In the process of undertaking our day-to-day work, The Nelson Trust regularly has the need to collect and use information about people with whom we work – members, employees (current, past, and prospective), trustees, clients, consultants and suppliers.

The Nelson Trust acknowledges the rights of individuals as set out in the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018 and we aim to respond promptly and appropriately to any Subject Access Request received.

Individual’s rights
GDPR sets out the following 8 rights of data subjects:

1. The right to be informed – individuals have the right to be informed about the collection and use of their personal data. The Nelson Trust has updated its privacy notices and documentation so that we are fully transparent about the personal data that we will obtain, the purpose(s), who it will he shared with, and how long it will be kept. Privacy notices include the rights of individuals.
2. The right of access – any living individual has the right to make a Data Subject Access Request, see below.
3. The right to rectification — we have a responsibility to ensure that data is accurate, and individuals can request that personal data is corrected either verbally or in writing. The Nelson Trust has 30 days to respond. This is the responsibility of the Data Protection Officer (DPO).
4. The right of erasure — Or ‘right to be forgotten’. Data subjects can request that their personal data is deleted. The Nelson Trust has 30 days to determine whether this is applicable and despond. It is the responsibility of the DPO to ensure data is erased appropriately.
5. The right to restrict processing / suppress their data – as above requests can be made verbally or in writing and the DPO has 30 days to consider and respond.
6. The right to data portability – this allows individuals to obtain and reuse their personal data tor their own purposes across different services.
7. The right to object — to processing, profiling, or inclusion in statistics, and
8. The right not to be subject to automated decision-making.

Subject Access Requests
The Nelson Trust endeavours to be clear and transparent about personal data held. The individual must confirm their identity and complete a Data Subject Access Request form and submit to The Nelson Trust. A copy of this form is available by contacting The Nelson Trust using the main address or by emailing office@nelsontrust.com, or downloading below.

• On receipt of a Subject Access Request form The Nelson Trust will forward to the nominated Data Protection Officer.
• All Subject Access Requests will he logged on a Subject Access Request (SAR) Log… The date of receipt will be recorded to enable monitoring against the 30 days timescales set out in legislation.

The Nelson Trust will not make a charge to respond to Subject Access Requests unless requests excessive, in which case a reasonable fee will be charged to cover the costs of preparing the response.

The responses must go through the following steps:

• Confirm whether the request is a Subject Access Request. If not then respond in accordance with usual procedures.
• Confirm the identity of the individual making the request in order to avoid inappropriate disclosure. Request any evidence required to confirm identity.
• Evaluate that the request is clear about what data subject requires, and that there is sufficient information to be able to comply with their request. Notify the subject if this is not the case.
• Determine whether the information will change between receiving the request and sending the response. Normal processing can still occur, however records must not be changed as a result of the request.
• If the request includes information about other data subjects, it is not reasonable to provide this information, and The Nelson Trust does not have their consent, then the information can either be redacted or a limited response provided with an explanation.
• If the request includes information containing any codes or language not easily understood by the subject a full explanation should be provided.
• The response should be supplied in an appropriate format that the respondent will be able to open and keep.
• The subject should be made aware of the The Nelson Trust complaints policy.

Phone Calls:
Phone calls can lead to unauthorised use or disclosure of personal information the following precautions should be taken:

• Personal information should not be given out over the telephone unless the caller’s identity has been established beyond doubt and the information requested is innocuous.
• If in doubt, ask the caller to put their enquiry in writing.

Responsibility
Overall responsibility for this policy lies with the The Nelson Trust Board of Directors / Trustees and its implementation with the Senior Management Team.
Review – This policy is reviewed annually and updated as required.

Disclaimer

This policy is intended as guidance for management and employees.
It does not confer any contractual rights on individuals.