Please note, if you would like to discuss this Privacy Notice in person or would like it made available in a different format, please contact us on 07707 336351 or email hello@my-journey.org.uk
My Journey is an East Midlands based community transport provider. We collect, store and process certain personal information about our clients, their carers, our staff, and our volunteers. We are therefore registered as a data controller with the Information Commissioner’s Office (ICO) and our registration number is A8855433.
We respect your right to privacy. This privacy notice explains what information we record, why we do this, what we do with the information and how we keep it safe in accordance with the UK General Data Protection Regulation (GDPR). It also explains your rights and how you can help us to make sure your information is kept up to date and accurate.
In this Privacy Notice all references to “we” or “us” or “our” relate to My Journey, a company incorporated in England and Wales (Company No. 13049399), whose registered office is 13 Grove Street, Mansfield Woodhouse, Nottinghamshire, NG19 8BU. My Journey CIC is the controller of any personal information processed as set out in this Privacy Notice.
In this document we will explain the following:
We collect information on our customers, staff, volunteers, general enquirers, job applicants and visitors to our website. We might also collect information on relatives or carers of clients, staff, and volunteers so that we can contact them in an emergency.
We hold basic information about you such as your name, address, telephone number, email address, date of birth, gender and next of kin/emergency contact. We may also hold more sensitive information such as:
We also store photographs of staff to enable identification for safeguarding purposes. Any other images and videos will only be held and used with prior consent.
The legal bases for us collecting and processing your information is that: It is necessary to fulfil the contract between you and us or the steps you and/or your carer/representative have asked us to take towards entering into a contract It is necessary to meet legislation and contractual obligations for example those arising from work commissioned by Local Authority transport contracts (specialist) or our obligations to you as your employer under employment and Health & Safety legislation and codes of practice) We also have a legitimate interest in processing employee and candidate personal data during and after the recruitment process and during and after the period of your employment with us.
We collect this information so that we can:
We may keep a record of any communications we have with you such as emails or telephone calls.
We seek to ensure that our information collection and processing is always proportionate. We will notify you of any material changes to information we collect or to the purposes for which we collect and process it.
We hold your records securely in both paper and electronic format. We have appropriate security measures in place to prevent personal information from being accidentally lost or used or accessed in an
unauthorised way. We limit access to your personal information to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.
We have a duty to:
We, or third parties acting on our behalf, may also store or process information that we collect about you in countries outside the European Economic Area, which may have lower standards of data protection. Specifically, servers used by our website are located in the United States and some of our third party service providers operate around the world. We have technical and organisational security measures in place to prevent the loss or unauthorised access of your personal information, however, please be aware that we cannot guarantee the security of information transmitted over the Internet.
We will share your information with third party organisations who are contracted to provide services to My Journey CIC. This will only be the case in order to meet our contractual obligations to you, to meet statutory requirements or to support the needs of our customers such as:
We may also share your information where we believe there is a legal or regulatory reason for us to do so such as:
We will not sell your information to other organisations or share your personal information with other organisations for the purposes of marketing or fundraising.
We will keep your records for no longer than is reasonably necessary and in line with our records retention schedule, a summary of which is as follows:
Customer records - up to 8 years from date service ended Customer records where no membership is continued - up to 6 months from date of last contact Employee records - up to 6 years post-employment Temporary workers records - up to 2 years post-employment Volunteer and Student Placement records - up to 2 years post-placement Recruitment (successful applicants) - up to 6 years post-employment Recruitment (unsuccessful applicants) - up to 6 months post recruitment campaign Finance records - up to 7 years
You have the right:
You have the right to be informed about the information we keep and how we use it. That is why we have written this privacy notice. We may need to make changes to our Privacy Notice from time to time but the most up to date version will always be available on our website www.my-journey.org.uk If we make any major changes to it, we will post a notice on our website or let you know in writing.
You have the right to confirmation that we are processing your personal information and to access your personal information. You can do so by contacting us:
David Bingham Data Protection Officer My Journey CIC 13 Grove Street Mansfield Woodhouse Nottinghamshire Tel: 07707 336351 Email: hello@my-journey.org.uk
Requests for access to information will be responded to as soon as is reasonably possible and normally no later than within one month in line with the UK GDPR.
If you think the personal information we have for you is not correct, you can contact us to ask that we put right any inaccurate or incomplete data. We will normally respond within one month.
You have the right to ask us to erase, or delete, your personal information or to restrict the processing of your data. Each request will be considered on an individual basis and in line with the UK GDPR. If we agree to your request to erase or delete your personal information, it is possible that we will no longer be able to fulfil our contract with you, depending on the type of information concerned.
You have the right to ask us to stop processing your information. Each request will be considered on an individual basis and in line with the UK GDPR. If your request is upheld, we would continue to store your information but would not do anything with it. This restriction in processing your information could be temporary or permanent depending on the request.
This means you have the right to ask us to send you the information you have given to us so that you
can pass it on to other organisations so that they can use the information. You may ask us to send the information straight to another organisation. If your personal information also contains information about other people, we will need to consider whether sending the information would affect their rights. We will respond to all requests as soon as possible and normally within no more than one month, unless the request is complex, in line with the UK GDPR.
If you are not happy with the way in which we are handling your personal information you can contact our Data Protection Officer at the address above or telephone 07707 336351
If you are not satisfied with the way we have dealt with your complaint, you can contact the Information Commissioner’s Office (ICO):
Wycliffe House Water Lane Wilmslow, Cheshire, SK9 5AF Website: https://ico.org.uk Helpline: 0303 123 1113
It’s important that you let us know if any of your personal details change, for example if you change address, telephone number, email address, GP etc. In order to keep accurate records, we need to know of any changes. We will then inform anyone with whom we have shared your information so they can update their records.
This privacy notice was last updated on 25th June 2021
_Some of the information contained within this document was obtained from the Information Commissioner’s Office Guide to the General Data Protection Regulation (GDPR) web pages https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/
This document contains public sector information licensed under the Open Government Licence v3.0_