Introduction
As part of its activities Woodcraft Folk makes use of personal information about its members, employees, volunteers, donors, customers and others. You can access Woodcraft Folk’s Privacy Policy here.
Woodcraft Folk recognises the importance of using personal and sensitive data in an appropriate way and protecting the personal information which it holds, and complying with data protection law in doing so.
This policy sets out what data we collect about different categories of individual engaging with Woodcraft Folk and how we use it, as well as Woodcraft Folk’s approach to protecting data, and provides guidance to members, staff and volunteers on how to deal with any personal or sensitive information they handle as part of their roles.
Group Contacts should also read the Data Protection Guidance for Groups and Woodcraft Folk’s Child Protection Reporting and Record Keeping Guidelines
Who We Are
Woodcraft Folk is a registered charity in England & Wales (1148195) and in Scotland (SC039791), and a limited company registered in England & Wales Company No. 8133727.
Woodcraft Folk is registered with the Information Commissioner’s Office
(reference: ZA160120). https://ico.org.uk/ESDWebPages/Entry/ZA160120
Our registered office is:
Woodcraft Folk
Holyoake House
Hanover Street
Manchester
M60 0AS
Woodcraft Folk’s main contact details include:
info@woodcraft.org.uk
020 7703 4173
www.woodcraft.org.uk
Woodcraft Folk’s Data Controller is the Chief Executive. You can contact our Data Controller by emailing data@woodcraft.org.uk.
The Data We Hold
Woodcraft Folk holds personal data on individuals in the following categories:
- Beneficiaries under the age of 13
- Beneficiaries aged 13-15
- Beneficiaries aged 16 or over
- Parents / Guardians of Beneficiaries
- Enquirers (potential, volunteers, beneficiaries, etc.)
- Volunteers working with children and young people
- Donors & supporters
- Trustees
- Staff
- Contractors
- Job applicants
- Centre Guests
- Visitors at our events, including international delegations
- Reference providers
In all cases Woodcraft Folk may hold information about people currently in one of these categories or people who have previously been in one of these groups. The basis for holding this data is set out in the Privacy Notice for each category below.
Privacy Notices
Beneficiaries under the age of 13 (Woodchips, Elfins and Pioneers)
Data about beneficiaries under the age of 13 can only be provided by a parent/guardian or appropriate adult with legal responsibility e.g. teacher. The personal information provided about a child is used to administer their active and safe participation in Woodcraft Folk activities. Where provided demographic data will also be used to monitor equal opportunities. Data about regular beneficiaries under the age of 13 is stored electronically.
Woodcraft Folk contracts a third party service provider to provide an online registration, group and event management system. Data will also, at times, be held in paper copy and managed by local volunteers in
line with Woodcraft Folk’s Data Protection Policy. Data will only be shared with those volunteers and staff directly involved in delivering activities to your child. In response to an accident, safeguarding or child protection issue Woodcraft Folk may also share a child’s information with medical or Child Protection teams in
Beneficiaries aged 13 to 15 (Venturers)
Parental consent will be sought when actively engaging beneficiaries aged 13 to 15 years in face to face events. It is possible for beneficiaries aged 13+ to register for online activities and communication without parental consent. Personal information provided about Venturers is used to administer their active and safe participation in Woodcraft Folk activities.
Where provided demographic data will also be used to monitor equal opportunities. Data about Venturers (beneficiaries aged 13 to 15) is stored electronically. Woodcraft Folk contracts a third party service provider to provide an online registration, group and event management system.
Data will also, at times, be held in paper copy and managed by local volunteers in line with Woodcraft Folk’s Data Protection Policy.
If Venturers have opted in to receive updates about national activities, it will also be stored by a third party mailing system provider and managed by staff and relevant volunteers in line with Woodcraft Folk’s Data Protection Policy. All recipients can unsubscribe at any time by activating the unsubscribe service.
Data will only be shared with those volunteers and staff directly involved in delivering activities to your child.
