, Referrer's Contact Details, Safe To Visit Alone Status, Risk of Infection Status, Additional Information, Consent Declaration, Cost of PHB, Reason For PHB Request, and Panel Findings.
Who Holds The Data
BPRCVS holds the data as the data controller. Lancashire & South Cumbria Foundation Trust (LSCFT) and Burnley’s Community Mental Health Team (CMHT) are data processors.
Who Can Access The Data
BPRCVS’ Social Prescribing and finance teams have access to the information stored. Lancashire & South Cumbria Foundation Trust (LSCFT) and Burnley’s Community Mental Health Team (CMHT) receive the data from BPRCVS.
Data Security
All paper files are stored in secure file storage in a locked office. Emails are stored on a secure Exchange server, and databases used to record this data are stored on servers which are backed up daily.
How Long Is Data Stored For
We store this data for up to a maximum of 7 years.
When & How Is The Data Removed & Destroyed
Upon completion of the retention period, all data records are removed from file storage and securely deleted or destroyed. Paper files are destroyed using confidential waste.
This privacy policy tells you what to expect BPRCVS to do with your personal data when you make contact with us or use one of our services/projects.
We’ll tell you:
- why we are able to process your information
- what purpose we are processing it for
- how long we store it for
- whether there are other recipients of your personal information
- whether we intend to transfer it to another country, and
- whether we do automated decision-making or profiling
BPRCVS is the controller for the personal information we process, unless otherwise stated.
There are many ways you can contact us, including by phone, email and post.
Our postal address: The CVS Centre, 62-64 Yorkshire Street, Burnley, Lancashire, BB11 3BT
Phone number: 01282 433740
Email address: info@bprcvs.co.uk
Most of the personal data, special category data and children’s data we process is provided to us directly by you for one of the following reasons:
- You are representing your organisation
- You are a service user of one or more of our projects and services
- You wish to attend, or have attended, an event
- You subscribe to our e-newsletter
- You have applied for a job or secondment with us
- You have made an information request to us
- You have made a complaint or enquiry to us
We also receive personal data indirectly, in the following scenarios:
- An employee/client/volunteer of ours gives your contact details as an emergency contact or a referee
If it is not disproportionate or prejudicial, we’ll contact you to let you know we are processing your personal data.
Data Subject Rights - Under GDPR you have rights we need to make you aware of. The rights available to you depend on our reason for processing your information.
Your Right Of Access - You have the right to ask us for copies of your personal information. This right always applies. There are some exemptions, which means you may not always receive all the information we process. You can read more about this right here.
Your Right To Rectification - You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies. You can read more about this right here.
Your Right To Erasure - You have the right to ask us to erase your personal information in certain circumstances. You can read more about this right here.
Your Right To Restriction Of Processing - You have the right to ask us to restrict the processing of your information in certain circumstances. You can read more about this right here.
Your Right To Object To Processing - You have the right to object to processing if we are able to process your information because the process forms part of our public tasks, or is in our legitimate interests. You can read more about this right here.
Your Right To Data Portability - This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another, or give it to you. The right only applies if we are processing information based on your consent or under, or in talks about entering into a contract and the processing is automated. You can read more about this right here.
You are not required to pay any charge for exercising your rights. We have one month to respond to you.
The current practices undertaken by BPRCVS where your personal data may be collected, processed or affected or described in the following pages.
For each project, service and data collection channel we have described in detail the purpose for BPRCVS collecting and storing data, the lawful processing basis determined by BPRCVS, what data is stored, who holds the data and who can access it, how we keep your data safe, how long you can expect us to keep your data, and when and how the data is removed and destroyed.
Website
Purpose For Collecting & Storing Data
We collect and store cookie data from visitors to www.bprcvs.co.uk. This is for the purpose of improving the website by monitoring how you use it.
Basis For Processing Data
Upon visiting the website for the first time you agreed to the cookie policy of BPRCVS. By clicking ‘Ok’ you consented to BPRCVS collecting and storing cookie information.
What Data Do We Store
BPRCVS stores your IP address and details of which version of web browser you used. We also store information on how you use the site, using cookies and page tagging techniques to help us improve the website.
Who Holds The Data
The data is held on secure servers in an off-site location by Host Media Ltd., our webhosting company. On occasion whereby the data has been processed for the purposes of performance analysis the data can be held by BPRCVS on our local secure server. Host Media Ltd. are the data controller.
Who Can Access The Data
BPRCVS and Host Media Ltd. can access the data stored on secure servers.
Data Security
All personal cookie data is stored safely on secure servers in an off-site location. Read the BPRCVS Cookie Policy to see how BPRCVS processes your cookies in more detail.
https://bprcvs.co.uk/cookie-policy.html
How Long Is Data Stored For
BPRCVS stores this data securely for 12 months.
When & How Is The Data Removed & Destroyed
BPRCVS don’t remove or destroy this information unless specifically requested to do so by the Data Subject.
…………………………………………………………………
Email Marketing
Purpose For Collecting & Storing Data
We collect and store personal data for the purpose of communicating with our clients, colleagues, members of the community and external organisations via email.
Basis For Processing Data
The lawful basis for processing data for the purpose of email marketing is consent for which you have completed a double opt in procedure.
What Data Do We Store
For the purpose of sending email newsletters and other email communications via MailChimp (Intuit) we store the following personal data:
Email Address*, Name, Organisation Name, and Region.
*This is the only piece of mandatory data required, all other data is optional and provided at the data subjects discretion.
Who Holds The Data
Intuit is the data controller and BPRCVS is the data processor. You can view Intuit's privacy policy here to see how they process your data: https://www.intuit.com/privacy/statement/
Who Can Access The Data
BPRCVS and Intuit can access the data provided when you subscribed to receive any of the BPRCVS email newsletters.
Data Security
All personal data is stored safely and securely on Intuit's servers.
How Long Is Data Stored For
Data is stored for as long you remain an active subscriber to BPRCVS newsletters.
When & How Is The Data Removed & Destroyed
You are in full control of the data stored. You can access your MailChimp account settings to amend your data and preferences at any time. You can also choose to unsubscribe at any time.
When you choose to unsubscribe, your data is removed from Intuit's servers.
…………………………………………………………………
Social Media
Purpose For Collecting & Storing Data
For the purpose of communicating via social media platforms personal data is stored.
Basis For Processing Data
The lawful basis for processing data associated with social media is consent given by the individual when signing up to each respective social media platform.
What Data Do We Store
BPRCVS does not store any data in relation to your social media accounts and activity.
Who Holds The Data
Facebook, X (formerly known as Twitter) and YouTube are the data controllers.
View the Facebook privacy policy here: https://www.facebook.com/privacy/policy/version/25238980265745528
View the X privacy policy here: https://x.com/en/privacy
View the YouTube privacy policy here: https://www.youtube.com/intl/ALL_uk/howyoutubeworks/our-commitments/protecting-user-data/
Who Can Access The Data
BPRCVS cannot access your personal data. See each respective privacy policy to find out who can access your data.
Data Security
Your personal data is stored safely and securely on each respective social media platform’s server.
How Long Is Data Stored For
See the respective privacy policies to find out how long each platform stores your data for.
When & How Is The Data Removed & Destroyed
See the respective privacy policies to find out how and when each platform removes and destroys your data.
…………………………………………………………………
Training
Purpose For Collecting & Storing Data
BPRCVS collects personal data for the purpose of recording attendees and contacting them in case of cancellations or if there’s a change of which attendees need to be notified.
We also record this data for the purpose of reporting outcomes to our funders.
Basis For Processing Data
The lawful basis for processing your personal data in regard to training events with BPRCVS is contractual agreement.
What Data Do We Store
We store the following personal data: Name, organisation/group name, phone number, email address and attendance status.
BPRCVS also keeps a copy of the attendance sheet used when signing into the training event.
Evaluation forms completed at the conclusion of training contains no personal data or any means to identify a particular individual and therefore are exempt from GDPR.
Who Holds The Data
Only BPRCVS holds this data as the data controller.
Who Can Access The Data
The BPRCVS training coordinator only.
The information sent to funders when reporting contains no identifying data of individuals who attended training events with BPRCVS, nor is the data pseudonymised or an alias created from which a data subject could be identified.
Data Security
When you make a booking your personal data is stored in an appropriate electronic system.
The attendance sheet is stored in a secure, locked office.
How Long Is Data Stored For
We receive funding to deliver training to community groups and voluntary organisations in our localities. Data is stored for as long as our funder requires which is 7 years.
When & How Is The Data Removed & Destroyed
After the 7 years storage requirement as set by our funders has expired all records are removed from electronic systems and paper copies are wasted confidentially.
…………………………………………………………………
Social Prescribing Programmes
Social Prescribing Clients
Purpose For Collecting & Storing Data
BPRCVS' Social Prescribing Team uses a Referral Form and an Initial Assessment Form to collect personal data and special category data which determines a client’s suitability for the programme and enables BPRCVS Link Workers to deliver to clients.
Basis For Processing Data
The lawful basis for processing this data is consent which was obtained at the referral stage of the programme’s process.
What Data Do We Store
We collect and store the following personal data and special category data for Social Prescribing clients:
Referral Form
Date Of Referral, Referral Via, Name, Address, Telephone Number, Gender, Ethnicity, GP Name & Practice, NHS Number, Preferred Language, Date Of Birth, Lives With Status, National Data Opt Out Status (NDOO), Reason(s) For Referral, Next Of Kin Emergency Contact Details, Referrer's Contact Details, Safe To Visit Alone Status, and Risk Of Infection Status.
Initial Assessment Form
Name, Date Of Birth, Gender, Email Address, Family & Friends Support Information, Living Arrangements, Health Information, and Hobbies & Interests.
Case Studies
Background information on the case and outcomes achieved. Anonymised data is explicitly used in this instance with all identifiable data removed.
'My Story' Consent Form
Name, Address, Postcode, Date Of Birth, Signature, Signature Date, and Agencies With Whom Not To Share.
'My Story' Video Consent Form
Name, Address, Postcode, Date Of Birth, Signature, Signature Date, and Agencies With Whom Not To Share.
Who Holds The Data
Personal data will be stored on your GP surgery's EMIS system, and the surgery will be the data controller and BPRCVS the processor appointed on behalf of the surgery.
BPRCVS also store personal data on AideCRM for which BPRCVS is the data controller.
Who Can Access The Data
Social Prescribing staff can access the data. Some data is shared with Lancashire & South Cumbria Integrated Care Board (LSC ICB) as they fund the project.
GP surgeries and their staff can access any data updated on the EMIS system by Link Workers.
If a client was to move from the Burnley, Pendle or Rossendale localities into Hyndburn or Ribble Valley localities the client’ file would be transferred over to Hyndburn & Ribble Valley CVS if the client wished to remain a participant of the project.
All BPRCVS staff have access to staff calendars and therefore basic contact information of Social Prescribing clients.
Case studies are provided to funders and members of the Primary Care Networks and also shared within the public domain occasionally to help promote the service. Only anonymised data is used, and no personable identifiable data is published to protect clients' identities.
