Data Privacy Statement for Foodbank Clients

Personal data
When you come to a foodbank for help, the foodbank will keep some data about you. This is “personal data”, because it is about you as a particular person, and it can be linked to you.

What personal data do we hold?
The foodbank will keep the data that is on your foodbank voucher(s). That means we will keep your name, address, and year of birth; the number of other adults and children in your household; and the reason you needed to come to the foodbank. We will also keep a record of who gave you the foodbank voucher.
If we can give you extra help, there may be extra things we need to ask you about and will keep a record of. There may also be some notes on our data system about your visit. This is the only data the foodbank will hold about you. We do not get data about you in any other way.

How is your personal data kept safe?
Your data is kept in a secure database. This can only be accessed with a login and password. We require all users of the system to sign a “confidentiality agreement”. This means they know they must only use your data for the right purposes. We are as careful as possible to make sure no-one else can log into the data system. For example, when a volunteer leaves the foodbank, we stop their access to the data system.
If you came to the foodbank with a printed voucher, your voucher will usually be shredded. Occasionally it will be kept for a short time securely in the manager’s office. It is never left where someone could see it.

What is your data used for?
We use your data for three things:
1. We need to keep some of your data so we can calculate the numbers of people coming to foodbanks, and the reasons they need to. This is so we can help other people understand how much foodbanks are needed and why people have to come to foodbanks for help.
2. We need to ask certain questions so we can provide you with appropriate help as requested, and to be able to check how many times you have been to a foodbank.
3. If we can give you extra help, such as with benefits, there may be extra questions we need to ask. This will be because we need certain information to know how to help you.

Does the foodbank have a right to your data?
Under Data Protection legislation, the foodbank needs to have a “lawful basis” for keeping your data, and for using it. There are several types of “lawful basis”. One of them is called “legitimate interests”.
The foodbank has a “legitimate interest” in keeping the data from your foodbank voucher so we can carry out the two main purposes described above – checking how many times clients visit the foodbank, and reporting on the need for foodbanks.
There is another type of “lawful basis” called “consent”. If we are to give you extra help, we may need certain information from you. We may need to ask you additional questions and record the answers. The lawful basis for this will be your informed “consent”.

Who can see your data?
Your personal information is only seen by people who need to do so for foodbank reasons. It not used for any other purpose.
Your personal information is stored in a secure database owned and administered by the Trussell Trust, who are a separate data controller and use your data for statistical, research and monitoring purposes.
Your data can be seen by people from this foodbank who have been given a login and password for the data system. If you go to two foodbanks, people from both foodbanks will be able to see the data from all your foodbank visits – not just for the visits to their own foodbank.
Some agencies can refer you to a foodbank using an on-line system called “e-referral”. If an agency has done this for you, then the agency will also be able to see the data for your visit.
E-referral agencies and other foodbanks can also see the dates when someone with your name and postcode has been to a foodbank. They can’t see any more data, like your address or why you needed foodbank help.
We will only ever share your information with other organisations with your consent and we never sell your data to any other bodies.

How long will your data be kept?
Your personal data is kept for six years. After that, identifiable information such as your name and address are anonymised and removed from our systems. This is so we can prove we have acted properly as a charity, and used people’s donations in the right way. Charity law means we may need to be able to prove this.

Who can you speak to if you have questions?
If you have questions about your data, and what we do with it, you should contact the foodbank operations manager:
email: [email protected] telephone: 07542 106107

What rights do you have?
You have a number of rights under Data Protection legislation:
1. Right to be know what data we hold
You have a right to know what personal data we hold about you.
This Data Privacy Statement describes the data that we will hold. But you can ask if we have any other data about you which is not covered by this Data Privacy Statement.
2. Right to have a copy of the data we hold
You can ask for a copy of the data we hold about you. This is called a “subject access request”. If you make a “subject access request”, we will give you a copy of all the data we hold about you. We will do this within one month. If it helps, we will give you the data in a computer file.
3. Right to object
You can object if you think we are using your data in the wrong way. You can also object if you think we don’t have “lawful grounds” for using your data.
We will give you a statement explaining why we use your data and explaining the “lawful grounds”. If you are still not happy, you can complain to the Information Commissioner’s Office.
If we find we are using your data in the wrong way, we will stop immediately and stop it happening again.
4. Right to have your data corrected
If you think there is a mistake in your data, please tell us. You have a right to have it corrected. We may need to check what is the correct data, but will put right any mistakes as soon as possible.
5. Right to be forgotten
We promise to remove your data after six years. You have a right for this to happen, because we don’t need to keep your data any longer than six years.
Finally, if anything happened to your data that could be a risk to you, we will do our best to tell you.