Privacy Policy

Our Commitment to Privacy

At the Middlesex Association for the Blind (MAB), we are committed to protecting the privacy and security of personal data.

Consolidation of Policies

To provide greater clarity and transparency around our data protection practices, we have consolidated our Data Protection Policy and GDPR Policy into this comprehensive Privacy Policy. This unified policy outlines how we collect, process, store, and protect personal data in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Who is Covered

This policy applies to all personal data controlled and processed by MAB, including data related to service users, volunteers, employees, and donors. It covers all staff, volunteers, trustees, and anyone processing personal data on behalf of MAB.

Types of Personal Data

MAB collects various types of personal data, including:

• Personal Information: Names, addresses, contact details, and medical information (where relevant)
• Volunteer Information: Names, addresses, contact details
• Donor Information: Donation history, Gift Aid declarations, communication preferences
• Interaction Records: Communications, support provided, feedback, and survey responses
• Staff Records: This includes information related to employment such as contact details, payroll information, performance reviews, disciplinary records, and absence records

Collection Methods

Primarily through service user applications, direct interactions, volunteer registration, and donor contributions.

Data Storage

Cloud-Based Storage

MAB uses secure, GDPR-compliant cloud-based systems to store and process personal data.

Paper Records

Some personal data may be stored in paper format, such as printed forms, notes, or correspondence. Typical examples include:

• Service user intake forms
• Volunteer applications
• Employee contracts
• Donor pledge forms

Clean Desk & Shredding Procedure

MAB operates a clean desk policy, requiring staff to securely store all paper records containing personal data when not in use. Any paper records containing personal data that are no longer needed are securely shredded in compliance with data protection regulations. For electronic records, all PCs and mobile devices are password protected, and staff are instructed to lock them when away from their desks. All personal data is stored on secure cloud systems that employ their own robust security measures.

Purposes of Data Processing

• Managing service user support services
• Coordinating volunteer activities
• Managing donor relationships
• Generating reports
• Internal communications
• Maintaining employee and trustee records

Core Principles We Follow

MAB adheres to the following key principles:

• Lawfulness, fairness, and transparency
• Purpose limitation
• Data minimisation
• Accuracy
• Storage limitation
• Integrity and confidentiality (security)
• Accountability

Legal Grounds for Data Use

MAB processes personal data only with a lawful basis, including:

• Consent
• Contract
• Legal obligation
• Vital interests
• Public task
• Legitimate interests

Your Rights under UK GDPR

Under the UK GDPR, you have various rights in relation to your personal data, including:

• The right to be informed about how your data is being used
• The right to access your personal data
• The right to rectify inaccurate or incomplete data
• The right to erase your data (also known as the “right to be forgotten”)
• The right to restrict processing of your data
• The right to data portability (obtaining and reusing your data for different services)
• The right to object to the processing of your data
• Rights related to automated decision making and profiling

For a full understanding of your rights, please visit the Information Commissioner’s Office (ICO) website or contact our Data Protection Officer (DPO).

Subject Access Requests (SARs) and other rights requests are overseen by the DPO.

When and How We Share Data

MAB may share personal data with:

• Local authorities or police (safeguarding concerns)
• Volunteers (to help support service users)
• Relevant bodies (e.g., DBS, Charity Commission) for employee-related safeguarding issues

All sharing is done in compliance with UK GDPR and on a strict need-to-know basis.

How Long We Keep Your Data

We retain personal data only as long as necessary to fulfil the purposes for which it was collected, including satisfying any legal, accounting, or reporting requirements.

Protecting Your Data

We prioritise the security of sensitive data through a multi-layered approach:

• Access Control: Secure logins with strong password policies, coupled with Two-Factor Authentication (2FA) for added protection against unauthorised access
• Threat Prevention: Robust antivirus and anti-malware software to proactively detect and neutralise potential threats
• Data Protection: Regular backups of business-critical data to ensure its availability and integrity in the event of system failures, cyber-attacks, or other disruptions
• Ongoing Security: Continuous monitoring and updates to our security protocols to address evolving threats and vulnerabilities

What Happens if There’s a Breach

• Suspected breaches must be reported immediately to the Data Protection Officer (DPO)
• The DPO will assess the breach and, if necessary, report it to the Information Commissioner’s Office (ICO) within 72 hours
• MAB will communicate with affected individuals and document all breaches

Assessing High-Risk Processing

MAB will carry out DPIAs when using new technologies or processing likely to result in high risk. DPIAs will include a description of processing and purposes, necessity and proportionality assessment, risk assessment, and measures to address risks.

Educating Our Team

MAB provides appropriate data protection training to all staff and volunteers, with regular refreshers.

Our DPO and Contact Information

Valerie Hill (CEO) is MAB’s designated DPO. She is responsible for:

• Informing and advising on GDPR obligations
• Monitoring compliance
• Advising on DPIAs
• Cooperating with the ICO

Keeping the Policy Updated

This policy is reviewed annually or as needed to stay current. It is available to all MAB Trustees, Employees, Volunteers, and the public upon request.