Data Security
Personal data is stored safely and securely by BPRCVS in electronic systems.
Data is extrapolated from the referral form and stored in secure data systems. These are saved on secure, off-site servers which is backed up daily.
Referral forms are stored in Outlook on a secure, off-site exchange server. Outlook calendars contain basic contact details of clients.
As Connectors/Link Workers are outreach workers conducting home visits for example, it is necessary for them to carry either a client’s case file or contact details to deliver the Social Prescribing service. When necessary these files will be kept in a secure location and removed and restored upon completion of use.
How Long Is Data Stored For
BPRCVS are required to keep all data from the Social Prescribing project for a maximum of 5 years in line with Lancashire & South Cumbria Integrated Care Board (LSC ICB) requirements.
Identifiable personal data is stored for up to 2 years.
When & How Is The Data Removed & Destroyed
After a period of 2 years all personal, identifiable data is removed and destroyed.
Upon the conclusion of the funder’s storage requirement all client data is removed from all electronic systems and any paper copies are confidentially wasted.
Social Prescribing for Children & Young People
Purpose For Collecting & Storing Data
BPRCVS' Social Prescribing Team uses a Referral Form and an Initial Assessment Form to collect personal data and special category data which determines a client’s suitability for the programme and enables BPRCVS Link Workers to deliver to clients.
Basis For Processing Data
The lawful basis for processing this data is consent which was obtained at the referral stage of the programme’s process.
What Data Do We Store
We collect and store the following personal data and special category data for Social Prescribing clients:
Referral Form
Date of Referral, Referral Via, Child’s Name, Child’s Date of Birth, Child’s Address, Gender Assigned At Birth, Gender Identity, GP Name, GP Practice, NHS Number, EMIS Reference, Preferred Language, Ethnicity, Health Issues, School Name, School Contact Name, School Contact Number, School Contact Email, Reasons For Referral, Parent/Guardian Name, Parent/Guardian Date of Birth, Parent/Guardian Address, Parent/Guardian Relationship, Parent/Guardian Health Issues, Parent/Guardian Preferred Language, Other Household Members Details (Name, Age and Relationship), Referrer’s Name, Referring Agency/Organisation, Referrer’s Number, Referrer’s Email, Safe To Visit, Infection Risks, and Additional Relevant Information.
Young Person’s Initial Assessment Form
Name of Worker, Initial Assessment Venue, Date of Initial Assessment, Young Person’s Name, Young Person's Date of Birth, School/College, Teacher’s Name, Teacher’s Contact Number, Young Person’s Interests, Clubs Accessed, Current Support Received, Support Required, Friends & Family Information, Feelings About School/College, School/College Attendance, and School/College Support.
Parent/Guardian Initial Assessment & Consent Form
Child’s Name, Child’s Address, Child’s Ethnic Origin, Child’s Date Of Birth, Emergency Contact Number, Child’s Allergy Information, Child’s Dietary Requirements, Child’s Medical Conditions, Child’s Medication, Consent To Emergency Medical Treatment, Name Of Child’s GP, GP Telephone Number, Swimming Information, Child’s Needs & Limitations, Photographic Consent, Parent/Guardian Name, Parent/Guardian Address, Parent/Guardian Email, Family Structure, Other Agencies Supporting The Family, Friends & Family Support, Child’s Education, Child’s Interests, Support Needs, and Consent.
Photo Consent
Parental/Guardian Consent, Child’s Name, Child’s Address, Child’s Phone Number, Child’s Date Of Birth, and Name Of Parent/Guardian.
Who Holds The Data
Personal data will be stored on your GP surgery's EMIS system, and the surgery will be the data controller and BPRCVS the processor appointed on behalf of the surgery.
BPRCVS also store personal data on AideCRM for which BPRCVS is the data controller.
Who Can Access The Data
Social Prescribing and Health & Wellbeing for Children & Families staff can access the data. Some data is shared with Lancashire & South Cumbria Integrated Care Board (LSC ICB) as they fund the project.
GP surgeries and their staff can access any data updated on the EMIS system by Link Workers.
All BPRCVS staff have access to staff calendars and therefore basic contact information of Social Prescribing clients.
Case studies are provided to funders and members of the Primary Care Networks and also shared within the public domain occasionally to help promote the service. Only anonymised data is used, and no personable identifiable data is published to protect clients' identities.
Data Security
Personal data is stored safely and securely by BPRCVS in electronic systems.
Data is extrapolated from the referral form and stored in secure online data systems. These are saved on secure, off-site servers which are backed up daily.
Referral forms are stored in Outlook on a secure, off-site exchange server. Outlook calendars contain basic contact details of clients.
As Connectors/Link Workers are outreach workers conducting home visits for example, it is necessary for them to carry either a client’s case file or contact details to deliver the Social Prescribing service. When necessary these files will be kept in a secure location and removed and restored upon completion of use.
How Long Is Data Stored For
BPRCVS are required to keep all data from the Social Prescribing project for a maximum of 5 years in line with Lancashire & South Cumbria Integrated Care Board (LSC ICB) requirements.
Identifiable personal data is stored for up to 2 years.
When & How Is The Data Removed & Destroyed
After a period of 2 years all personal, identifiable data is removed and destroyed.
Upon the conclusion of the funder’s storage requirement all client data is removed from all electronic systems and any paper copies are confidentially wasted.
Back On Track - Social Prescribing Volunteers
Purpose For Collecting & Storing Data
BPRCVS collects and stores personal and special category data for the purpose of matching volunteers to clients, arranging appointments and so that staff have the means to contact volunteers. Furthermore, we also collect next of kin data for the purpose of having a recognised emergency contact.
Basis For Processing Data
As a volunteer you agreed to the processing of personal and special category data by way of consent given when signing a declaration on the Volunteer Application Form.
What Data Do We Store
For volunteers to become a member of the Social Prescribing Team, BPRCVS collects and stores the following personal data:
Volunteer Application Form
Name, Address, Postcode, Telephone Number, Email Address, Date Of Birth, Volunteer Locality, Disability Status, National Insurance Number, Driver Status, Access To Car, Employment Status, Education Status, DBS Status, References Information, Days Of Availability, Details Of Convictions (Spent & Unspent) and Next Of Kin Emergency Contact Details.
Who Holds The Data
Only BPRCVS holds this data as the data processor.
Who Can Access The Data
Only BPRCVS Social Prescribing staff and the Back On Track coordinator have access to paper copies on file.
All BPRCVS staff with database access can access your personal data.
All BPRCVS staff may have access to your contact details if stored in Outlook calendars for the purpose of appointment management.
Data Security
Personal data is stored safely and securely on file in a locked filing cabinet within a locked office.
Data is extrapolated from the form/email and stored in a Microsoft Excel file to store electronic records of data. This is saved on a secure, on-site server which is backed up daily.
Forms returned via email are stored in Outlook on a secure, off-site exchange server. Outlook calendars contain basic contact details of volunteers.
How Long Is Data Stored For
For as long as you volunteer with the project and for a maximum of 7 years in line with Lancashire & South Cumbria Integrated Care Board (LSC ICB) requirements.
When & How Is The Data Removed & Destroyed
Paper files are confidentially wasted, and electronic records are deleted after 7 years.
…………………………………………………………………
DBS
Purpose For Collecting & Storing Data
BPRCVS is a DBS registered body which means we can process DBS applications on behalf of other groups and organisations. Therefore, we need to collect and store data in order to process DBS applications.
We use up to three forms to facilitate this operation: DBS Registration & Confidentiality Form; DBS Contract; and External ID Validation Check Consent Form.
Furthermore, we need to store this data for the issuing of invoices for payment of using the DBS service.
BPRCVS also stores completed DBS Applications Forms along with the Documentary Evidence Sheet and External ID Validation Check Consent Form. The purpose for this is in the instance of errors occurring so that such errors can be double checked. An External ID Validation Check can be used to validate the ID of a DBS applicant via Route 2 if that person does not have sufficient ID to validate their ID through Route 1 of the DBS identity verification process.
Basis For Processing Data
The lawful basis for processing this data is a contractual agreement within which you agree to the terms and conditions of BPRCVS in regard to processing DBS applications.
What Data Do We Store
For the purpose of delivering this service we use a number of forms which collect personal and special category data:
DBS Registration Form (Inside BPR)
Group/Organisation Name, Telephone Number, Email Address, Nominated DBS Contact Information, Address, and Contact Preferences.
DBS Registration Form (Outside BPR)
Group/Organisation Name, Telephone Number, Email Address, Nominated DBS Contact Information, Address, Registered Charity Number, Company Number, Number Of Staff, Number Of Volunteers, and Contact Preferences.
DBS Contract
The names of authorised signatories only.
DBS Applications
Name, Previous Names, Current Address, Other Addresses, Date Of Birth, Place Of Birth, Gender, National Insurance Number, Driving Licence Number, Passport Number, Telephone Number, and Email Address.
For the purpose of delivering this service we may be required to undertake an external ID validation check using a third-party provider.
To facilitate this check we use two forms which collect personal and special category data:
External ID Validation Check Form
Name, Gender, Title, Date Of Birth, Address, Date Lived At Current Address From.
External ID Validation Check Consent Form
Full Current Name, and Date Of Birth.
Who Holds The Data
Only BPRCVS holds the data from the DBS Registration & Confidentiality Form and the DBS Contract.
BPRCVS and the DBS hold data from the DBS Application Form. DBS are the data controller and BPRCVS the data processor.
View the DBS privacy policy here: https://www.gov.uk/government/publications/dbs-privacy-policies
BPRCVS and Mayflower Disclosure Services Ltd hold data from the External ID Validation Check. Mayflower Disclosure Services Ltd are the data controller and BPRCVS the data processor.
View the Mayflower Disclosure Services Ltd privacy policy here: http://dbsdirect.co.uk/privacy-policy.php
Who Can Access The Data
Only three members of BPRCVS staff responsible for processing DBS applications and services can access this data.
Please refer to the respective privacy policies of DBS and Mayflower Disclosure Services Ltd to see who can access the data each holds.
Data Security
All data obtained relating to DBS is stored safely and securely on file in a locked office.
All data is shared with Mayflower Disclosure Services Ltd via secure password protected online forms.
How Long Is Data Stored For
Copies of submitted DBS Application Forms are stored for up to 6 months after submission.
All other DBS related data is stored for as long as the group or organisation uses the DBS service.
When & How Is The Data Removed & Destroyed
Copies of DBS Application Forms are destroyed after 6 months via secure confidential shredding services.
All data is stored for as long as you use the DBS service.
We will conduct an audit on an annual basis to determine whether any organisations no longer wish to use the DBS service at which point all files and records will be deleted and confidentially wasted.
All copies of DBS Application Forms are confidentially wasted at the end of the 6-month storage policy.
Mayflower Disclosure Services Ltd store External ID Validation Check data only for as long as it requires it to fulfil their service – refer to their privacy policy.
