Privacy and Data Protection Statement for Individuals applying to the Holywood Trust
The Holywood Trust is required to inform you why we are requesting and processing the information contained in this form, and any supporting information received from you or a third-party, and the lawful basis for doing so as defined in data protection laws.
Why we need your information:
• When considering the amount of any grant awarded to an individual we will take into account the circumstances of a young person and the form has been designed so that you can tell us about yourself.
• Reference will be made to any previous applications from you to allow The Holywood Trust to further understand your progress towards your goals and to be aware of the amount of funding provided to you already.
• The Holywood Trust needs to demonstrate that it is spending its money in ways that comply with the legal requirements which apply to charities in Scotland.
How information is processed:
• The information in this form and any supplementary information you or others have provided will be securely stored and access to it limited to specified Holywood Trust staff members and The Holywood Trust Trustees.
• In addition, our accountants and auditors may need to have access to some of our files (whether paper or electronic) and may carry out some limited processing of them to fulfil their duties.
• All electronic information is overseen by and processed by external IT support companies – but only as far as required to maintain the integrity and security of the data we hold.
• It will be stored in its original paper format initially and then a scanned copy will be made of the form and of any further information provided by you or others and the paper copy will be shredded (usually within three months of you receiving a decision from us).
• The information contained in the application form and any subsequent information provided by you or others will also be processed for electronic storage within our computer systems some of which may be “cloud-based”. The information stored electronically will be used to assist with the administration of your application.
• Some of the information you provide may also be combined with all other application information we hold to assist with the general management of The Holywood Trust and used to make statutory and other returns. The information provided externally by way of these returns will be general statistical information only and will not identify any individuals except in the circumstances described in “How information is shared” below.
How information is shared:
• Your information will be shared with our accountants, auditors and external IT support companies as detailed in “How information is processed”.
• There may be occasions when the Trust would like to discuss your application with third-parties outwith The Holywood Trust such as someone involved in the preparation of, referral of, or who have provided supporting information for, your application. If we need to contact any third-parties we will contact you about this to seek your explicit consent to do so. We will tell you why we want to contact them and what information will be discussed and/or shared; your consent will only apply to the application in hand.
• When a grant is approved The Holywood Trust sometimes uses external suppliers of goods and services to which we would want to provide your name, address and telephone number. We will always ask your consent to share this information.
• To meet a legal requirement to help Her Majesty’s Revenue and Customs (HMRC) to reduce “money laundering” we may be required to share your name, address, date of birth and country of origin with HMRC for this purpose. This requirement is only necessary where the applicant is not a citizen of the United Kingdom and is unable to provide a National Insurance Number (their own or their parent’s or guardian’s) and will not normally affect applicants to The Holywood Trust.
How long information is retained:
• All valid applications, whether approved or not, and any supporting information received will be kept until your 26th birthday or for 7 years, whichever is the later date.
• If you make a further application it will be matched to any previous application(s) which may be referred to by Holywood Trust staff and Trustees when considering the new application received from you and the timescale for retention of your data will be set by the date of this most recent application.
• At the end of this period any electronic copies of forms relating to you will be permanently deleted and any records in our databases or similar will be anonymised. This anonymised data will allow The Holywood Trust to continue to look at individual records and produce general statistical data but not to identify an individual.
This could mean that, if your last application to The Holywood Trust is just before your 26th birthday, you would be nearly 33 years old before your data is anonymised.
Lawful Basis for processing:
• Your “Ethnic Origin” and any information you choose to provide about your health can only be processed lawfully on the basis of your “Consent” as this type of data is described as “Special Category Data” in the law which covers data protection. The lawful basis of “Consent” gives you special rights under this law – in particular you have a right to request the erasure of this information from our records; this right does not apply to the other data you provide. (See “Your rights” below.)
• All other information you or others provide will be processed as being within The Holywood Trust’s “Legitimate Interests” (which means we need the information to carry out our work as a charity) and also to meet its “Legal Obligations” (the Trust needs to keep financial records for seven years); this is all the information on your form and any supporting information provided which is not “ethnic origin” or “health” information.
You have certain rights in law regarding the data we hold about you:
• The first is the right to be informed which is covered by the statement above.
• The second is that you have a right to access your data and to know how it is processed. The Holywood Trust is required to respond to any such request within one month.
• The third is that, if the information held is inaccurate or incomplete, it is rectified by us when requested to do so within one month.
• Fourthly, you have the right within the data protection regulations to have your information erased. However, this is not an absolute right as there is some information which we need to keep for the purposes we have described previously under “Lawful Basis for processing”. We will always approach such requests in a spirit of co-operation and try to reach a conclusion which is satisfactory to both the person requesting erasure and The Holywood Trust and will always comply with data protection law. Again, the Trust has one month to respond to your request.
• Fifth, there are rights to restrict the processing of data. It will be processed so that The Holywood Trust can carry out its charitable work. We do not believe that there will be many circumstances where this will apply but we will always consider such requests sympathetically and ensure compliance with data protection law.
• Sixth, data portability – this does not apply in this instance.
• Seventh, a right to object to processing – we do not foresee any circumstances where this is likely but we will always respond to such requests and comply with requirements of data protection law.
• Finally, there are rights regarding automated decision making and profiling – we do not use such processes.
If you have any reason for concern about the information we hold about you, please contact us in the first instance and we will do all we can to resolve the matter. Alternatively, you can report your concern to the Information Commissioner’s Office (ICO) at – ICO.org.uk
The Information Commissioner’s Office – Scotland
45 Melville Street, Edinburgh EH3 7HL Telephone: 0303 123 1115 Email: Scotland@ico.org.uk