Scripture Union, Northern Ireland

Special Category Data

All personal information is private, but some types of information are more sensitive than others e.g medical information, religious beliefs or information about special needs, and this is recognised in law.  Since we only collect the information we need, you can rest assured that we will only ask for personal information about you if there is a good reason for doing so – e.g. to ensure that children’s needs are appropriately catered for at a camp or mission; to make sure that our volunteers meet the high standards we require of them; to ensure safeguarding at camps, missions or events.  We will have identified sound legal bases for processing any special category data and we will treat it with extra care.

Third parties

SUNI will never sell your data to anyone else, nor do we share your data with other organisations for their marketing purposes.  We don’t share your data in ways you would not expect and we are transparent about who we plan to share your data with and why, but we may also have to share your data if there are legal reasons to do so e.g. with the police regarding suspected fraud or with social services in relation to child protection.  

In outlining above what we do with each different type of person’s data we have highlighted some of the third party service providers we use.  They are listed below.  We have chosen them because they also treat your data with respect and their data policies align with ours.  They will only use your data as instructed by us.

Most of our Third Parties store data within the European Economic Area, but where one of our third parties is based outside the EEA or needs to transfer data outside the EEA we will have carried out a risk assessment to ensure that adequate levels of privacy protection, in line with UK data protection law, are in place.  For further information on this please email data@suni.co.uk. To see the full list of our Third parties, click here.

Taking Photographs

It is SUNI’s policy to obtain parental permission for children in schools or at camps and missions, and permission from young people at events like Making Your Mark, to take photographs/videos which may be used in SUNI publicity (e.g. in the following year’s brochure, on websites, on SUNI social media posts etc).  At events there will be a poster displayed explaining that we might be taking photos/videos, and signposting who to talk to if you don’t want to be in photos.  There will also be an announcement made to ensure that event participants are aware that they can ask us not to use their photograph.

Security

Policies and procedures

Our Data Protection Policy is reviewed and updated annually.

Physical security

Out of office hours the main office building is securely locked and alarmed.  During office hours, visitors not allowed unsupervised access to office areas. 

Paper

There are robust practices to ensure the security of paper records: they are stored in locked filing cabinets, and shredded once they are no longer needed, in line with our data retention policy.  Large quantities of confidential waste are disposed of commercially, and certificates confirming destruction are provided and held on file.

Staff

References for all staff are obtained prior to employment and we place a high value on trustworthiness, integrity and confidentiality.  Staff receive regular training (at appropriate levels) on data protection.

Cyber security

As an almost entirely Mac–based organisation, our cyber security issues are significantly reduced.  All staff laptops are encrypted and all staff computers are passworded. Only the staff member and the PA know the password to each computer. Staff are encouraged to use passwords for files containing personal data, and to consider using file sharing websites rather than attachments when personal data needs to be transferred for some reason.  Data on our secure server is encrypted, and it is backed up regularly.  Care and consideration are taken regarding SPAM mail, up to date antivirus protection and appropriate firewalls, as well as installing updates.  Outdated computer equipment is destroyed by our IT support (Blackdog Media).  SUNI policy is to shutdown computers completely or put on ‘sleep more’ each evening, which would avoid sensitive information being accessed in the event of an office break in.  Our wireless router is secure and guards against hackers, and a wifi password is in place.  The connection between devices and the wifi is encrypted.

Your Rights

You have the following rights with regard to good information handling, which we affirm and will endeavour to uphold:

The right to be informed

That’s why we have this privacy policy, so that you can see we are fair and transparent in how we process the information you give us.

The right of access

You can ask us for the data we hold about you (this is a data subject access request).  We are happy to give you all the information which we can.  This is a straightforward procedure for this, which will include verifying your identity.  It doesn’t cost anything.  You can ask for the form by emailing (data@suni.co.uk) phoning (028 9045 4806) or writing to us (Data Team, SUNI, 157 Albertbridge Road, BELFAST, BT5 4PS).

The right to rectification

If you think the information we hold about you is not correct, let us know – we will find and update it.  We endeavour to do this as soon as you let us know, but always within 30 days.

The rights to erasure and to restrict processing

You can ask to be forgotten.  If we can, we will then delete or destroy the information we hold about you.  There may be a compelling reason why this is not possible (e.g. a legal obligation for us to continue to hold your data) but we will always take your request seriously.  If we can’t completely delete your data for some reason, it is likely that we could store it without actively continuing to process it (restrict processing).

The right to data portability

If you want it, we will give you the information we hold about you in an appropriate transferable form.  

The right to object

If you don’t like how we have processed your data based on legitimate interest or for marketing purposes, you have the right to say so, and we will stop processing your information in that way.  You can always opt out of any mailings we send and we make sure that it is easy for you to do so. 

You also have rights relating to automated processing and profiling

We don’t use automated processing and we don’t profile people.

Let us know how we can improve

We have thought carefully about protecting your data – about what information we gather, how we use it and store it, and for how long, and how we delete or destroy it when it is no longer needed.

However, all policies and procedures are implemented by imperfect human beings. So if you think we have made a mistake in any way, please let us know and we willwork hard to make things right. You can email (data@suni.co.uk) phone (028 9045 4806) or write to us (Data Team, SUNI, 157 Albertbridge Road, BELFAST, BT5 4PS).

If you are concerned with how we are handling your information we would like to be able to address those concerns and put things right. However, if you wish to raise any concerns with a supervisory body, you can contact the ICO (Information Commissioner’s Office). You will find information on how to do this on the ICO website (www.ico.org.uk) or by phoning the ICO on 0303 123 1113 or writing to The Information Commissioner’s office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. There is also a regional office (write to ICO, 3rd Floor, 14 Cromac Place, Belfast,BT7 2JB, phone 028 9027 8757 or email ni@ico.org.uk)