…………………………………………………………………
Volunteering for Wellbeing & Community Hub (from June 2023)
Volunteer Brokerage Services
Purpose For Collecting & Storing Data
BPRCVS’ Volunteering for Wellbeing & Community Hub requires the collection of relevant data to deliver our volunteer brokerage services and assist with the recruitment of volunteers, and the promotion of voluntary opportunities.
Basis For Processing Data
The lawful basis for processing this data is consent which is obtained upon completing the Volunteer Brokerage Initial Enquiry Form.
What Data Do We Store
For BPRCVS to effectively operate the Hub’s services in relation to volunteer brokerage, we need to collect and store the following data:
Volunteer Brokerage Initial Enquiry Form
Volunteer Coordinator Name, Contact Number, Email, Organisation/Group Name, Address, Organisation/Group Number (if different), Organisation/Group Email (if different), Operational Locality, Volunteer Role Title, Role Description, DBS Requirements, Driving Requirements, English As First Language Requirements, Access To Own Vehicle, Support Needs, and Any Other Information.
Volunteer Enquiry Form
Name, Gender, Date of Birth, Postcode, Phone, Email, Driving Licence, CVS/Gannow Role Applied For, Other Opportunities, Consent, and Date.
Volunteer Application Form
Name, Gender, Date of Birth, Address, Phone, Email, Driving Licence, Access To Car, Employment Status, Education Status, DBS, DBS Number, Disability/Illness/Condition Information, Name of Referee, Referee Email, Referee Phone, Referee Relationship, Organisation Applied To, Role Applied For, Locality, Day & Time Availability, Most Recent Employer Name, Employer’s Address, Role, Date Started, Date Finished, Reason For Leaving, Conviction Status, Where You Heard About BPRCVS, Emergency Contact Name, Emergency Contact Phone, Emergency Contact Email, Emergency Contact Relationship, Any Further Information, and Date.
Volunteer Reference Form
Referee’s Name, Volunteer’s Name, Voluntary Role, Length Of Time Knowing The Volunteer, In What Capacity They Are Known, Personal Attributes, and Personal Characteristics.
Volunteer & Brokerage Feedback Form
Group/Organisation Name, Project Name, Period Of Support, Support Received, Volunteer Questionnaire Responses, and Brokerage Questionnaire Responses.
Photograph, Video & Case Study Consent Form
Name, Date, and Any Agencies Not To Share Information With.
Who Holds The Data
Only BPRCVS holds this data as the data controller.
Who Can Access The Data
Only BPRCVS staff can access the data.
Data Security
Forms returned via email are stored securely in Outlook on a secure, off-site Exchange server.
Data extrapolated from forms is stored in AideCRM which is a secure online database hosted off-site on a secure server.
How Long Is Data Stored For
Data will be stored for 7 years in line with funder’s requirements.
The exception to this is any volunteer who is no longer active in their role, or never became active within 12 months. If the former, upon confirmation of no longer being active, your personal data will be removed at that point, and if the latter, all personal data will be removed from all systems upon the conclusion of 12 months of inactivity.
Active volunteers will have their personal data stored for as long as they remain active volunteers and therefore could exceed the 7-year retention period.
When & How Is The Data Removed & Destroyed
Upon conclusion of the funder’s storage requirements, or when a volunteer becomes inactive all personal data is removed from electronic systems and any paper copies are securely destroyed using confidential waste.
If a volunteer registered with the Hub never becomes active, after 12 months all data is removed from electronic systems and any paper copies are securely destroyed using confidential waste.
Volunteer Centre (old)
Organisation Registration
Purpose For Collecting & Storing Data
BPRCVS collect and store data from organisations who wish to register with the BPRCVS Volunteer Centre for the purpose of promoting voluntary opportunities and recruiting volunteers.
Basis For Processing Data
Consent was given by completing a form and signing a declaration to allow BPRCVS to collect and store the data provided for the purposes of volunteering brokerage.
What Data Do We Store
For BPRCVS to effectively run the Volunteer Centre services we collect and store the following information:
Volunteer Centre Organisation Registration Form
Organisation/Group Name, Contact Name, Telephone Numbers, Email Address, Address, Website, Mission Statement, Aims Of Organisation, Volunteer Policy, Equal Opportunities Policy, Health & Safety Policy, and Public Liability Insurance.
Volunteer Centre Vacancy Info Sheet
Volunteer Vacancy, Organisation/Group Name, Address, Days & Hours Required, Volunteer Duties, Training Requirements, Preferred Skills, Qualities & Experience, Contact Person Name, Contact Telephone Number, Contact Email Address, Other Useful Information, and Additional Information.
Who Holds The Data
BPRCVS and the Do-it Trust hold this data. Do-it Trust are the data controller and BPRCVS the data processor.
Read the Do-it privacy policy to see how they process your data: https://do-it.org/about/privacypolicy
Who Can Access The Data
BPRCVS Volunteer Centre staff and Do-it have access to the data.
Data Security
The data provided from the Organisation Registration Form and Vacancy Info Sheet is stored in Outlook which is securely installed on on-site servers.
This data is also stored on the Do-it website and in the V Base database. Do-it stores data safely and securely on their own servers and the V Base database is stored safely and securely on BPRCVS on-site servers.
Any paper copies of forms not yet processed are stored securely in a locked filing cabinet in a locked office.
How Long Is Data Stored For
Forms returned via email and stored in Outlook are only kept for as long as the organisation remains active.
Data is stored on Do-it and in the V Base database and is publicly available for as long the opportunities remain active. When opportunities are no longer available they are marked as inactive and therefore are no longer visible publicly. Such data is stored until an audit is undertaken to determine which data needs to be removed. An audit is undertaken annually.
When & How Is The Data Removed & Destroyed
Paper copies are confidentially wasted when the data has been processed.
Emails stored in Outlook are deleted when the audit has been completed providing there are no remaining opportunities listed as active.
Data stored on Do-it and in the V Base database is removed upon completion of the annual audit providing there are no active opportunities.
Application Form
Purpose For Collecting & Storing Data
BPRCVS collect and store personal data and special category data from individuals who wish to register with the BPRCVS Volunteer Centre for the purpose of volunteering.
Basis For Processing Data
Consent was given by completing a form and signing a declaration to allow BPRCVS to collect and store the data provided for the purposes of volunteer recruitment.
What Data Do We Store
For BPRCVS to effectively arrange suitable voluntary positions for you we need to collect and store the following information:
Name, Address, Postcode, Telephone Number, Email Address, Date Of Birth, Volunteer Locality, Disability Status, National Insurance Number, Driver Status, Access To Car, Employment Status, Education Status, DBS Status, References Information, Days Of Availability, Details Of Convictions (Spent & Unspent) and Next Of Kin Emergency Contact Details.
Who Holds The Data
BPRCVS and V Base Cloud produced and supported by Veda NFP Consulting Ltd on behalf of Do-it Trust hold this data. Do-it Trust are the data controller and BPRCVS the data processor.
Read the Do-it privacy policy to see how they process your data: https://do-it.org/about/privacypolicy
Who Can Access The Data
BPRCVS Volunteer Centre staff and Do-it have access to the data.
Suitable voluntary groups/organisations will be given your personal data for the express purpose of contacting you in relation to their voluntary positions.
Data Security
Application Forms are stored in a locked filing cabinet within a locked office.
The V Base Cloud is hosted on secure servers off-site.
How Long Is Data Stored For
BPRCVS store volunteer application forms for as long as a volunteer remains interested in volunteering. BPRCVS will conduct an audit at least once annually to ensure volunteers wish to remain on our database for future opportunities and openings.
When & How Is The Data Removed & Destroyed
Upon completion of volunteering your data is removed from all electronic systems and any paper copies are confidentially wasted.
…………………………………………………………………
Strengthening Communities – Volunteering In Lancashire (SCVL)
Purpose For Collecting & Storing Data
This project uses a variety of documents to collect and store data necessary for the running of the project. The purpose of these documents is to determine involvement with the project; to enter participants into the project; to monitor and provide support to participants; to record participant progress; and to record participant wellbeing.
Basis For Processing Data
Consent is given by you when joining the project by completing and signing a declaration giving permission to collect and store the required data for the purpose of the SCVL project.
What Data Do We Store
This project uses a number of different forms to collect personal data that we are required by our funder to store for processing.
Participant Entry Form
Full Name, National Insurance Number, Participant Reference Number, Project Start Date, Referral Information, Additional Information, Gender, Date Of Birth, Address, Telephone Numbers, Email Address, Ethnicity, Eligibility, Employment Status, Benefits Information, Qualifications, Housing Information, Parenting Information, Offender Information, and Health Information.
Basic Engagement Form
Full Name, National Insurance Number, Date Of Birth, Address, Telephone Numbers, Email Address, Ethnicity, Support Needed Information, and Circle Of Support Scores.
Circle Of Support Action Plan
Full Name, Circle Of Support Scores, Action Plan, and Additional Case Notes.
Ways To Wellbeing Survey
Full Name, Date Of Birth, VIEWS Reference Number, GP Surgery, Medical Appointment History, and Wellbeing Information.
Participant Exit Form
Full Name, National Insurance Number, Participant Reference Number, Project Leaving Date, Achievements, Education/Training Information, Employment Information, Qualifications, Job Search Information, Employment Status, and Feedback.
Who Holds The Data
BPRCVS and Views hold the data for participants involved in the project. Views are the data controller and BPRCVS are the data processor.
Who Can Access The Data
BPRCVS, Views and Community CVS can access the data through the shared cloud portal.
Data Security
All data contained in paper records are stored safely and securely in lockable BPRCVS file storage within a locked office.
We use Views CRM Database to store electronic records of data. This is a secure cloud-based database hosted on secure, off-site servers.
How Long Is Data Stored For
All data collected, stored and processed for the SCVL project is stored for as long as the funder requires it. This is 11 years after the project end date.
When & How Is The Data Removed & Destroyed
Upon completion of the funder’s storage requirements all electronic records are to be deleted and all paper files are to be confidentially wasted.
…………………………………………………………………
Group Support
Purpose For Collecting & Storing Data
In order for BPRCVS to support groups and organisations effectively we need to collect and store some personal data from each respective group or organisation.
Basis For Processing Data
Where personal data is stored, consent is sought and given by completing and signing a consent form.
We may also store other groups and organisations in our database if they are publicly listed or having removed all personal data from the record.
What Data Do We Store
We typically collect and store the following data: Group/Organisation Name, Contact Name, Contact Email, Contact Telephone Number, Address, Area Of Operation, Registered Charity Number, Company Number, Number Of Volunteers & Hours, Number Of Staff, and Who The Group/Organisation Works With.
Additionally for the purposes of internal monitoring we record activities undertaken with a group or organisation by a given member of staff.
Who Holds The Data
Only BPRCVS holds this data as the data controller.
Who Can Access The Data
All BPRCVS staff can access an organisation’s or group’s data.
Data Security
We use a safe and secure CRM database to store all data. Any paper copies are stored safely and securely in a locked drawer or filing cabinet in a locked office.
Data is extrapolated from the form/email and stored in AideCRM to store electronic records of data. This is saved on a secure, on-site server which is backed up daily.
