Privacy Notice
Blue Sky Trust (BST) is committed to protecting your privacy and data. We will use the information that we collect about you in accordance with the General Data Protection Regulations 2018 and the Privacy and Electronic Communications Regulations 2003. This Privacy Notice describes the way BST, as a controller use your data. This notice applies to current and ex service users, employees, volunteers, supporters, trustees, applicants, donors and those making enquiries.
1. Your personal data – what is it?
Personal data relates to any data that identifies a person. Identification can be by the information alone or in union with any other information that Blue Sky Trust holds. The processing of personal data is governed by General Data Protection Regulation (the “GDPR”).
2. Principles for processing your personal data
BST will comply with legal obligations under the GDPR to keep personal data up to date; to store and destroy it securely; to not collect or retain excessive amounts of personal data; to keep personal data secure, and to protect personal data from loss, misuse, unauthorised access and disclosure and to ensure that appropriate technical and organisational measures are in place to protect personal data. We process data in line with our Data Protection and Information Governance Policy which can be viewed on request.
3. What data do BST process?
In order to aptly support or respond to enquiries we will process the following data:
Names, titles, and aliases, photographs;
Contact details such as telephone numbers, addresses, and email addresses;
Demographic information such as gender, age, date of birth, marital status, nationality, education/work histories, family composition, and dependants;
Personal information required to deliver the service including risk information, support needs assessment, medical and/or health information, support received and information about family, household members and/or carers;
Where you make donations or pay for activities, financial identifiers such as bank account numbers, payment card numbers, payment/transaction identifiers, policy numbers, and claim numbers.
Special Category Data
The data we process constitutes special category data because, as a charity working in the field of HIV/sexual health, we may process data relating to your health status. Where you provide this information, we may also process other categories of special category data: racial or ethnic origin, sexual health, sexual orientation, religion, mental and physical health, disability, medication/treatment received, gender/gender identity and criminal records, fines and other similar judicial records.
4. Why do we process your personal data?
We use your personal data for some or all of the following purposes:
• To deliver the charity’s constitutional aim, to support clients and provide services relevant to this aim
• To monitor and improve services including ensuring our services meet equality and diversity standards
• To maintain supporter and donor records
• To fundraise and promote BST
• To manage our trustees, employees and volunteers
• To manage accounts and records (including gift aid applications)
• To keep individuals up to date on news, events and services
• To carry out Safeguarding procedures (including due diligence and complaints handling) in accordance with best safeguarding practice from time to time with the aim of ensuring that all children and adults-at-risk are provided with safe environments.
5. What is the legal basis for processing your personal data?
These fall under either article 6 (personal data) or article 9 (special categories of data) processing.
Article 6 processing personal date:
• Legitimate interests (e.g. to provide the service clients are requesting to be referred to, voluntary service)
• Consent of the data subject;
• Processing is necessary for compliance with a legal obligation (e.g. relating to finances,);
• Processing is necessary for a contract (e.g. employment)
Article 9 processing special category data
• Explicit consent of the data subject
• Processing is necessary for carrying out obligations under employment, social security or social protection law, or a collective agreement;
Where your information is used other than in accordance with one of these legal bases, we will obtain your consent to that use unless there is another public interest that we can rely on to use your personal data.
6. Sharing your personal data & Blue Sky Trust’s Website
Your personal data will be treated as strictly confidential and will be shared only with those responsible for processing it e.g. administering Gift Aid and other donations. We will only share your data with third parties outside of the organisation with your consent or where we are legally required to share your personal data- where we share your personal data to protect BST or another individual. It may also be shared with our contractors. For example, we may ask a commercial provider to maintain our database software e.g. Substance. In these instances we will ensure these processors also comply with the ‘GDPR’ regulation. Copies of contractors’ privacy notice can be shared on request.
Blue Sky Trust’s website contains links to and from other organisations’ websites. If you go to another website from this one, read their privacy policy to find out what it does with your information. We never share your information with other organisations for marketing, market research or commercial purposes, and we don’t pass on your personal information to any other website. The transmission of information over the internet is never completely secure. We’ll do our best to protect your personal data, but cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk.
7. How long do we keep your personal data?
Your personal data will be kept no longer than necessary in order to comply with HMRC, Charity Commission and other regulatory requirements and in case of any legal claims or complaints. The table below sets out Blue Sky Trust’s retention period for different types of data.
Type of Record & Minimum Retention Period
Adult service user - 10 years after date of last contact between the service user and Blue Sky Trust, or 8 years after the death of the service user if sooner
Child service user - Until the child’s 25th birthday (or 26th birthday if entry was made when the young person was 17), or 8 years after death if sooner
Employee - 10 years after the individual ceases to be employed by Blue Sky Trust
Volunteer - 10 years after the volunteer ceases to volunteer at Blue Sky Trust
Donor - 7 years after the final transaction
Applicant - 1 year after the applicant has been made aware of their unsuccessful application
Applicant - 1 year after enquiry resolved
8. Your rights and your personal data
When exercising any of the rights listed below, in order to process your request, we may need to verify your identity for security reasons. In such cases we will need you to respond with proof of your identity before you can exercise these rights.
You have the right to access personal data we hold on you.
You have the right to correct and update the personal data we hold on you, if it is out of date or incorrect.
You have the right to request to have your personal data erased. This will be carefully considered but may not be possible due to the need to retain information to comply with a legal obligation or for the performance of a task of public interest, for the exercise or defence of legal claims or for purposes relating to public health, archiving in the public interest, scientific/historic research or statistics
You have the right to data portability. This means that you have the right to request that we transfer some of your personal data to another controller. (This only applies where the processing is based on consent or is necessary for the performance of a contract with the data subject and in either case the data controller processes the data by automated means).
The right to request that we stop processing your personal data.
The right to withdraw your consent to the processing at any time.
The right to lodge a complaint with the Information Commissioner’s Office.
Once we have received your request we will endeavour to respond within one month and this will normally be free of charge.
9. Further processing
If we wish to use your personal data for a new purpose, not covered by this Data Protection Notice, then we will provide you with a new notice explaining this new use prior to commencing the processing and setting out the relevant purposes and processing conditions. Where and whenever necessary, we will seek your prior consent to the new processing.
10. Changes to this notice
This Notice was last updated in May 2018. We keep this Notice under review and any updates will be posted on our website: www.blueskytrust.org
Contact Details
Please contact us if you have any questions about this Privacy Notice or the information we hold about you or to exercise all relevant rights, queries or complaints at:
Data Controller Contact: Helen Anderson
Address: Blue Sky Trust, The Castlegate, Melbourne Street, Newcastle upon Tyne, NE1 2JQ
Telephone: 07989155175
Email: info@blueskytrust.org