This policy outlines how the ‘Time for Recovery’ campaign run by Restore the Balance Limited processes and manages personal data
1. Data Controller – The Data Controller is Restore the Balance Limited and our Data Protection Officer can be contacted by email: email@example.com
2. Lawful basis for processing – All processing is carried out by consent, under the legitimate interest of our campaign, or public interest. These cover processing to maintain contact with you, as well as our campaigning and communication more broadly in support of our campaign. Where processed under the lawful basis of a task carried out in the public interest, it is to support or promote democratic engagement. This includes fundraising activity in order to support democratic engagement.
3. Data sources – All Personal Data comes from what you provide to us when you sign up for our campaign or correspond with us.
4. Data Security – Personal Data is stored electronically and securely. We only work with service providers who comply with our expected standard of security.
5. Special Category Data – Special category data will be processed under the lawful basis indicated in section 2 above. We also may process data as is permitted in clauses 4, 13, and 24 of schedule 1 of the Data Protection Act, covering research, journalistic use and communication to elected representatives. This is because our campaign aims to share information, including by research and sharing of our findings, and to support debate by raising questions in the media and with elected persons.
6. Transferring your data outside of the UK or European Economic Area – Some service providers are located outside of the European Economic Area (EEA) and therefore it may be necessary to transfer your personal data outside of the EEA. Where the transfer of your data outside of the EEA takes place we will make sure that it is protected in the same way as if the data was inside the EEA, and it only occurs with your consent, which you gave at sign up. Wherever possible we work with providers in the UK or Europe. We also avoid sharing personal data wherever we can.
7. Data retention policy – We will keep personal data until our campaign concludes. We will review the data held each calendar year to determine whether it should be maintained or put beyond use. Once our campaign ends all personal data will be deleted.
8. Subject Access Requests –
• We will request verification of the identity of any individual making a request, and ask for further clarification and details if needed.
• We will respond within 28 calendar days once we have confirmed it is a legitimate request.
• Data subjects have the right to the following:
o To be told whether any personal data is being processed
o To be given a description of the personal data, the reasons it is being processed and whether it will be given to another organisations or people.
o To be given a copy of the information comprising the data, and given details of the source of the data where this is available.
9. We will not share your personal data with anyone else, unless required to by law.
10. Your personal data is only used as outlined here and within reasonable expectations based on the nature of the campaign, and recognising the need of politically related engagement in wider support of democratic engagement.
11. Personal Data Rights –
• Right of access – you have the right to request a copy of the information held about you.
• Right of rectification – you have a right to correct data held about you that is inaccurate or incomplete.
• Right to be forgotten – in certain circumstances you can ask for the data held about you to be erased from our records.
• Right to object – you have the right to object to certain types of processing, such as direct marketing.
• Right to object to automated processing, including profiling – you also have the right not to be subject to the legal effects of automated processing or profiling.
• Right to review: You have the right to complain to the UK Information Commissioner if we cannot resolve your complaint.