Forms returned via email are stored in Outlook on a secure, off-site exchange server.
How Long Is Data Stored For
The data is stored for up to 7 years in line with our funder’s requirements.
When & How Is The Data Removed & Destroyed
After 7 years has expired all electronic and paper records will be permanently deleted and all paper copies confidentially wasted unless ongoing support is still being provided and such documents hold relevance.
…………………………………………………………………
Health & Wellbeing For Children & Families
Purpose For Collecting & Storing Data
BPRCVS must collect and store personal and special category data about children, parents/guardians and families to register children onto the Health & Wellbeing For Children & Families project.
Basis For Processing Data
The lawful basis for processing this data is consent which was obtained at the referral stage of the project.
What Data Do We Store
The Health & Wellbeing For Children & Families project stores a range of data and collects this data via a number of different forms.
Referral Form (old)
Referrer’s Name, Referrer’s Address, Referrer’s Contact Numbers, Referrer’s Email Address, Child’s Name, Child’s Address, Child’s Phone Number, Child’s Email Address, Child’s Date Of Birth, Care Receiver’s Name, Care Receiver’s Date Of Birth, Care Receiver’s Relationship, Care Receiver’s Care Situation, Ethnicity, School Contact Information, Other Household Member’s Name, Other Household Member’s Relationship, Other Household Member’s Date Of Birth, and Tasks Carried Out By Young Carer.
Referral Form (from May 2024)
Date of Referral, Referral Via, Child’s Name, Child’s Date of Birth, Child’s Address, Gender Assigned At Birth, Gender Identity, GP Name, GP Practice, NHS Number, EMIS Reference, Preferred Language, Ethnicity, Health Issues, School Name, School Contact Name, School Contact Number, School Contact Email, Reasons For Referral, Parent/Guardian Name, Parent/Guardian Date of Birth, Parent/Guardian Address, Parent/Guardian Relationship, Parent/Guardian Health Issues, Parent/Guardian Preferred Language, Other Household Members Details (Name, Age and Relationship), Referrer’s Name, Referring Agency/Organisation, Referrer’s Number, Referrer’s Email, Safe To Visit, Infection Risks, and Additional Relevant Information.
Initial Assessment Form (old)
Child’s Name, Child’s Phone Number, Child’s Email Address, Name Of Person Cared For, Health Condition Of Cared For Person, Names Of Other Household Members, Age Of Other Household Members, Relationship To Other Household Members, Names Of Other Care Providers, Caring Jobs Completed, Family/Friends Information, School/College Information, and Further Referrals Needed.
Parent/Guardian Information Form (old)
Parent/Guardian Name, Parent/Guardian Address, Parent/Guardian Date Of Birth, Parent/Guardian Diagnosis, Names Of Other Family Members, Date Of Birth Of Other Family Members, Relationship To Other Family Members, Contact Details Of Other Professional Agencies, Friends & Family Support Information, Child’s Caring Role, Child’s Health Information, Child’s Education Information, Child’s Interests & Hobbies, Parental/Guardian Consent, Ethnic Origin, and Preferred Language/Means Of Communication.
Young Person’s Initial Assessment Form (from May 2024)
Name of Worker, Initial Assessment Venue, Date of Initial Assessment, Young Person’s Name, Young Person's Date of Birth, School/College, Teacher’s Name, Teacher’s Contact Number, Young Person’s Interests, Clubs Accessed, Current Support Received, Support Required, Friends & Family Information, Feelings About School/College, School/College Attendance, and School/College Support.
Parent/Guardian Initial Assessment & Consent Form (from May 2024)
Child’s Name, Child’s Address, Child’s Ethnic Origin, Child’s Date Of Birth, Emergency Contact Number, Child’s Allergy Information, Child’s Dietary Requirements, Child’s Medical Conditions, Child’s Medication, Consent To Emergency Medical Treatment, Name Of Child’s GP, GP Telephone Number, Swimming Information, Child’s Needs & Limitations, Photographic Consent, Parent/Guardian Name, Parent/Guardian Address, Parent/Guardian Email, Family Structure, Other Agencies Supporting The Family, Friends & Family Support, Child’s Education, Child’s Interests, Support Needs, and Consent.
Photo Consent
Parental/Guardian Consent, Child’s Name, Child’s Address, Child’s Phone Number, Child’s Date Of Birth, and Name Of Parent/Guardian.
Who Holds The Data
BPRCVS holds this data as the data controller.
Who Can Access The Data
Only BPRCVS Health & Wellbeing For Children & Families project staff have access to this data.
Data Security
All paper copies of files, forms and records are stored safely and securely in a locked filing cabinet within a locked office.
All electronic records are stored in our AideCRM database which is saved on a secure off-site server.
How Long Is Data Stored For
All data is stored for as long as a young person is an active project participant and in line with our funder’s requirement which is 5 years.
When & How Is The Data Removed & Destroyed
Upon exiting from the project all electronic records are deleted and paper copies are archived in file storage. After the conclusion of the funder’s storage requirements all paper records are then confidentially wasted.
…………………………………………………………………
Young Carers/We Count/Female Empowerment Project (FEP)
Purpose For Collecting & Storing Data
BPRCVS must collect and store personal and special category data about children, parents/guardians and families to register children onto the Young Carers project.
Basis For Processing Data
The lawful basis for processing the majority of this data is the contractual agreement to which was entered when registering for the project.
However, upon initial assessment and discussions with parents/guardians consent is sought in the initial instance.
What Data Do We Store
The Young Carers project stores a range of data and collects this data via a number of different forms.
Referral Form
Referrer’s Name, Referrer’s Address, Referrer’s Contact Numbers, Referrer’s Email Address, Young Carer’s Name, Young Carer’s Address, Young Carer’s Phone Number, Young Carer’s Email Address, Young Carer’s Date Of Birth, Care Receiver’s Name, Care Receiver’s Date Of Birth, Care Receiver’s Relationship, Care Receiver’s Care Situation, Ethnicity, School Contact Information, Other Household Member’s Name, Other Household Member’s Relationship, Other Household Member’s Date Of Birth, and Tasks Carried Out By Young Carer.
Initial Assessment Form
Young Carer’s Name, Young Carer’s Phone Number, Young Carer’s Email Address, Name Of Person Cared For, Health Condition Of Cared For Person, Names Of Other Household Members, Age Of Other Household Members, Relationship To Other Household Members, Names Of Other Care Providers, Caring Jobs Completed, Family/Friends Information, School/College Information, and Further Referrals Needed.
Parent/Guardian Information Form
Parent/Guardian Name, Parent/Guardian Address, Parent/Guardian Date Of Birth, Parent/Guardian Diagnosis, Names Of Other Family Members, Date Of Birth Of Other Family Members, Relationship To Other Family Members, Contact Details Of Other Professional Agencies, Friends & Family Support Information, Child’s Caring Role, Young Carer’s Health Information, Young Carer’s Education Information, Young Carer’s Interests & Hobbies, Parental/Guardian Consent, Ethnic Origin, and Preferred Language/Means Of Communication.
Parent/Guardian Consent Form
Young Carer’s Name, Young Carer’s Address, Young Carer’s Phone Number, Young Carer’s Date Of Birth, Emergency Contact Number, Young Carer’s Allergy Information, Young Carer’s Dietary Requirements, Young Carer’s Medical Conditions, Young Carer’s Medication, Consent To Emergency Medical Treatment, Name Of Young Carer’s GP, GP Telephone Number, Swimming Information, Young Carer’s Needs & Limitations, Photographic Consent, and Parent/Guardian Name.
Photo Consent
Parental/Guardian Consent, Young Carer’s Name, Young Carer’s Address, Young Carer’s Phone Number, Young Carer’s Date Of Birth, and Name Of Parent/Guardian.
Who Holds The Data
BPRCVS holds this data as the data controller.
Who Can Access The Data
Only BPRCVS Young Carers/ We Count/Female Empowerment Project (FEP) project staff have access to this data.
Data Security
All paper copies of files, forms and records are stored safely and securely in a locked filing cabinet within a locked office.
Data is extrapolated from the form/email and stored in a Microsoft Excel file to store electronic records of data. This is saved on a secure, on-site server which is backed up daily.
Forms returned via email are stored in Outlook on a secure, off-site exchange server.
How Long Is Data Stored For
All data is stored for as long as a young person is an active project participant and in line with our funder’s requirement which is 5 years.
When & How Is The Data Removed & Destroyed
Upon exiting from the project all electronic records are deleted and paper copies are archived in file storage. After the conclusion of the funder’s storage requirements all paper records are then confidentially wasted.
…………………………………………………………………
Community Transport
Communicars
Communicars Passengers
Purpose For Collecting & Storing Data
BPRCVS collects and stores personal data and special category data for the purpose of registering passengers onto the Communicars service.
Basis For Processing Data
The lawful basis for processing your data is contractual agreement to which you agreed when registering with the service.
What Data Do We Store
We store the following personal data for all passengers:
Name, Address, Telephone Number, Date Of Birth, Disabilities/Health Conditions, Blue Badge Holder, and Emergency Contact.
Who Holds The Data
BPRCVS and Shaunsoft hold this data. BPRCVS are the controller of this data. Shaunsoft are the data processor.
Who Can Access The Data
BPRCVS Communicars staff have access to this data and the Shaunsoft cloud-based database staff have access too.
Data Security
Your personal data is stored in a secure cloud-based database.
How Long Is Data Stored For
We only keep your personal data for as long as you remain a Communicars passenger.
If you have not used the service in 12 months we will automatically delete your personal data. This does not affect your statutory rights and you are able to register again in the future.
When & How Is The Data Removed & Destroyed
Upon your exit from the service BPRCVS delete all records from the Shaunsoft cloud-based database.
Communicars Drivers
Purpose For Collecting & Storing Data
BPRCVS collects and stores personal data and special category data for the purpose of registering people as volunteer drivers for the Community Transport service.
Basis For Processing Data
The lawful basis for processing your data is contractual agreement to which you agreed when registering with the service.
We also have a legal obligation to store some personal data, in particular related to you and your vehicle such as driving licence, insurance and tax documents, and MOT certificates.
What Data Do We Store
From the Volunteer Driver Application Form, we store the following data:
Name, Address, Telephone Number, Email Address, Date Of Birth, Car Registration Number, Car Make, and Car Model.
We also store the following driver documents:
- Driving licence
- Insurance documents
- Tax documents
- MOT certificates
Who Holds The Data
BPRCVS and Shaunsoft cloud-based database hold this data. BPRCVS are the controller of this data. Shaunsoft are the data processor.
Who Can Access The Data
BPRCVS Community Transport staff have access to the paper copies and Excel workbook of this data and the Shaunsoft cloud-based database staff have access to the driver’s data stored on the cloud.
Data Security
BPRCVS store the original paper copies of the Volunteer Driver Application Form and driver documents in a secure, locked drawer within a locked office.
BPRCVS also store driver’s personal data on a cloud-based database and an Excel workbook.
