South Bristol Toy Library Privacy Notice
This notice explains how we collect data, how we use and store information and what it means for you. We welcome any feedback on our actions, please contact us on email@example.com
Who we are
South Bristol Toy Library is a local charity and community resource enabling local children, parents and carers to play, share and grow through the borrowing and sharing of toys and play equipment. We are a charity registered in England and Wales (number 1170160)
For the purposes of this Policy, ‘us’, ‘we’ and ‘our’ refer to South Bristol Toy Library.
What information do we collect?
Directly with us
We collect personal information each time you deal with us. For example, when you become a member, borrow and return toys, sign up for our newsletter, apply to become a volunteer or otherwise provide your personal details we collect the information you provide.
What do we do with it?
We may use the personal data we collect to:
- Run and administer the toy library including; processing membership and the lending and returning of toys, development of services and selection of toys/play items available to borrow.
- Provide news and information about the toy library and conduct our annual membership survey to aid our understanding of the difference the toy library makes to our members and how we can improve it.
Basis of processing your data
- Consent: We will process your personal data for the purposes of sending out our newsletter on the basis of the consent you provided us with. You are free to change your preferences at any time by contacting us at firstname.lastname@example.org
- Legitimate interest: Administration and running of the toy library; For example, when you become a member of the toy library or volunteer with the library, we will rely on our legitimate interest to ensure the smooth administration, running and development of the toy library in order to collect and process the personal data you supply us in your membership or volunteer application form. You can update, request access or object to us processing your data at any time by contacting us at email@example.com
- Contract: Applying for a freelance or employed role with the library; We will process personal data to comply with our obligations under the contract or if we do not yet have a contract with you, we will process your personal data to undertake the first steps needed before a contract can be entered into. For example, to run a recruitment process, we need to process your personal data to consider you in that process.
- Legal obligation: We are required by law to keep various business and charity records and certain records for health and safety purposes. We will process personal data when necessary to comply with our legal obligations. For example, to record attendees at our library sessions to comply with health and safety legislation.
Volunteering or applying for a freelance role with us
When you provide us with personal data when you apply for a freelance role with us, such as the information on your CV, we will process, store and disclose the personal data we collect to:
- Support the recruitment process;
- Enable you to submit your CV and application
- Answer any questions you may have
- Use third parties to provide services such as references, qualifications and criminal referencing and verification of information you have provided.
- Provide anonymised data to monitor compliance with our equal opportunities policy.
Where you provide personal data to volunteer with us, we will store, process and disclose personal the personal information we collect to:
- Support the volunteer recruitment process
- Answer any questions or feedback you may have
- Use third parties to provide services such as references
- Deliver the volunteering opportunity
- Provide information and the administration of the volunteering opportunity
- Monitor the quality of the volunteering opportunity
How and where we store your information
We will keep your personal information only for as long as we consider it necessary to carry out each purpose. Our data protection policy implements this. We take into account any legal obligations and accounting and tax considerations as well as considering what would be reasonable for the activity concerned.
For example, we will retain membership personal details for a year after a membership has expired and volunteer details for a year after a volunteer has stopped volunteering.
If you have any questions about how long we keep your data, please contact us at firstname.lastname@example.org
We have in place appropriate controls to protect any personal data you provide. For example, our Lend Engine Database is password protected and any paper membership forms which have to be retained for tax purposes are kept securely. Our data security policy and measures can be found here.
We ensure that access to personal data is restricted only to those volunteers or workers whose roles require such access and that suitable training is provided for these volunteers or workers.
We use external companies to process personal data on our behalf: Lend Engine, Mail Chimp, Stripe and Google Drive. Their privacy policies can be found here. When we use these companies we remain responsible for the storing and processing of the personal data you give us.
However, we need to remind you that despite our efforts, the internet cannot be guaranteed to be 100% secure and that you submit data at your own risk.
Credit/debit card security
Where we store your personal information
We use Lend Engine and a cloud based system (Google Drive) to process data. Lend Engine uses Stripe when processing payments made by bank card. Our newsletter is sent out using MailChimp. Therefore data may be processed outside of the European Economic Area (EEA). These companies privacy policies can be found here, which state that they hold and process personal data in compliance with European data protection regulations. We take reasonable steps to ensure your data is stored and processed in accordance with these regulations. By submitting your personal data you agree to this transfer, storing and processing of your information.
When we share your information
We do not share or swap your information with any other charities or organisations.
We may need to pass on information if required by law or by a regulatory body. For example, information relating to Gift Aid requested by the HMRC.
We may employ or contract third parties to carry out tasks on our behalf, such as co-ordinating our volunteers. These third parties are bound by contract to protect your data and we remain responsible for their actions.
We may provide third parties (such as funders) with general information about our members, but this information is both aggregate and anonymous.
How we treat children
We collect and process the number and year of birth of any children who benefit from the toy library. This information is only given by their parent or carer.
Your choices and telling us when things change
You can change your preferences on what you receive from us or how we contact you, at any time.
You can do so by e-mailing us at email@example.com
Updating your details
We appreciate it if your details are up to date. You can update us by e-mailing us at firstname.lastname@example.org
You have the right to be informed about how we process your personal data, the right to access your data, the right to have your personal data held by us rectified if it is inaccurate or incomplete.
You may have the right to ask us to erase your personal data, to ask us to restrict our processing or to object to our processing of your personal data.
You can make these requests at any time by e-mailing us at email@example.com
For more information about your rights under GDPR you can visit the website of the Information Commissioner’s Office.
South Bristol Toy Library is the Data Controller for South Bristol Toy Library and the trustees have responsibility for data protection within the organisation. They can be contacted at firstname.lastname@example.org.