Lighthouse Data Privacy Notice

LIGHTHOUSE DATA PRIVACY NOTICE updated 19th April 2024

This privacy notice explains how we use any personal information we collect about you.

1. Who are we?

Throughout this notice, the term ‘Lighthouse’ shall be taken to mean, collectively:

Lighthouse Beaconsfield, Registered Charity No. 1198953
Lighthouse Burnham, Registered Charity No. 1182190
Lighthouse Cressex, Registered Charity No. 1183476
Lighthouse Derby City, Registered Charity No. 1207908
Lighthouse Haddenham, Registered Charity No. 1201685
Lighthouse Hazlemere, Registered Charity No. 1178562
Lighthouse High Wycombe, Registered Charity No. 1114541
Lighthouse Langley, Registered Charity No. 1181000
Lighthouse Loudwater, Registered Charity No. 1197125
Lighthouse Mansfield, Registered Charity No. 1164680
Lighthouse Marlow, Registered Charity No. 1178062
Lighthouse Princes Risborough, Registered Charity No. 1178119
Lighthouse Safe Harbour, Registered Charity No.1180779
Lighthouse Shelswell, Registered Charity No 1187651
Lighthouse Central, Registered Charity No. 1169839

And Lighthouse Water Eaton which is an associate Lighthouse through St Frideswide’s Church, a resource hub in the Diocese of Oxford for community organising and church growth.

There is one other Lighthouse that is not part of Lighthouse Central: Great Missenden registered Charity No 1071892 (Lighthouse88). They will have their own Data Privacy Notice.

2. Definitions

‘Data Controller’ means the organisation that controls and makes decisions about personal data. Lighthouse is the Data Controller of some, but not all of the information collected and processed. Lighthouse uses the services of ‘The Software Charity’ (TSC) to collect and process data on its behalf, and TSC is the Data Controller of some of the information collected. If you have questions regarding use of data you may direct these to Lighthouse in the first instance.

‘Data Processor’ means the organisation that captures, stores and processes information. TSC carries this out for some types of information for Lighthouse. Lighthouse is the Data Processor for other types of information.

‘Personal data’ relates to a living individual who can be identified from that data. Identification can be by the information alone or in conjunction with any other information in the Data Controller’s possession or likely to come into such possession.

‘Data Protection Law’ means all data protection laws and regulations applicable to the UK including (i) UK Data Protection Act 2018; (ii) UK General Data Protection Regulation (‘UK GDPR’); (iii) Privacy & Electronic Communications Regulations 2003 (‘PECR’) relating to electronic communications; (iv) In the event that the EU GDPR (as defined in the Data Protection Act 2018) applies to activities, we will comply with the EU GDPR; and applicable national implementations of (iii) and (iv).

3. What information does Lighthouse collect about you?

a. Volunteers

We collect information about you when you volunteer with us that includes your date of birth, address and telephone number, email address, church attended, names, email addresses and telephone numbers of the references you provide, details of any DBS disclosures you hold and details of your proof of identity documents used to obtain a DBS check when required. In addition, Lighthouse collects your answers to the following declaration questions:

Have you any health problem(s) which might affect your work with children or young people?
Have you ever been known by any name other than the one given?
Have you, during the past five years, had any home address other than that given?
Has a child in your care, or for whom you have or had parental responsibility, ever been removed from your care, been placed on the Child Protection Register, or been the subject of a care order, a supervision order, a child assessment order, or an emergency protection order under the Children Act 1989, or a similar order under other legislation?
Have you ever been convicted of any criminal offence?
Have you been cautioned by the police, or bound over to keep the peace?
Have you ever been found by a court exercising civil jurisdiction (including matrimonial or family jurisdiction) to have caused significant harm to a child or young person under the age of 18 years? Or has any such court made any order against you on the basis of any finding or allegation that any child or young person was at risk of significant harm from you?

b. Parents / carers of volunteers under 18

If you are a volunteer under 16 years of age, you cannot register yourself, and we require a person with parental responsibility for you to register on your behalf. We collect information on these parents / carers, including their name, address and contact details.

If you are over 16 but under 18 you may register yourself as a volunteer, but we require you to give the name and contact information of your parent / carer.

c. Parents / carers and children

When you register a child for a place at Lighthouse we collect information that includes your name, address, email address and phone number(s), and the name, date of birth, health and special needs information of your child / children.

d. Donors to Lighthouse

Lighthouse is funded entirely by donations. We collect information from donors in order to determine those who are eligible to donate under Gift Aid. This information includes name, address, and eligibility to Gift Aid donations.

4. How will Lighthouse use the information about you?

Lighthouse complies with its obligations under GDPR legislation by keeping personal data up to date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data. All personal data is kept on central IT systems including those operated by TSC on behalf of Lighthouse and is not stored or transported on portable electronic devices.