How Long Is Data Stored For
BPRCVS only keep your data stored for as long as you remain a Community Transport Volunteer Driver.
When & How Is The Data Removed & Destroyed
Upon your exit from the service all paper copies of your data are confidentially wasted and your data is removed from the cloud based database and Excel workbook.
Minibus
Purpose For Collecting & Storing Data
BPRCVS collected and stores personal data relating to minibus bookings for the purpose of operating the Community Transport Minibus service.
Basis For Processing Data
The lawful basis for processing your data is contractual agreement to which you agreed when placing your minibus booking.
What Data Do We Store
To effectively operate the minibus service we are required to store the following data:
Group/Organisation Name, Group/Organisation Contact Name, Phone, Destination, Date of Journey, Group/Organisation Address, Pickup Address, Return Collection Point, Guide Dog Numbers, Frame/Rollator Numbers, Contribution Costs, and Date.
Who Holds The Data
Only BPRCVS holds this data.
Who Can Access The Data
BPRCVS Community Transport staff have access to the paper copies, Outlook booking calendar, and Excel workbook of this data.
Data Security
All paper copies are stored securely in locked file storage in a locked office. All electronic records are stored securely in Microsoft Excel and Outlook which is backed up daily and stored on a secure, off-site server.
How Long Is Data Stored For
Data is stored for up to a maximum of 5 year.
When & How Is The Data Removed & Destroyed
All paper copies are securely destroyed in confidential waste. All electronic records are deleted. This is done in the event of a cancellation, and upon the conclusion of the 5 year retention period.
…………………………………………………………………
UK Shared Prosperity – People & Skills: Steps To Employment
Purpose For Collecting & Storing Data
The purpose for collecting and storing personal data for this project is to enable registration with, and delivery of the project’s service.
Basis For Processing Data
The lawful basis for processing your data is consent provided when registering with the service.
What Data Do We Store
Several forms are used for the processing of your personal data. Below is a breakdown of what personal data we store:
Participant Entry Form
Organisation, Participant Name, Customer Reference Number, Project Start Date, Gender, Date of Birth, Address, Phone Number, Email, Ethnicity, Eligibility Criteria, Alternative Credible Evidence, Employment Status, Education Status, Education Details, Self-Declaration, Household Situation, Offender Status, Disabilities, Date, and Signature.
Participant Progress Form
Organisation, Participant Name, Customer Reference Number, Project Start Date, Progress Form Date, Activities Undertaken, Date, Time Spent, Signature, Development Objectives, Review Date, and Other Comments.
Participant Expenses Form
Organisation, Participant Name, Customer Reference Number, Expense Description, Date, Amount, Declaration, and Signature.
Participant Exit Form
Organisation, Participant Name, Customer Reference Number, Project Exit Date, Job Start Date, Company Name, Job Title, Hours, Contract Type, Outcomes, Declaration, and Signature.
Who Holds The Data
Views is the electronic database system used to store your data and as such Views is the data controller. BPRCVS is the data processor.
Who Can Access The Data
Only BPRCVS project staff have access to personal data for this project. However, as the lead organisation in the partnership, Calico also have access to the same personal data.
Data Security
All paper forms are stored in locked file storage in a secure, locked office. All electronic records are stored in a secure, online database which is hosted on off-site servers and backed up regularly.
How Long Is Data Stored For
Data will be stored for 6 years after the conclusion of the project on 31st March 2025.
When & How Is The Data Removed & Destroyed
Upon completion of the project and at the end of the retention period, all paper records are destroyed using confidential waste and all electronic records are deleted from the database.
…………………………………………………………………
Room Bookings – The CVS Centre & Gannow Community Centre
Purpose For Collecting & Storing Data
BPRCVS collects and stores data for the purpose of processing room bookings at The CVS Centre and Gannow Community Centre. It is also necessary to store this data for the purpose of issuing invoices to cover charges and payments.
Basis For Processing Data
The lawful basis for processing this data is contractual agreement which you agreed to when completing the Room Booking form.
What Data Do We Store
For both centres we store the following personal data:
Name, Organisation Name, Address, Telephone Number, Email Address, and Invoice Name & Address.
Who Holds The Data
Only BPRCVS holds the data as the data controller.
Who Can Access The Data
Reception staff at BPRCVS and the finance department has access to this data.
All BPRCVS staff have access to the Outlook calendar which forms part of the room booking system.
Data Security
Room Booking forms are stored on file in a secure, locked filing cabinet.
Contact details are stored in an Outlook calendar which forms part of our room booking system. Outlook is stored on a secure off-site exchange server.
How Long Is Data Stored For
BPRCVS store this data for up to a maximum of 12 months after your booking.
When & How Is The Data Removed & Destroyed
After 12 months from the date of your booking the form is removed from file storage and confidentially wasted.
…………………………………………………………………
Tenancy
Purpose For Collecting & Storing Data
BPRCVS collects and stores data for the purpose of processing tenancy at The CVS Centre. It is also necessary to store this data for the purpose of issuing invoices to cover charges and payments.
Basis For Processing Data
The lawful basis for processing this data is contractual agreement which you agreed to when completing the Tenancy Agreement.
What Data Do We Store
The Tenancy Agreement only contains a date and signature. We do however need to store additional details for the purpose of invoicing. This includes:
Group/Organisation Name, Contact Name, Contact Details, and Address.
Who Holds The Data
Only BPRCVS holds this data as the data controller.
Who Can Access The Data
The centre manager, reception staff and the finance department have access to this data.
Data Security
Tenancy Agreements are stored on file in a secure, locked filing cabinet within a locked office.
Invoices are stored on file in a secure, locked filing cabinet within a locked office.
How Long Is Data Stored For
BPRCVS store this data for up to a maximum of 12 months after your tenancy expires.
Invoices are stored for a maximum of 7 years from the date of issue.
When & How Is The Data Removed & Destroyed
After 12 months from the date your tenancy expires all records are removed from file storage and confidentially wasted.
…………………………………………………………………
Payroll
Purpose For Collecting & Storing Data
It is necessary to collect and store this data to enable BPRCVS Payroll Service to complete payroll functions on behalf of your organisation.
Basis For Processing Data
The lawful basis for processing this data is contractual agreement which you agreed to when completing the Payroll Service Agreement.
What Data Do We Store
For the purpose of processing payroll on behalf of your organisation it is essential that we store the following personal data:
Employer
Organisation/Group Name, Address, Telephone Number, Fax Number, Email Address, Contact Person Name & Telephone Numbers, Secondary Contact Name, Secondary Contact Telephone Numbers, Tax District & Reference Number, Accounts Office Reference, and Authorised Signatories.
Employee
Organisation/ Group Name, Name, Address, Date Of Birth, Employment Start Date, Tax Code, National Insurance Number, Marital Status, Gender, Salary, Pension Contribution, P11, P45, and P46.
Who Holds The Data
Only BPRCVS holds this data as the data processor. The respective organisations are the data controller.
Who Can Access The Data
The BPRCVS finance department are the only staff who have access to this data.
Data Security
The data is stored and processed using secure payroll software installed on a secure, on-site server.
Completed paper forms are stored in file storage in a locked filing cabinet in a locked office.
Some completed documents are stored on hard drives of finance department computers which are connected to a secure, on-site server and password protected.
How Long Is Data Stored For
Personal data is stored for as long as an organisation uses the BPRCVS Payroll Service.
We also keep copies of accounts from each organisation on-site. We store 12 months’ worth before asking each organisation to come and collect their records.
Account summary reports are stored indefinitely in case queries or issues are raised.
When & How Is The Data Removed & Destroyed
Personal data relating to both employers and employees stored on paper forms will be confidentially wasted upon leaving the Payroll Service.
Personal data stored electronically is deleted upon leaving the Payroll Service.
…………………………………………………………………
The CVS Centre Volunteer Application Form
Purpose For Collecting & Storing Data
BPRCVS collects and stores personal data obtained from prospective volunteers applying for reception opportunities at The CVS Centre. This enables us to conduct interviews and recruit volunteers.
Basis For Processing Data
The lawful basis for processing this data is contractual agreement.
What Data Do We Store
BPRCVS collects and stores the following data:
Name, Gender, Date Of Birth, Address, Telephone Numbers, Email Address, Availability, Skills, Disabilities Or Significant Illnesses, Personal Reference Details, Employment Status, Ethnicity, and Prosecutions Pending Or Unspent Convictions.
Who Holds The Data
Only BPRCVS holds this data as the data controller.
Who Can Access The Data
Only the BPRCVS volunteer coordination team can access this information.
Data Security
All applications received are stored safely and securely on file in a locked filing cabinet within a locked office.
How Long Is Data Stored For
The data is only stored for as long as the individual remains a volunteer for BPRCVS.
When & How Is The Data Removed & Destroyed
Upon a volunteer’s exit from the company the paper files are confidentially wasted.
…………………………………………………………………
BBO Projects
Purpose For Collecting & Storing Data
For individuals to participate in any of the BBO projects it is necessary to collect and store personal, and in some cases, special category data. The data collected enables BPRCVS and other project partners to determine whether a participant is viable for the project based on pre-determined criteria.
Basis For Processing Data
The lawful basis for processing this data is contractual agreement to which you agreed.
What Data Do We Store
BPRCVS needs to collect and store the following data for each respective project.
BBO1 – Age Of Opportunity
For this BBO project BPRCVS only collects the individuals name, address and contact details for the purpose of referring to Age UK. All other BBO1 project forms are completed by Age UK with the exception of the form below.
Life Circle
The purpose of this form is to determine eligibility for the project. The only personal and identifiable data collected and stored in this form is the Participant Name. The form collects data associated with personal opinions on the following topical areas: Education & Training, Motivation, Self-Care, Money & Budgeting, Support Networks, Wellbeing, Physical Health, Housing, Confidence, and Employment.
BBO3 – Changing Futures
Participant File
We collect and store your Name, National Insurance Number and a Customer Reference Number used to identify you.
Annex H – Participant Entry Form
We collect and store the following data:
Participant Name, National Insurance Number, Customer Reference Number, Start Date, Previous Involvement With Another BBO Project, Gender, Date Of Birth, Address, Telephone Numbers, Email Address, Ethnicity, Eligibility, Employment Status, Education, Qualifications, Household Situation Details, Criminal Convictions, Disabilities & Long-Term Health Conditions, Sexual Orientation, and a Declaration.
Annex I – Participant Progress Form
We collect and store the following data:
Participant Name, National Insurance Number, Customer Reference Number, Start Date, Details Of Activities Undertaken, and a Development Action Plan.
Annex J – Participant Exit Form
We collect and store the following data:
Participant Name, National Insurance Number, Customer Reference Number, Leaving Date, Project Exit Results, Education & Training Details, Employment Or Self-Employment Details, Job Search Details, Employment Status On Leaving, and a Declaration.
Annex N – Participant Expenses, Allowances & Incentives Form
We collect and store the following data:
Participant Name, National Insurance Number, Customer Reference Number, Expense Details, Expense Evidence, Allowances & Incentives, and a Declaration.