In response to an accident, safeguarding or child protection issue Woodcraft Folk may also share a child’s information with medical or Child Protection teams in order to safeguard a child. Where possible the young person will be engaged in discussions about information sharing. When information is shared
parents/guardians will be informed if doing so does not put the child at greater
risk.
Beneficiaries aged 16 or over (DFs)
Parental consent will be sought when actively engaging beneficiaries aged 16 to 18 years in face to face events. However, it is possible for beneficiaries aged 16+ to register themselves for face to face events, online activities and communication without parental consent. Personal information provided about DFs is used to administer their active and safe participation in Woodcraft Folk activities.
Where provided demographic data will also be used to monitor equal opportunities. Data about DFs (beneficiaries aged 16 or over) is stored electronically. Woodcraft Folk contracts a third party service provider to provide an online registration, group and event management system.
Data will also, at times, be held in paper copy and managed by local volunteers in line with Woodcraft Folk’s Data Protection Policy. If DFs have opted in to receive updates about national activities, it will also be stored by a third party mailing system provider and managed by staff and relevant volunteers in line with Woodcraft Folk’s Data Protection Policy. All recipients can unsubscribe at any time by activating the unsubscribe service. Data will only be shared with those volunteers and staff directly involved in delivering activities to your child.
In response to an accident, safeguarding or child protection issue Woodcraft Folk may also share a child’s information with medical or Child Protection teams in order to safeguard a child. Where possible the young person will be engaged in discussions about information sharing. When information is shared
parents/guardians may be informed if doing so reduces further risk to the child
Parents / Guardians of Beneficiaries
Local groups and branches will use the personal information you provide about yourself and your child in order to administer your child’s active and safe participation in Woodcraft Folk activities. Your data will be stored electronically. Woodcraft Folk contracts a third party service provider to provide an online registration, group and event management system. Data will also, at times, be held in paper copy and managed by local volunteers in line with Woodcraft Folk’s Data Protection Policy.
If you have opted in to receive updates about national activities, it will also be stored by a third party mailing system provider and managed by staff and relevant volunteers in line with Woodcraft Folk’s Data Protection Policy. All recipients can unsubscribe at any time by activating the unsubscribe service.
If you have opted in to receive fundraising communications we may contact you about making a donation or about Gift Aid preferences to enable you to support our work. We may at times share carefully selected relevant opportunities from partner organisations.
In response to an accident, safeguarding or child protection issue Woodcraft Folk may also share a child’s information with medical or Child Protection teams in order to safeguard a child. When information is shared parents/guardians will be informed if doing so does not put the child at greater risk.
Enquirers (potential volunteers, beneficiaries, donors, etc.)
Woodcraft Folk and its branches will use the personal information you provide in order to respond to your enquiry. If you send your child to one of our groups, become a volunteer or donor, please see the appropriate section about how we will use your data in that instance. Your data will be stored electronically and accessed by the staff or volunteer dealing with your enquiry..
If you have opted in to receive updates about national activities, it will also be stored by a third party mailing system provider and managed by staff and relevant volunteers in line with Woodcraft Folk’s Data Protection Policy. All recipients can unsubscribe at any time by activating the unsubscribe service.
If you do not send your child, become a volunteer or donor, we will delete the details of your enquiry six months after our last communication with you.
Volunteers working with children and young people
Woodcraft Folk and its branches will use the personal information you provide in order to manage your volunteering, check that you are permitted to work with children, and communicate with you regarding your volunteering and updates to Woodcraft Folk policies. As part of our screening procedures we will use your data to administer sustainability references, DBS checks and PVG membership. Woodcraft Folk
contracts a third party service provider to process DBS applications who will securely share information with the DBS and local Police authorities.
Where provided demographic data will also be used to monitor equal opportunities. Your data will be stored electronically. Woodcraft Folk contracts a third party service provider to provide an online registration, group and event management system. Data will also, at times, be held in paper copy and managed by local volunteers in line with Woodcraft Folk’s Data Protection Policy.
