Phrame
Data Protection and Privacy Policy
Purpose
This policy explains the approach of Phrame to the
data protection as regulated by The General Data Protection Regulation Act 2018 (“the Act”)
in relation to employees, volunteers, funders, customers, clients and other third parties.
1. Principles
Phrame regards the lawful and correct treatment of personal information as important to
successful working and to maintaining the confidence of those with whom it deals.
Phrame complies with the eight principles of good information handling enforced by the Act:
a. Data must be processed fairly and lawfully
b. Data must only be used for specific purposes
c. Data must be adequate, relevant and not excessive
d. Data must be accurate and kept up-to-date
e. Data must not be kept for longer than necessary
f. The rights of Data Subjects must be respected
g. Organisations must take appropriate steps to maintain security
h. Data must not be transferred abroad without adequate protection.
This policy will be updated as necessary to reflect best practice in data management, security and
control and to ensure compliance with changes or amendments made to the Act.
2. Policy
Phrame needs to collect and use certain types of information about the Data Subjects with
whom it comes into contact. This personal information will be collected and dealt with
appropriately – whether on paper, in a computer, or in another form (e.g. photographs,
recordings). The organisations and individuals about which Phrame holds information are
referred to in this policy as data subjects. Phrame will ensure that:
a. everyone processing personal information is appropriately trained and supervised;
b. anybody wanting to make enquiries about handling personal information knows what
to do;
c. any enquiries about handling personal information are dealt with promptly and
courteously;
d. the handling of personal information is clearly described;
e. the management and use of personal information is regularly reviewed.
3. Responsibilities
Phrame is the Data Controller under the Act, which means that it determines for what purposes
personal information will be used.
Jon Scurrah is the central point of contact at MTHCC for all data
compliance issues.
4. Procedure
4.1 Disclosure
Phrame may share data with other agencies, either as a legal requirement (e.g. Companies
House, Charity Commission, HM Revenue and Customs) or a contractual obligation
(e.g. local authorities, funding bodies). The Data Subject will be made aware in most
circumstances how and with whom their information will be shared.
There are circumstances where the law allows organisations to disclose data (including
sensitive data) without the data subject’s consent. These are:
a. Carrying out a legal duty or as authorised by the Secretary of State;
b. Protecting vital interests of a Data Subject or other person;
c. Where the Data Subject has already made the information public;
d. While conducting legal proceedings or obtaining legal advice;
e. Monitoring for equal opportunities purposes;
f. Where the Data Subject’s consent cannot be obtained or where it is reasonable
to proceed without consent: e.g. where providing consent would cause stress to
a vulnerable person.
4.2 Information held by the Organisation
Information held by Phrame relates to organisations and individuals with whom it works or
comes into contact.
Phrame will not give out information about any individual unless:
a. explicit consent is given;
b. Phrame is satisfied that the individual knows this type of disclosure may be made;
c. the information is already in the public domain,
d. and/or there is some over-riding reason for the disclosure (see 5.1 above).
No details of individuals will be passed to other organisations for marketing, fundraising or
circulating information.
4.3 Storage
a. Computer records and files containing sensitive information will be password protected,
accessible only to relevant staff.
4.4 Data Access Requests
A Data Subject may make a subject access request (“SAR”) at any time to see the
information which Phrame holds about them.
4.5 Data collection
MTHCC may collect the following information:
a. Email addresses when signing up to the mailing list. This is not linked to any other
personal information and is used only for occasional email news letters.
This information is kept on a password-protected third party website as part of a single
mailing list, and is neither used for individual contact nor held on Phrame's own
computer or email server.
Promotional emails are at least two weeks apart, and usually no more than one per
month.
b. Contact information from individuals and companies who contact Phrame by email.
This is kept on a password-protected email sever and deleted after six months unless it
is part of an ongoing business relationship.
5. Website
Phrame runs websites for general information and promotion, Any such websites are hosted securely, with access only to relevant Phrame on a password-protected basis.
5.1 Personal identification information
Phrame may collect personal identification from website users only if they fill out a form, fill in a
survey with identifying information, or place an order.
.
5.2 Non-personal identification information
MTHCC may collect non-personal information about website users, including the browser name,
type of computer and technical information about users’ means of connection to the site. The
website may use "cookies" to enhance user experience. These are small data files placed on
the user’s hard drive for record-keeping purposes and sometimes to track information. Users
may choose to set their web browser to refuse cookies, or to alert the user when cookies are
being sent. In some cases, parts of the website may not function properly for users who have
disabled cookies.
5.3 User acceptance
By using Phrame website/s, users signify their acceptance of this Data Protection Policy.
Continued use of the website/s following the posting of changes to this policy will be deemed
acceptance of those changes.
6. Electronic newsletters
If a user opts in to the Phrame e-mailing list, they will receive emails with information about
phrame and namephrame including news, forthcoming events and organisational updates. Detailed
unsubscribe instructions are included at the bottom of each email, or users may contact
Phrame by any means and at any time to opt out. Phrame may use third party service
providers to send out newsletters, and may share the following information only in order to
personalise emails: email address (for all users), frst name and surname (for some users).
This information is not available to the third party service provider for any purpose other than
Phrame information sharing.
.
7. Changes to this privacy policy
Phrame will review this policy at least biennially, and may update it at any time. If and when this
happens, Phrame will post a notification on the main page of our website and include the
information in the next email sent.