Confirmation Of Starting Employment (Result) Form
We collect and store the following data:
Employer Name, Employer Address, Employee Name, Started Work Date, Position, and Signatory.
Confirmation Of Starting Education Or Training (Result) Form
We collect and store the following data:
College/Training Provider Name, College/Training Provider Address, Student Name, Started Learning Date, Course Title, and Signatory.
Confirmation Of Employment Status (3rd Party) Form
We collect and store the following data:
Participant Name, Participant Address, Name Of Third Party, Address Of Third Party, Occupation Of Third Party, Organisation Represented, Capacity In Which Applicant Is Known, Length Of Time Applicant Has Been Known, and a Declaration.
Confirmation Of Employment Status (Self-Certification) Form
We collect and store the following data:
Participant Name, Participant Address, Participant Declaration, and the Reasons For Self-Declaration.
Life Circle
The only personal and identifiable data collected and stored in this form is the Participant Name. The form collects data associated with personal opinions on the following topical areas: Education & Training, Motivation, Self-Care, Money & Budgeting, Support Networks, Wellbeing, Physical Health, Housing, Confidence, and Employment.
BBO4 – ReachIT
The only data BPRCVS store is the names of persons identified to partake in Digital Champion training. Contact the organisation you registered as a participant with for how they collect and store your data.
Who Holds The Data
BPRCVS are the processors of this data. Age UK also process BBO1 – Age Of Opportunity Data. The controllers of this data are Selnet (BBO1 – Age Of Opportunity & BBO3 – Changing Futures) and WEA (BBO4 – ReachIT).
Who Can Access The Data
Selnet, Age UK and BPRCVS can access the data collected and stored for the BBO1 – Age Of Opportunity project.
Selnet and BPRCVS can access the data collected and stored for the BBO3 – Changing Future project.
WEA and BPRCVS can access the data collected and stored for the BBO4 – ReachIT project.
Big Lottery Fund and the E.U. may also be privy to some of the data collected as partner organisations are required to report in-depth about the project.
Data Security
All paper copies are filed away safely and securely in a locked filing cabinet within a locked office. All electronic records are stored safely and securely on an off-site server using a CRM program called Views for BBO1 and BBO3. BBO4 files are stored using a different CRM system called I-Web Storage.
How Long Is Data Stored For
The data is stored in line with funder’s requirements for a maximum of 11 years after the conclusion of the project as determined by the EU.
When & How Is The Data Removed & Destroyed
Upon conclusion of the 11-year storage period for E.U. funded projects all paper copies stored on file will be confidentially wasted and all electronic records permanently deleted from the Views CRM.
…………………………………………………………………
ESOL
Purpose For Collecting & Storing Data
BPRCVS are not responsible for the collection of data associated with this project, but we do store basic contact details for each family. BPRCVS make take photos of events and activities undertaken as part of the project. In this instance BPRCVS will seek consent prior to processing photos.
Basis For Processing Data
The basis for processing this data is contractual agreement.
When processing photos of events, etc. the basis for this processing is consent.
What Data Do We Store
BPRCVS only stores names, addresses and contact details for each family on the project. We may also store a photo consent form containing a signature and date.
Who Holds The Data
BPRCVS holds this data along with Calico. BPRCVS are the data processor and Calico are the data controller.
Who Can Access The Data
Calico are the data controller and BPRCVS the data processor for this project. As such Calico have access to all data provided for this project. Only BPRCVS ESOL workers have access to the personal data stored.
Data Security
All personal data is stored safely and securely on file in a locked office.
How Long Is Data Stored For
The data will be stored for 11 years after the project end date.
When & How Is The Data Removed & Destroyed
Upon completion of the project BPRCVS will remove all records from our files. All paper copies will be confidentially wasted, and any electronic records permanently deleted.
…………………………………………………………………
Job Applications
Purpose For Collecting & Storing Data
It is essential that BPRCVS collect and store personal and special category data for the purpose of reviewing and assessing candidates, contacting for interviews and recruiting into post.
Basis For Processing Data
The lawful basis for processing job applications is contractual agreement.
What Data Do We Store
For the purpose of processing job applications, we store the following data:
Name, Address, Telephone Numbers, Email Address, Present/Most Recent Employer Name Details Including Salary, Education History, Qualifications, Training, Past Employment Details, Driving Licence, References Details, Disabilities Or Significant Illnesses, Criminal Convictions, and Equal Opportunities Information Including Sexual Orientation, and Disability & Ethnicity.
Who Holds The Data
Only BPRCVS holds this data as the data controller.
Who Can Access The Data
Only BPRCVS HR staff can access this data for processing.
Data Security
All applications are stored safely and securely in a locked filing cabinet within a locked office.
How Long Is Data Stored For
BPRCVS stores all job applications for 5 years.
When & How Is The Data Removed & Destroyed
Upon completion of the 5-year storage period all job applications are confidentially wasted.
If you have selected the option to not to be stored beyond the deadline of the job for which you have applied your application will be confidentially wasted after the recruitment process has been completed.
…………………………………………………………………
Membership Applications
Purpose For Collecting & Storing Data
BPRCVS are a member-led organisation and as such we are required to store the details of all members of our organisation. In addition to this some of our services are member only and we need to store details as proof of access to such services. Furthermore, we require the contact details of all members to invite them to the AGM.
Basis For Processing Data
Consent has been given by completing and signing a declaration on the Membership Application form.
What Data Do We Store
For the purpose of recording BPRCVS members we require to store the following data:
Group/Organisation Name, Membership Contact Person, Membership Contact Details, Group/Organisation Address, Contact Preferences, Area Of Operation, Registered Charity Number, Company Number, Number Of Volunteers & Hours, Number Of Staff, Services Provided, and the Group/Organisation’s Aims.
Who Holds The Data
Only BPRCVS store this data as the data controller.
Who Can Access The Data
BPRCVS administrative staff are processors of this data.
Data Security
All data is stored safely and securely using the following methods:
Paper copies are stored on file in a secure office that is locked when empty.
Data is extrapolated from the form and stored in a database. The database is hosted on a secure, on-site server. Regular backups are taken for additional security. These backups are stored securely on removable media which are stored off-site.
Forms returned via email are stored in Outlook on a secure, off-site exchange server.
How Long Is Data Stored For
BPRCVS stores membership data for a minimum of 2 years; 1 year active and 1 year lapsed.
The maximum amount of time depends on how long you remain a member of BPRCVS.
Basic electronic records are kept after expiration of membership for the purpose of internal monitoring.
When & How Is The Data Removed & Destroyed
If membership is not renewed after the lapsed year the paper copy is destroyed in confidential waste and any non-required data is removed from the database.
Database records will be deleted upon a periodic audit completed every 5-7 years in line with funder's requirements.
Upon completion of processing the form any emails containing Membership Application data will be deleted.
Membership Renewals
Purpose For Collecting & Storing Data
BPRCVS collects and stores membership renewal data for the purpose of determining whether you are an active or lapsed member.
Moreover, the annual renewal process enables BPRCVS to maintain accurate records.
Basis For Processing Data
Consent has been given by completing and signing a declaration on the Membership Renewal form.
What Data Do We Store
For the purpose of recording BPRCVS membership renewals we require to store the following data:
Group/Organisation Name, Membership Contact Person, Membership Contact Details, Group/Organisation Address, Contact Preferences, Area Of Operation, Registered Charity Number, Company Number, Number Of Volunteers & Hours, Number Of Staff, Services Provided, and the Group/Organisation’s Aims.
Who Holds The Data
Only BPRCVS store this data as the data controller.
Who Can Access The Data
BPRCVS administrative staff are processors of this data.
Data Security
All data is stored safely and securely using the following methods:
Paper copies are stored on file in a secure office that is locked when empty.
Data is extrapolated from the form and stored in a database. The database is hosted on a secure, on-site server. Regular backups are taken for additional security. These backups are stored securely on removable media which are stored off-site.
Forms returned via email are stored in Outlook on a secure, off-site exchange server.
How Long Is Data Stored For
BPRCVS stores membership data for a minimum of 2 years; 1 year active and 1 year lapsed.
The maximum amount of time depends on how long you remain a member of BPRCVS.
When & How Is The Data Removed & Destroyed
If membership is not renewed after the lapsed year the paper copy is destroyed in confidential waste and the record is removed from the database.
Upon completion of processing the form any emails containing Membership Renewal data will be deleted.
…………………………………………………………………
Organisation Directory
Purpose For Collecting & Storing Data
BPRCVS store organisation and group contact details for the ease of accessing contact details in one central location. This enables BPRCVS to easily contact groups and organisations with whom we may work. Furthermore, storing this data enables BPRCVS to signpost potential clients, service users, customers, etc. to your organisation, group, project or service.
Some contact details are publicly listed and therefore no consent has been sought as long as there is no personal data in the record. Where personal data exists BPRCVS seeks consent to store the data. BPRCVS also seek consent to signpost persons to your organisation or group.
Basis For Processing Data
Consent has been given by completing and signing a declaration on the Organisation Registration form.
What Data Do We Store
Group/Organisation Name, Membership Contact Person, Membership Contact Details, Group/Organisation Address, Contact Preferences, Area Of Operation, Registered Charity Number, Company Number, Number Of Volunteers & Hours, Number Of Staff, Services Provided, and the Group/Organisation’s Aims.
Who Holds The Data
Only BPRCVS store this data as the data controller.
Who Can Access The Data
All BPRCVS staff are able to access the data.
Data Security
All data is stored safely and securely using the following methods:
Paper copies are stored on file in a secure office that is locked when empty.
Data is extrapolated from the form and stored in a database. The database is hosted on a secure, on-site server. Regular backups are taken for additional security. These backups are stored securely on removable media which are stored off-site.
Forms returned via email are stored in Outlook on a secure, off-site exchange server.
How Long Is Data Stored For
As storing organisation and group details is a crucial aspect of BPRCVS’ business operations we store all records that contain no personal data indefinitely, unless a periodic audit determines that the organisation or group is no longer in operation or suitable for BPRCVS to work with.
Records where personal data exists will be audited annually. The Organisation Registration form will be distributed to all organisations and groups found in the database. Upon receipt of this form your record will be amended where necessary.
Forms returned via email and stored in Outlook will be kept in this location until processing occurs.
When & How Is The Data Removed & Destroyed
You, the data subject, can request to have data amended, or removed and destroyed at any time by submitting a data subject access request.
From the annual audit, if we don’t receive the Organisation Registration form back from you by the date given this will lead to your record being permanently removed from the database. This also applies to paper copies stored on file. Paper copies are destroyed in confidential waste.
Upon completion of processing the form any emails containing Organisation Registration data will be deleted.
…………………………………………………………………
Funding
Purpose For Collecting & Storing Data
When applying for funding from any BPRCVS administered funding programme it is necessary to collect and store personal data in order to determine the award of funding based on the respective criteria.
Basis For Processing Data
The basis for processing data is a contractual agreement which you entered when applying for funding. This applies to all BPRCVS administered funding programmes.