If you have opted in to receive updates about national activities, it will also be stored by a third party mailing system provider and managed by staff and relevant volunteers in line with Woodcraft Folk’s Data Protection Policy. All recipients can unsubscribe at any time by activating the unsubscribe service.
If you have opted in to receive fundraising communications we may contact you about making a donation or about Gift Aid preferences to enable you to support our work. We may at times share carefully selected relevant opportunities from partner organisations.
In response to an accident, safeguarding or child protection issue Woodcraft Folk may also share information with insurers, medical or Child Protection teams in order to safeguard a child.
Donors & supporters
Woodcraft Folk will use the personal information you provide to process any donations you make to us and to keep in touch with you about how we have used your donation. If you opt in to fundraising communications, we may contact you about making further donations. Where provided demographic data will also be used to monitor equal opportunities.
Your data will be stored electronically.
It will also be used and analysed by our Fundraiser to better understand your fundraising preferences.
Woodcraft Folk uses third party providers to process card payments, standing orders and direct debit payments. Woodcraft Folk does not hold personal
financial information about donors beyond their name, donation history and Gift Aid status.
If you have opted in to receive updates about national activities, it will also be stored by a third party mailing system provider and managed by staff and relevant volunteers in line with Woodcraft Folk’s Data Protection Policy. All recipients can unsubscribe at any time by activating the unsubscribe service.
If you have opted in to receive fundraising communications we may contact you about making a donation or about Gift Aid preferences to enable you to support our work. We may at times share carefully selected relevant opportunities from partner organisations.
Trustees
Woodcraft Folk will use the personal information you provide to manage your membership of General Council (Woodcraft Folk’s Board of Trustees). In addition to the uses set out above for volunteers, we will share relevant information with regulatory bodies including the Charity Commission, the Office
of the Scottish Charity Register and Companies House, and with providers, e.g. our bankers and other financial institutions to meet other legal requirements, including anti-money-laundering regulations.
If we have not already shared your information with the Disclosure & Barring Service (England & Wales) and the Protection of Vulnerable Groups service (Scotland) due to your volunteering, we will do so because Trustees are ultimately responsible for the safeguarding of children and young people engaging with Woodcraft Folk. Woodcraft Folk Trustee names and organisational contact details will be
displayed on our website and in our Annual Report.
Staff
Woodcraft Folk will use the personal information you provide for the purposes of administering and managing the employee/employer relationship, monitoring equal opportunities, and complying with our legal and regulatory obligations. Your data will be stored electronically. Woodcraft Folk contracts a third party service provider to host employee information, process leave and issue payslips. Woodcraft Folk will only share your personal information with those third parties we contract to provide payroll, pension and related HR services. Please see Data Protection Policy for more information.
Your data will be stored for 6 years following the end of your employment period to support reference requests after which time we will destroy all records retaining only your name, role, period of employment and any child protection or safeguarding concerns. In response to an accident, safeguarding or child protection issue Woodcraft Folk may also share information with insurers, medical or Child Protection teams in order to safeguard a child.
Contractors
Woodcraft Folk will use the personal information you provide in order to administer your engagement with us, including communicating with you and arranging payment for services contracted. Your data will be stored for 6 years following the end of your engagement period to support reference requests after which time we will destroy all records retaining only your name, role, period of engagement and any child protection or safeguarding concerns.
In response to an accident, safeguarding or child protection issue Woodcraft Folk may also share information with insurers, medical or Child Protection teams in order to safeguard a child.
Job Applicants
Woodcraft Folk will use the personal information you provide for the purposes of administering and managing your application, monitoring equal opportunities, and complying with our legal and regulatory obligations. Your data will be stored electronically. Woodcraft Folk contracts a third party service provider to manage application data. Information about shortlisted candidates will be held securely within Woodcraft Folk’s data infrastructure. Document access will be restricted to the shortlisting panel and HR administration team. If your application is unsuccessful all data will be destroyed securely within 6 months of the closing date or until any complaint or conflict has been resolved.
Customers
Woodcraft Folk will use the personal information you provide for the purposes of fulfilling our contract to provide the goods or services you have purchased and dealing with any issues arising from your purchase.