Lighthouse uses your personal data for the following purposes:

To enable us to provide a voluntary service for the benefit of the public in a particular geographical area
To manage our volunteers: processing your application and keeping you updated with relevant information such as your role and training dates
To register children attending Lighthouse: processing your application, keeping you updated with relevant information such as ticket printing, ticket collection, the dates and times of Lighthouse events
To fundraise and promote the interests of Lighthouse
To maintain our own accounts and records (including the processing of Gift Aid applications)
To email you about other Lighthouse activities we think may be of interest to you. We will only email you for this purpose where we have a legitimate interest in doing so. You may opt out of these communications at any time by using the “unsubscribe” link on any email we send you.

5. What is the legal basis for processing your personal data?

Volunteers: Data is processed under Consent
Parents & Children: Data is processed under Consent
People providing references for Volunteers: Data is processed under Legitimate Interest
Parents / carers of Volunteers aged 16 – 18 who self-register: Data is processed under Legitimate Interest
Donors supporting Lighthouse: Data is processed under Consent
Processing is also necessary for carrying out obligations under health and safety, or social protection law or any regulatory body.

6. Sharing your personal data

Your personal data will be treated as strictly confidential. Lighthouse will not share your information with anyone else unless obliged by law.

You should note that some of your personal data is collected and processed by The Software Charity under contract from Lighthouse, you should refer to their data privacy notice at https://www.thesoftwarecharity.org/
You have a right at any time to stop us from contacting you. If you no longer wish to be contacted by Lighthouse, please email us at admin@lighthousecentral.org

7. Who sees your information?

Lighthouse considers the following information to be confidential:

Contact information, including addresses, email addresses and phone numbers
Date of birth
Answers to declaration question answers, specifically information relating to the criminal records of volunteers and DBS check identity data
Health information
Special needs information

Confidential information shall be seen only by individuals nominated by the Trustees (including admin staff, volunteer co-ordinators and those responsible for safeguarding).

Data is only shared on a strict need-to-know basis. For example, an Age Group Leader or Teacher will generally only receive the names of the leaders and children assigned to their age group. They may receive health and special needs information if a leader or child has a health condition or special needs that will impact upon them during their time on-site, whether this be behaviourally or through the requirement for medication.

During Lighthouse week all printed reports are held securely on site. These reports are collected and securely destroyed at the end of the Lighthouse week.

8. How long does Lighthouse keep your personal data?

Lighthouse retains all data collected about registered children for a period of two years

Lighthouse retains all data collected about volunteers for a period of five years. This time period is renewed when a volunteer registers again for Lighthouse.

The data for volunteers shall be used each year to contact those who have volunteered in previous years. At this point, volunteers have the choice to register again for Lighthouse, or request not to be contacted in future. If no such request is received, volunteers’ data will be kept on file and they will be contacted the following year, up to the five-year limit.

Following the five-year limit, if a volunteer does not register, their data will be deleted.

9. Exception to the two year period

In accordance with its duty of care responsibilities to all volunteers and children attending Lighthouse, Lighthouse will exceptionally keep a volunteer’s data on file for more than five years if that data indicates that the said volunteer could pose a threat to others, and the Lighthouse Trustees or individuals nominated by them consider there to be a reasonable risk of that person attempting to register at Lighthouse again in the future.

It is required by our Insurers that records of who attended training and who attended Lighthouse is kept for 15 years. This will be on the basis of data sufficiency: name, role at Lighthouse and Lighthouse location only and will be archived on a secure database.

Lighthouse retains gift aid declarations and associated paperwork for up to 6 years after the calendar year to which they relate.

10. Your rights and your personal data

Unless subject to an exemption under the GDPR, you have the following rights with respect to your personal data: -

The right to request a copy of your personal data which Lighthouse holds about you
The right to request that the Lighthouse corrects any personal data if it is found to be inaccurate or out of date
The right to request your personal data is erased where it is no longer necessary for Lighthouse to retain such data
The right to withdraw your consent to the processing at any time
The right to request that the Data Controller provide the data subject with his/her personal data and where possible, to transmit that data directly to another Data Controller, (known as the right to data portability)
The right, where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction is placed on further processing
The right to object to the processing of personal data
The right to lodge a complaint with the Information Commissioners Office.

Where Lighthouse is not the Data Controller for the types of data for which you are exercising your rights, for instance information where TSC is the Data Controller, you may contact the TSC Data Protection Officer. If you’re not sure, you may contact us in the first instance.

11. Further processing

If we wish to use your personal data for a new purpose, not covered by this Data Privacy Notice, then we will provide you with a new notice prior to commencing the processing. This notice will explain the new use and set out the relevant purposes and processing conditions. Where and whenever necessary, we will seek your prior consent to the new processing.

12. Changes to our Data Privacy Notice

Lighthouse keeps our Data Privacy Notice under regular review and we will place any updates on this web page. This Data Privacy Notice was last updated on 26rth March 2024 and is formally reviewed annually.

13. Contact Details

Please contact Lighthouse if you have any questions about our privacy notice or information we hold about you. You can contact us by email to admin@lighthousecentral.org, or by writing to us at Lighthouse central, Bridge House, Station Approach, Great Missenden HP16 9AZ

You can contact the Information Commissioners Office on 0303 123 1113, via email - see ico.org.uk/ or by letter addressed to The Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire. SK9 5AF.