What Data Do We Store
In order to process applications for funding it is necessary to collect and store personal data:
Lancashire & South Cumbria Integrated Care Board (LSC ICB) Social Prescribing Funding Programme (formerly known as East Lancashire Clinical Commissioning Group Prescription For Wellbeing Funding Programme, and East Lancashire Clinical Commissioning Group Social Prescribing Small Grants Programme)
Group/Organisation Name, Group/Organisation Address, Numbers Of Staff, Numbers Of Volunteers, Legal Status, Charity Number, CIC Number, Names Of People In Group/Organisation, Contact Name, Contact Address, Contact Preferences, Bank Details, and Project Related Details.
Gannow Big Local Community Fund
Group/Organisation Name, Group/Organisation Address, Numbers Of Staff, Numbers Of Volunteers, Names Of People In Group/Organisation, Contact Name, Contact Address, Contact Preferences, Bank Details, Project Related Information, and Financial Details.
Gannow Big Local Community Event Fund
Group/Organisation Name, Group/Organisation Address, Numbers Of Staff, Numbers Of Volunteers, Names Of People In Group/Organisation, Contact Name, Contact Address, Contact Preferences, Bank Details, Event Information, and Financial Details.
Eric Wright Charitable Trust Grant
Group/Organisation Name, Group/Organisation Address, Numbers Of Staff, Numbers Of Volunteers, Annual Turnover, Names Of People In Group/Organisation, Contact Name, Contact Address, Contact Preferences, Bank Details, Project Details, and Financial Details.
Cliviger Community Benefit Fund
Group Name, Project/Activity Name, Address, When Group Was Established, How Many People Are Involved In The Group Including Volunteers, Staff, Committee & Members, Details Of Larger Organisation (if part of), Information Regarding Previous Grant From Cliviger Fund, Contact Name, Contact Address, Contact Telephone Numbers, Contact Email, Bank/Building Society Name & Address, Project Details, Financial Details, and Declaration Signatories.
The Distress Fund
Parents Names, Children’s Names, Address, Dates Of Birth, and Personal Circumstances.
UK Shared Prosperity Fund – Burnley Community Grant Scheme
Organisation/Group Name, Project Name, Amount Requested, Previous Funding Report Received, Success Status, Organisation/Group Address, Establishment, Number of People Involved, Part of a Larger Organisation, Legal Status, VAT Registration Number, Name of Signatories, Signatories Position, Contact Name, Contact’s Position, Contact’s Address (if different), Preferred Contact, Bank/Building Society Name, Bank/Building Society Address, Cheques Payable To, Project Details, Contingency Plans, Groups/Individuals Targeted, Engagement, Beneficiaries, Community Consultation, Interventions, Locality, Delivery Date, Sessional Information, Additional Information, and Financial Details.
Population Health Management
Group/Organisation Name, Address, Establishment, Number of People Involved, Part of a Larger Organisation, Legal Status, Name of Signatories, Signatories Position, Contact Name, Contact’s Position, Contact’s Address (if different), Preferred Contact, Bank/Building Society Name, Bank/Building Society Address, Cheques Payable To, Project Details, Contingency Plans, Beneficiaries, Community Consultation, Locality, Delivery Date, Sessional Information, Additional Information, Themes, Financial Details, and Amount Applied For.
Lancashire County Council Over 50s Social Isolation Grant
Group/Organisation Name, Project Name, Date Received, Amount Requested, Successful Status, Locality, Previous Reports Received, Address, Established, Number of People Involved, Part of a Larger Organisation, Legal Status, Signatories Name, Signatories Position, Contact Name, Contact’s Position, Contact’s Address (if different), Preferred Contact, Bank/Building Society Name, Bank/Building Society Address, Cheques Payable To, Project Details, Contingency Plans, Beneficiaries, Community Consultation, Delivery Details, Sessional Details, Additional Information, Financial Details, Project Cost, and Additional Funding.
Who Holds The Data
Only BPRCVS holds the data as the data controller for all funds except the Distress Fund, of which Lancashire County Council is the data controller.
Who Can Access The Data
Only the BPRCVS funding team has complete access to this data except the Distress Fund, which is accessible by BPRCVS’ finance department. Lancashire County Council and our accountants, Ashworth Moulds, also have access to Distress Fund data.
Burnley Borough Council has access to UK Shared Prosperity applications.
Lancashire & South Cumbria Integrated Care Board has access to Population Health Management applications.
Where funding applications are awarded via a panel, the members of the panel will have temporary access to the data.
Data Security
All application data on paper, successful or otherwise, is stored safely and securely in a locked filing cabinet within a locked office.
Some limited personal data is recorded in electronic systems such as email and databases, both of which are stored on secure servers.
Distress fund applications are received from referral agencies via secure encrypted email. Personal data is stored on a secure Lancashire County Council database. BPRCVS do not store any of this data electronically.
How Long Is Data Stored For
The data is only stored for as long as each funder requires, of which:
Lancashire & South Cumbria Integrated Care Board (LSC ICB) Social Prescribing Funding Programme (formerly known as East Lancashire Clinical Commissioning Group Prescription For Wellbeing Funding Programme, and East Lancashire Clinical Commissioning Group Social Prescribing Small Grants Programme) – is stored for a maximum of 7 years
Gannow Big Local Community Fund – is stored for a maximum of 10 years up to 2025
Gannow Big Local Community Event Fund – is stored for a maximum of 10 years up to 2025
Eric Wright Charitable Trust Grant – is stored for a maximum of 7 years
Cliviger Community Benefit Fund – is stored for a maximum of 10 years up to 2036
Distress Fund – is stored for a minimum of 2 years and up to a maximum of 7 years.
UK Shared Prosperity – is stored for a maximum of 7 years.
Population Health Management – is stored for a maximum of 7 years.
L.C.C. Over 50s Social Isolation Grant – is stored for a maximum of 7 years.
When & How Is The Data Removed & Destroyed
All Distress Fund data accessible by BPRCVS via the Lancashire County Council database are automatically deleted periodically.
All paper copies of Distress Fund applications are removed and confidentially wasted after 7 years.
Data from unsuccessful Distress Fund applications is removed and deleted from our email system upon the unsuccessful outcome.
For all other funding applications where the outcome was unsuccessful the paper and electronic records containing personal data are removed, deleted and confidentially wasted at the end of each calendar year.
When the funding application is successful the records are removed, deleted and confidentially wasted in line with our funder’s requirements.
…………………………………………………………………
Events
Purpose For Collecting & Storing Data
When we organise and/or host events it can be necessary to collect, process and store personal data in relation to the event.
Basis For Processing Data
Depending upon the event in question the lawful basis for processing will either be consent or contractual agreement. Please refer to the original document you completed associated with the respective event for the specific lawful basis; if consent is not being asked for you can automatically assume the lawful basis as contractual agreement, unless otherwise stated.
What Data Do We Store
The data we collect and store for processing will vary depending upon the type and nature of the event.
Typically, we would collect the following personal data (not all data will be collected for every event):
Name, Address, Date Of Birth, Phone Number, Email Address, Locality, Group/Organisation Name, Group/Organisation Address, and Group/Organisation Contact Details.
If you have any specific queries relating to data being stored from a BPRCVS event please contact the event organiser via the contact details on the sign-up forms, registration documents, marketing materials or other promotional materials and content.
Who Holds The Data
BPRCVS store this data as the data controller.
Third parties, such as Eventbrite and Ticketsource, may also be a data controller and data processor.
Who Can Access The Data
The relevant BPRCVS event staff are able to access the data.
Third parties, such as Eventbrite and Ticketsource, may be able to access your data.
Data Security
All data is stored safely and securely using one or more of the following methods:
Paper copies are stored on file in a secure office that is locked when empty.
Data is extrapolated from the form/email and stored in a Microsoft Excel file to store electronic records of data. This is saved on a secure, on-site server which is backed up daily.
Forms returned via email are stored in Outlook on a secure, off-site exchange server.
For how third parties, such as Eventbrite and Ticketsource, keep your data secure please refer to their respective policies.
How Long Is Data Stored For
BPRCVS store personal data associated with events for as long as our funders require it. This can vary and will be dependent upon the funder in question. Typically, this will range from 5-7 years.
If it is not directly associated with one of our funders then BPRCVS store all records pertaining events for a period of 5 years.
For how long third parties, such as Eventbrite, store your data for please refer to their policies.
When & How Is The Data Removed & Destroyed
Upon conclusion of the either the funder’s or BPRCVS’ storage requirements all records, paper and electronic, will be confidentially wasted and removed from any electronic storage solutions.
…………………………………………………………………
Gannow Food Share
Purpose For Collecting & Storing Data
To record the numbers of food parcels collected and the areas to which we're providing support to compare with areas of deprivation.
Basis For Processing Data
The basis for processing data is consent agreed upon collection.
What Data Do We Store
For the purpose of Food Share we only record the name, address and how many children there are in the family when relevant.
Who Holds The Data
Only BPRCVS store this data as the data controller.
Who Can Access The Data
The relevant BPRCVS staff are able to access the data.
Data Security
All data is stored safely and securely in a database file stored on a secure server.
How Long Is Data Stored For
BPRCVS store personal data associated with Food Share for 2 years.
When & How Is The Data Removed & Destroyed
All personal data is deleted after being stored for 2 years.
…………………………………………………………………
Burnley Together Food Parcels
Purpose For Collecting & Storing Data
To record the numbers of food parcels to be collected and by whom.
Basis For Processing Data
The basis for processing data is consent agreed via registration with Burnley Together.
What Data Do We Store
For the purpose of issuing Burnley Together Food Parcels we receive and store the following data:
Name, House Number, Number of Adults, Number of Children, Collection Point, Date, and Dietary Requirements.
Who Holds The Data
Burnley Together store this data as the data controller. BPRCVS are the data processor.
Who Can Access The Data
Only BPRCVS reception and Gannow Community Centre staff/volunteers are able to access the data.
Data Security
All data is stored safely and securely in a locked office.
How Long Is Data Stored For
BPRCVS store this data until the food parcel has been collected at which point the collector takes the paper record with them.
When & How Is The Data Removed & Destroyed
In the event they don’t take the paper record, it is immediately securely destroyed in confidential waste.
…………………………………………………………………
ESIF Passport To Employment
Purpose For Collecting & Storing Data
This project uses a variety of documents to collect and store data necessary for the running of the project. The purpose of these documents is to determine involvement with the project; to enter participants into the project; to monitor and provide support to participants; to record participant progress; and to record participant wellbeing.
Basis For Processing Data
Consent is given by the participant when joining the project by completing and signing a declaration giving permission to collect and store the required data for the purpose of the ESIF project.
What Data Do We Store
This project uses a number of different forms to collect personal data that we are required by our funder to store for processing.
Evidence Requirements
Passport, Right To Work Card, Birth Certificate, Adoption Certificate, Phone/Utility/Energy Bill, Current Tenancy Agreement, DWP Letter, and Jobcentre/Universal Credit Journal.
