Volunteer privacy notice

Why are we collecting your information?

Processing of volunteers’ personal information is necessary for the purposes of managing workload and administration. Your records are used to directly manage your voluntary placement to ensure that:

The staff involved in your voluntary placement have accurate and up to date information to assess and advise on the most appropriate placement for you;
Staff have the information they need to be able to assess and improve your voluntary placement;
The personal information we collect about you may also be used to:
remind you about your placement if it changes and send you relevant correspondence;
review your voluntary placement;
communicate with you about Trust activities/your role;
report and investigate any complaints, claims or untoward incidents;
report events to the appropriate authorities when we are required to do so by law.

Who are we?

The Trust is a ‘Data Controller’, this means that we determine the purposes for which, and the manner in which, your personal data is processed. We have a responsibility to you and your personal data and will only collect and use this in ways which are compliant with data protection legislation.

The Trust has appointed Rebecca Bradley (Head of Information Governance) to be its Data Protection Officer (DPO). The role of the DPO is to ensure that the Trust is compliant with Data Protection legislation and to oversee data protection procedures. The DPO contact details are:

York and Scarborough Teaching Hospital NHS Foundation Trust
York Hospital
Wigginton Road
York
North Yorkshire
YO31 8HE

yhs-tr.Information.Governance@nhs.net

What Information are we collecting?

Full Name
Date of Birth
Gender
Postal Address, email, Contact Number
Emergency Contact

Special categories of information held:

Health information via returned forms from the Trust occupational health

Your nationality is not recorded, but will be known upon sight of your ID.

It is important for us to have a complete picture of you, as this will assist us make an informed decision to your suitability for a volunteer placement within the Trust.

What is our lawful basis for processing your information?

Any personal data we process is done so in accordance with the UK General Data Protection Regulation (UK GDPR). Our lawful basis for processing are:

Article 6(1)(b) Contract: Processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract.

Article 9(2)(h): Health and Social Care Purposes, under Schedule 1 Part 1 Paragraph 2:

the purposes of occupational medicine
for the assessment of the working capacity of the employee

In relation to necessary DBS checks, we process in accordance with Article 10 (UK GDPR) and the Data Protection Act 2018 Section 10 (4) and (5), Schedule 1 Part 2 Paragraph 18 Safeguarding of children and individuals at risk and Schedule 1 Part 2 Paragraph 10 preventing or detecting unlawful acts.

How long do we keep your information for?

The Trust follows NHS Digital’s recommended retention schedule and your information will be deleted after six years of you ending your role with the Trust.

Who do we share your information with?

The information we hold about you will not routinely be shared with any other organisations. However there may be occasions where the Trust is required by law to share information with other bodies responsible for auditing or administering public funds, in order to prevent and detect fraud.

Do we transfer your information outside the UK?

Volunteer information is not sent outside the UK

What rights do you have over your data?

Under GDPR data subjects have the following rights in relation to the processing of their personal data:

to be informed about how we process your personal data. This notice fulfils this obligation
to request access to your personal data that we hold, and be provided with a copy of it
to request that your personal data is amended if inaccurate or incomplete
to request that your personal data is erased where there is no compelling reason for its continued processing
to request that the processing of your personal data is restricted
to object to your personal data being processed

If you have any concerns about the way we have handled your personal data or would like any further information, then please contact our Data Protection Officer at the details provided above.

If we cannot resolve your concerns you may also complain to the Information

Commissioner’s Office (the Data Protection Regulator) about the way in which the Trust has handled your personal data. You can do so by contacting:

First Contact Team
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

casework@ico.org.uk // 0303 123 1113

Information Governance Team V3
March 2023