1. Introduction

CHESS Homeless is committed to protecting the privacy and security of the personal information of its volunteers, guests and employees.

The Chief Executive Officer the data controller under the General Data Protection Regulation (GDPR). This means that he/she is responsible for deciding how we collect, hold, use and protect your personal information and we are required to give you certain information about how and why we do this.

This privacy notice describes how we collect, hold, use and protect personal information that relates to you or any individual connected to you, both during and after the time when you are a volunteer, guest or employee of CHESS.

2. Personal information we may collect about you

Personal information means, broadly, information that identifies (or that could, with other information that we hold or are likely to hold, identify) a living individual. This could include any information provided to us in relation to your involvement with CHESS.

We may hold any or all of the following personal information about you:

• personal details such as your name, gender, age, date of birth, email address, postal address, telephone or mobile number, and identifiers such as National Insurance number and other records provided for ID purposes;
• information relating to risk/needs assessments and support planning such as criminal history; dependencies; other agencies you interact with; housing details
• family, lifestyle and social circumstances such as details about current relationship status and marital/relationship history, details of family and dependents, next of kin and emergency contact information;
• employment details employment status and career history, references, recruitment and termination details, job title and job responsibilities; and
• if you are our employee, details such as salary, bank account details to process wage payments, tax code, benefits, licenses and insurance details, details of formal and informal proceedings such as letters of concern, disciplinary and grievance proceedings, your annual leave records, appraisal and performance information;
• photos, CCTV footage and shared vehicle dashcam footage
• Building access records
• IT equipment use including telephones and internet access

We may also hold other information about you which is known as ‘special category’ data and requires a higher level of protection – for example, information relating to your physical or mental health or criminal convictions. Where we collect this type of information about you, and where required, we will take appropriate steps to get your consent to process this.

It is important that the personal information we hold about you is accurate and up-to-date. Please let us know if your personal information changes.

3. What we may use your personal information for

CHESS may use your personal information for the following purposes:

• to carry out the proper functions of the charity
• in relation to any correspondence related to the administration of CHESS
• for internal record keeping;
• risk management
• complying with any present or future law, rule, regulation, guidance or directive, and complying with any industry rules and regulations or any applicable voluntary codes;
• complying with demands or requests made by local and foreign regulators, governments and law enforcement authorities, and complying with any subpoena or court process, or in connection with any litigation;
• for insurance purposes
• for security and safety of all employees, volunteers, service users and any third parties
• for protection of all individuals involved in CHESS services, CHESS property and vehicles
• in case of an emergency
• incident and accident investigation and reporting
• where you are a volunteer:
  • in relevant circumstances, to check your suitability for a position (for example, through a DBS check)
  • to communicate with you about volunteering arrangements
  • to promote volunteer training and other volunteer events
  • in case of an emergency
• where you are a guest:
  • in relation to you being referred to and staying within any CHESS Property or project.
  • in relation to medical and mental health assistance
  • in relation to case work around, for example, helping you find alternative accommodation, housing, benefits etc.
• where you are an employee:
  • to check your suitability for a position (for example, through a DBS check)
  • to contact you in relation to your employment
  • to arrange payment of wages and other benefits (for example pension arrangements)
  • For the purposes of

4. Reasons for processing data

We use your personal information in the ways described above for one or more of the following reasons:

1. we must process the data in order to carry out our contractual obligations
2. you have given explicit consent to the processing;
3. we need to comply with a legal obligation to which we are subject; and/or
4. it is necessary in our legitimate interests (or those of a third party) to do so, and your interests and fundamental rights do not override those interests. For example, our legitimate interests may include:

• ensuring safe and effective administration of CHESS, and carrying out the proper business of CHESS as a charity;
• carrying out our responsibilities as an employer;
• managing the risks to all volunteers, guests and employees;
• complying with all laws, guidance and codes that apply to CHESS, as well as with data requests from regulators, governments, courts and law enforcement authorities; and
• complying with our record-keeping duties;
• monitoring the way in which our website is used, to help us improve your experience when using.

We will only use your personal information for the purposes for which we collected it, unless we reasonably need to use it for a different reason that is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will explain the legal basis which allows us to do so.

5. Keeping your personal information safe

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

6. Sharing your personal information

We may share or disclose your personal information to any of the following recipients:

• our service providers and professional advisers;
• members of the board of trustees;
• other third parties as required by law – for example, local or foreign regulators, governments and law enforcement authorities; local and foreign courts, tribunals and arbitrators or other judicial committees; and
• insurance companies.

7. How long do we retain your personal information?

We will hold your personal information (and any personal information collected in respect of any individual connected with you) for as long as necessary to fulfil the purposes for which we collected it, including satisfying any legal, accounting, or reporting requirements. The period may depend on the type of data and the purpose for which it is held.

8. Your rights regarding the personal information you provide to us

You have the right, in accordance with the law:

to withdraw your consent to the processing of your personal information, to the extent it is processed on the basis of your consent (as set out above);

• to request a copy of the personal information we hold about you, and to request information regarding the processing of your personal information (this is known as a ‘data subject access request’);
• to request the correction, completion and/or deletion of your personal information, or to request the restriction of processing of your personal information;
• in relation to personal information processed on the grounds of the legitimate interest of CHESS or a third party, to object to the processing of your personal information;
• to complain to your local data protection authority, or to a court of law, if your data protection rights are violated. You may be entitled to claim compensation as a result of unlawful processing of your personal information.

If you would like to exercise any of the rights described above, please let us know by emailing us at data.protection@chesshomeless.org

9. What if you do not provide us with your personal information?

We may not be able to perform actions necessary to achieve the purposes set out above and you may not be able to make use of the services offered by us if you do not provide us with personal information that we may need to comply with our obligations.

10. Changes to our data protection arrangements

From time to time, we may update this privacy notice and the data protection arrangements described above. You can find out information about any changes at www.chesshomeless.org. Any changes will take effect when we post the revised wording on our website. Your use of the website, or continued interaction with CHESS following these changes means that you accept the revised data protection arrangements.

11. How to contact us

If you have any questions, comments or requests about this privacy notice, please contact us.

Email: data.protection@chesshomeless.org or write to

CHESS Homeless.org
200 New London Road,
Chelmsford,
Essex
CM2 9AB