Participant Entry Form
Full Name, National Insurance Number, Participant Reference Number, Project Start Date, Referral Information, Additional Information, Gender, Date Of Birth, Address, Telephone Numbers, Email Address, Ethnicity, Eligibility, Employment Status, Benefits Information, Qualifications, Housing Information, Parenting Information, Offender Information, and Health Information.
Basic Engagement Form/Client Progress Record
Full Name, National Insurance Number, Date Of Birth, Address, Telephone Numbers, Email Address, Ethnicity, Record Of Actions Completed and Journey Undertaken, and Support Needed Information.
ONS4 Wellbeing Survey
Full Name, Date Of Birth, VIEWS Reference Number, GP Surgery, Medical Appointment History, and Wellbeing Information.
Participant Exit Form
Full Name, National Insurance Number, Participant Reference Number, Project Leaving Date, Achievements, Education/Training Information, Employment Information, Qualifications, Job Search Information, Employment Status, and Feedback.
Who Holds The Data
BPRCVS and Views hold the data for participants involved in the project. Views are the data controller and BPRCVS are the data processor.
Who Can Access The Data
BPRCVS, Views and Community CVS can access the data through the shared cloud portal.
Data Security
All data contained in paper records are stored safely and securely in lockable BPRCVS file storage within a locked office.
We use Views CRM Database to store electronic records of data. This is a secure cloud-based database hosted on secure, off-site servers.
How Long Is Data Stored For
All data collected, stored and processed for the ESIF project is stored for as long as the funder requires it. This is 11 years after project completion.
When & How Is The Data Removed & Destroyed
Upon completion of the funder’s storage requirements all electronic records are to be deleted and all paper files are to be confidentially wasted.
…………………………………………………………………
Emergency Assistance/Winter Grant Scheme
Purpose For Collecting & Storing Data
These grant schemes required data to be collected to enable BPRCVS to issue grants to those who qualified. The purpose of these documents is to determine qualifying criteria and record the recipient's contact information.
Basis For Processing Data
Consent is given by the recipient by completing and signing a declaration giving permission to collect and store the required data for the purpose of these grants schemes.
What Data Do We Store
Both schemes use a form to collect personal data that we are required by our funder to store for processing. Depending on when the referral was made, two different forms have been used.
This is the data we store using the earliest version of the form:
Name, Date Of Birth, Address, Email Address, Contact Number, Ethnicity, Gender, NHS Number, GP Name, GP Practice, Date Of Referral, Reason For Referral, Specific Support Required, Name Of Agency Referring, Name Of Agent Completing The Form, Agent's Telephone Number, Agent's Email Address, and Next Of Kin/Emergency Contact Details.
This is the data we store using the second version of the form:
Name, Date Of Birth, Address, Email Address, Contact Number, Ethnicity, Gender, Reason For Referral, Specific Support Required, Name Of Agency Referring, Name Of Agent Completing The Form, Agent's Telephone Number, and Agent's Email Address.
Who Holds The Data
BPRCVS holds the data for this scheme as the data controller.
Who Can Access The Data
Only BPRCVS can access the data.
Data Security
All data contained in paper records are stored safely and securely in lockable BPRCVS file storage within a locked office.
We use Microsoft Excel to store electronic records of data. This is saved on a secure, on-site server which is backed up daily.
How Long Is Data Stored For
All data collected, stored and processed for the grant schemes is stored for up to a maximum of 7 years.
When & How Is The Data Removed & Destroyed
Upon completion of the funder’s storage requirements all electronic records are to be deleted and all paper files are to be confidentially wasted.
…………………………………………………………………
Household Support Scheme
Purpose For Collecting & Storing Data
This grant scheme requires data to be collected to enable BPRCVS to issue grants to those who qualify. The purpose of these documents is to determine qualifying criteria and to record the recipient's contact information.
Basis For Processing Data
Consent is given via a checkbox on referral forms, or by the recipient verbally over the phone by agreeing to a declaration giving permission to collect and store the required data for the purpose of these grants schemes.
What Data Do We Store
We use a form to collect personal data that we are required by our funder to store for processing.
This is the data we store:
Name, Date Of Birth, Address, Email Address, Contact Number, Ethnicity, Gender, Family Status, Reason For Referral, Specific Support Required, Name Of Agency Referring, Name Of Agent Completing The Form, Agent's Telephone Number, and Agent's Email Address.
Who Holds The Data
Burnley Household Support Scheme - Burnley Borough Council are the data controller and BPRCVS the appointed data processor on behalf of Burnley Borough Council.
Pendle Household Support Scheme - BPRCVS and Pendle Borough Council are joint data controllers and BPRCVS is the appointed data processor on behalf of Pendle Borough Council.
Rossendale Household Support Scheme - Rossendale Borough Council are the data controller and BPRCVS the appointed data processor on behalf of Rossendale Borough Council.
Please see your respective council's privacy policy for your rights as a data subject.
Who Can Access The Data
Only BPRCVS and your respective local council can access the data.
Data Security
All data contained in paper records are stored safely and securely in lockable BPRCVS file storage within a locked office.
We use Microsoft Excel to store electronic records of data. This is saved on a secure, on-site server which is backed up daily.
How Long Is Data Stored For
All data collected, stored and processed for the grant schemes is stored for up to 7 years.
When & How Is The Data Removed & Destroyed
Upon completion of the funder’s storage requirements all electronic records are to be deleted and all paper files are to be confidentially wasted.
…………………………………………………………………
Launch Into Your Future
Purpose For Collecting & Storing Data
The purpose for collecting and storing data is to enable the project to recruit suitable candidates into employment.
Basis For Processing Data
The lawful basis for processing data is contractual agreement.
What Data Do We Store
Name, Date of Birth, Address, Phone, Email, National Insurance Number, Employment History, and Benefits.
Who Holds The Data
BPRCVS holds the data as the data controller for this project. Community CVS (project partner) also have access to this data.
Who Can Access The Data
Only the Launch Into Your Future coordinator has access to this data.
Data Security
All paper files are stored in secure file storage in a locked office. All electronic records are stored securely using appropriate systems.
How Long Is Data Stored For
Stored for 11 years after project completion date.
When & How Is The Data Removed & Destroyed
Upon completion of the project’s record retention period, the data will be removed from file storage and confidentially wasted, and all electronic systems will have records deleted.
…………………………………………………………………
ESIF Upskilling Project
Purpose For Collecting & Storing Data
The purpose for collecting and storing data is to enable the project to recruit candidates into skills-based training.
Basis For Processing Data
The lawful basis for processing data is contractual agreement.
What Data Do We Store
This project utilises several forms to collect and store data:
Organisational Diagnostic Form
Organisation Name, Address, Phone, Contact Name, Contact Role, Contact Phone, Legal Status, Registration Numbers, HMRC Registration, About The Organisation Details, Marketing & Communications Details, Financial Details, Future Proofing & Sustainability Information, Self-Assessment, Organisational Structure, State Aid De Minimis Regulations Declaration, and Signatory.
Entry Form
Participant VIEWS Number, Project Join Date, Name, Gender, Date of Birth, Address, Phone Numbers, Email, Eligibility, Organisation Name, Organisation Address, Equality Information, Disability Information, Household Situation, Religion/Belief, Sexual Orientation, Additional Information, and Education.
Organisation Training & Development Plan
Advisor Name, Date, Organisation Name, Contact Name, Address, Phone, Email, Website, Registration Numbers, Notes, About The Organisation, Other Observations, Training Action Plan, Confirmed Training Plan, and Signatories.
Personal Development Plan
Name, Date, Organisation Name, Job Title, Responsibilities, Achievements and Qualifications, Upskilling Opportunities, Strengths, Area for Development, Short Term Employment Goals, Long Term Career Goals, and Signatories.
Who Holds The Data
BPRCVS holds the data as the data controller for this project.
Who Can Access The Data
Only the ESIF Upskilling coordinator has access to this data.
Data Security
All paper files are stored in secure file storage in a locked office. All electronic records are stored securely using appropriate systems.
How Long Is Data Stored For
Stored for 11 years after project completion date.
When & How Is The Data Removed & Destroyed
Upon completion of the project’s record retention period, the data will be removed from file storage and confidentially wasted, and all electronic systems will have records deleted.
…………………………………………………………………
Children’s Personal Health Budget
Purpose For Collecting & Storing Data
Personal data is collected and stored for the purpose of awarding grants to individuals to assist with their physical health and wellbeing.
Basis For Processing Data
The lawful basis for processing data is contractual agreement.
What Data Do We Store
For the purposes of issuing grants we are required to store the following data:
Date of Referral, Name, Date of Birth, Address, Phone Number, Email, Parent/Guardian Name, Parent/Guardian Relationship, Support Plan Details, Consent Declaration, Consent Date, and Name of Representative.
Who Holds The Data
ELCAS holds the data as the data controller for this project. BPRCVS receives data for the purposes of processing.
Who Can Access The Data
Only the Children & Families team, Chief Officer, and finance team have access to the information stored by BPRCVS.
ELCAS as the data controller can also access the data.
Data Security
All paper files are stored in secure file storage in a locked office. Emails are stored on a secure Exchange server, and the Excel database used to record this data is stored on a secure on-site server which is backed up daily.
How Long Is Data Stored For
We store this data for up to a maximum of 7 years.
When & How Is The Data Removed & Destroyed
Upon completion of the retention period, all data records are removed from file storage and securely deleted or destroyed. Paper files are destroyed using confidential waste.
…………………………………………………………………
Adult’s Personal Health Budget
Purpose For Collecting & Storing Data
Personal data is collected and stored for the purpose of awarding grants to individuals to assist with their physical health and wellbeing.
Basis For Processing Data
The lawful basis for processing data is consent obtained at the referral stage.
What Data Do We Store
For the purposes of issuing grants we are required to store the following data:
Date Of Referral, Referral Via, Name, Address, Telephone Number, Gender, Ethnicity, GP Name & Practice, NHS Number, EMIS Reference Number, Preferred Language, Date of Birth, Lives With Status, National Data Opt Out Status (NDOO), Reason(s) For Referral, Next Of Kin Emergency Contact Details, Referrer's Contact Details, Safe To Visit Alone Status, Risk of Infection Status, Additional Information, Consent Declaration, Cost of PHB, Reason For PHB Request, and Panel Findings.
Who Holds The Data
BPRCVS holds the data as the data controller. Lancashire & South Cumbria Foundation Trust (LSCFT) and Burnley’s Community Mental Health Team (CMHT) are data processors.
Who Can Access The Data
BPRCVS’ Social Prescribing and finance teams have access to the information stored. Lancashire & South Cumbria Foundation Trust (LSCFT) and Burnley’s Community Mental Health Team (CMHT) receive the data from BPRCVS.
Data Security
All paper files are stored in secure file storage in a locked office. Emails are stored on a secure Exchange server, and databases used to record this data are stored on servers which are backed up daily.
How Long Is Data Stored For
We store this data for up to a maximum of 7 years.
When & How Is The Data Removed & Destroyed
Upon completion of the retention period, all data records are removed from file storage and securely deleted or destroyed. Paper files are destroyed using confidential waste.
Last reviewed: 07/06/2024