If you opt in to marketing communications, we may use the personal information you provide to send you information about other Woodcraft Folk products or services we think you may be interested in. We will not sell your data or share it with third parties except where necessary to fulfil our contract with you or where required to do so by law.
Centre Guests
Woodcraft Folk will use the personal information you provide for the purpose of ensuring you have a safe and enjoyable visit to one of our centres. Your data will be stored electronically. Woodcraft Folk contracts a third party to provide a secure online booking and payment system. Your data will not be used
for any other purpose without your consent.
If you opt in to marketing communications, we may use the personal information you provide to send you information about other Woodcraft Folk products or services we think you may be interested in.
If you have opted in to receive fundraising communications we may contact you about making a donation or about Gift Aid preferences to enable you to support our work. We may at times share carefully selected relevant opportunities from partner organisations.
We will not sell your data or share it with third parties except where necessary to fulfil our contract with you (caterers or activity providers) or where required to do so by law.
In response to an accident, safeguarding or child protection issue Woodcraft Folk may also share information with insurers, medical or Child Protection teams in order to safeguard a child.
Visitors at our events, including international delegations
Woodcraft Folk will use the personal information you provide for the purpose of ensuring you have a safe and enjoyable visit to one of our events. Your data will be stored electronically. Woodcraft Folk contracts a third party service provider to provide an online registration, group and event management system. If you opt in to marketing communications, we may use the personal information you provide to send you information about other Woodcraft Folk products or services we think you may be interested in.
If you have opted in to receive fundraising communications we may contact you about making a donation or about Gift Aid preferences to enable you to support our work. We may at times share carefully selected relevant opportunities from partner organisations.
We will not sell your data or share it with third parties except where necessary to fulfil our contract with you (caterers or activity providers) or where required to do so by law.
In response to an accident, safeguarding or child protection issue Woodcraft Folk may also share information with insurers, medical or Child Protection teams in order to safeguard a child.
Reference providers
Woodcraft Folk will use your personal information only to receive suitability references for staff and volunteers who have given your contact details as a suitable referee. The reference provided together with your name, role and date provided will be stored electronically in the staff or volunteer records for the individual it was given. We will not sell your data or share it with third parties. We will not contact you for any other purpose.
Third Party Service Providers working on our behalf
If you make a donation online or purchase a product from Woodcraft Folk, your card information is not held by the organisation, it is collected by a third party payment processor, who specialise in the secure online capture and processing of credit/debit card transactions.
Woodcraft Folk works with a number of third party service providers to deliver its
activities, including:
● Groop: Group registration and event management system
● Constant Contact: Email and communications management system
● NetGuides: Online booking system
● WorldPay: Online payment system
● QuickBooks: Online HR system
● Talos360: Online recruitment system
● First Advantage: Online DBS processing system
● Tee-Mill: Online print on demand shop
● Stripe: Online payment system
● JustGiving: Online donation system
As described above, Woodcraft Folk may pass your information to a third party service provider, agent subcontractor and/or other associated organisation for the purposes of completing tasks and providing services to you. However, when Woodcraft Folk uses a third party service provider, only the personal information that is necessary to deliver the service is disclosed. Woodcraft Folk will also only work with third party service providers when there is a contract in place that requires them to keep your information secure.
Woodcraft Folk will not contact you for marketing purposes by email, phone or text message unless you have given your prior consent. You can change your preferences at any time by contacting data@woodcraft.org.uk
Woodcraft Folk will not sell or rent your information to third parties. Woodcraft Folk will not share your information with third parties for marketing purposes.
Media content (photo, video and audio content)
To help promote the value of our work, Woodcraft Folk takes a range of photos, video and audio content. Photos, videos and audio content may be used by Woodcraft Folk, or by our event partner(s) (including funders) on websites, social media, promotional materials, publications, press releases or other illustrations of our work.
Woodcraft Folk will ask for consent from individuals that will be used in photos where they may be identifiable. Where the individual is under the age of 16 or a vulnerable young adult we will seek consent of the parent/guardian. Consent can be withdrawn at any time and will be notified on all paperwork. If consent is withdrawn we will stop using the photos/videos/audio content for future purposes but may not be able to retract publications already in the public domain.
Who has access to your information?
Woodcraft Folk does not sell any personal data.
Woodcraft Folk shares appropriate personal data with the following parties:
● Organisations and partners delivering Woodcraft Folk activities. For example a residential centre may be given names, access needs and dietary requirements to support the participation of individuals.
● Funders will receive aggregated and anonymised statistics only. These are shared with funders to demonstrate the impact of our programmes.
● HMRC and other organisations for the performance of employee contracts.
● Social Services, emergency services, the Health and Safety executive, local authorities and the police in the event of an emergency or in the event of a safeguarding issue (e.g. there is a risk to the safety of a young person or any other party) or to law enforcement agencies for the prevention and detection of crime.
● Where we have a legal or regulatory obligation we will share data/information with the police, law enforcement agencies, the Government and statutory agencies or any other necessary parties.
● The Disclosure and Barring Service (DBS) for the purposes of verifying suitability of those working with children and young people.
● Third party suppliers: We may need to share your information with data hosting providers or service providers who help us to deliver our services, projects, or fundraising activities and appeals. These providers will only act under our instruction and are subject to pre-contract scrutiny and contractual obligations containing strict data protection clauses. We also may need to share your names with partners and venues hosting events for the purpose of registration.
Your data protection rights
Under data protection law, you have rights including:
● Your right of access – You have the right to ask Woodcraft Folk for copies of your personal information.
● Your right to rectification – You have the right to ask Woodcraft Folk to rectify information you think is inaccurate. You also have the right to ask Woodcraft Folk to complete information you think is incomplete.
● Your right to erasure – You have the right to ask Woodcraft Folk to erase your personal information in certain circumstances.
● Your right to restriction of processing – You have the right to ask Woodcraft Folk to restrict the processing of your information in certain circumstances.
● Your right to object to processing – You have the right to object to the processing of your personal data in certain circumstances.
● Your right to data portability – You have the right to ask that Woodcraft Folk transfer the information you gave to another organisation, or to you, in certain circumstances.
Accessing your data
You are not required to pay any charge for exercising your rights. If you make a request, Woodcraft Folk have one month to respond to you. Please contact data@woodcraft.org.uk if you wish to make a request.
The right to be forgotten
If you no longer wish Woodcraft Folk to store and process your data, you have the Right to request that it be deleted. Your request will need to be emailed to data@woodcraft.org.uk
Under the GDPR Woodcraft Folk must respond to a request to have your data erased, however there are circumstances where Woodcraft Folk will be unable to erase data due to other obligations. For example:
● Where there are financial transactions on your record (where part of the data must be kept for a set period of time). In this instance, we will keep the data that must be held for financial and audit purposes and will erase all data not required for this purpose
● Where there has been a complaint, disciplinary, safeguarding issue, child protection concern or accident. In these instances we will keep the data until the issue has been resolved or the time limits set out in our reporting and record keeping guidance have been reached.
Full details and an explanation of Woodcraft Folk’s decision will be communicated to you.
How to complain
If you have questions about how Woodcraft Folk uses your data that are not answered by this document please email data@woodcraft.org.uk.
If you have a complaint about how Woodcraft Folk has used your data, please contact data@woodcraft.org.uk. You can also complain to the Information Commissioner’s Office if you are unhappy with how Woodcraft Folk have used your data.
The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
Policy History
This policy was agreed by General Council in June 2022. It includes updated
information on:
● Definition and legal framework
● Woodcraft Folk’s lawful base to collect and use data
● How Woodcraft Folk use data to undertake activities
● Third party service providers
● Media content
● Individual’s data protection rights
Individual privacy statements have not significantly changed.
This policy is an updated policy previously approved February 2020 and May 2018.
This policy replaces the previous Data Protection Policy approved February 2020.