Privacy notice – volunteers

We are The Access Project, and we are based at 128 Aldersgate Street, Barbican, London, EC1A 4AE. We are a Data Controller and are committed to protecting your data in line with the General Data Protection Regulation (GDPR).

The central contact for data protection can be contacted through info@theaccessproject.org.uk.

Processing personal data

We process personal data relating to our tutors in order to run The Access Project and keep people informed about any work that we are completing.

What personal information do we collect and how is it used?

Personal information means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

Typically, we collect: 

  • Your name
  • Date of birth
  • Email address and telephone number
  • Education information and reference details. 

We also collect your five year address history, history of name changes, birthplace details, ID documents and information relating to any unspent criminal convictions to process your DBS checks.

We collect information through our volunteer registration process, either directly from you or the references you will be asked to provide. We also collect your contact information to register you on our safeguarding e-learning system Me Learning.

We record tutorials occurring online using the company Infiniti for safeguarding purposes. Their privacy policy can be found here.

We may sometimes collect additional information from third parties including business and social media searches such as LinkedIn. We use volunteer websites such as do-it.org, Escape the City, Volunteering Brent, Reach Volunteering – these sites may capture an interested volunteer’s name and email address or phone number and pass this on to us to contact you. We may collect personal information in the course of volunteering activities throughout the period of you volunteering for us.

What do we do with your data?

We look after your personal data by keeping it up to date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting it from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect it.

We store your data on the secure cloud-based service Salesforce, we use Gmail for email communications, Me-Learning for safeguarding training and all tutorial recordings are held within the Infiniti platform.

We may share your data with third parties:

  • Schools, in order to inform a school about their pupils’ tutor pairings
  • A university, in order to inform that university about their volunteer tutor pairings
  • Business partners, in order to allow them to monitor the impact of their company’s volunteer tutors
  • Law enforcement agencies, regulators, courts or other public authorities where we are required to, or are authorised to by law
  • Tutoring programmes and their business administrators, in order to support schools by providing access to high-quality tutoring to help pupils whose education has been affected by the COVID-19 pandemic
  • Tutor personal data is shared with our evaluation partners who will use it to conduct impact analyses of our programme
  • Anonymised data is sometimes provided to third parties for purposes of statistical analysis to enable us to assess the impact of our work
  • We use a third-party provider, Mailchimp, to deliver our newsletters. You can find more information here. 

If we have a contract with another organisation to provide services on our behalf or if we share information with other parties as set out above, we’ll make sure that they also have appropriate security measures in place and only process your personal data in accordance with our instructions and not for any other purpose.

If you are not willing to provide your personal data, then you will not be able to benefit from many of our services or participate in our programmes.

Our legal grounds for using your information

Under the General Data Protection Regulation (GDPR), the lawful bases we rely on when handling your information are:

  • We ask for your consent to contact you for any reason other than necessary communications while you are on the programme. This is in accordance with the legal basis of consent
  • We share information that will help us to improve The Access Project, except where doing this is unfair to you. This is in accordance with the legal basis of legitimate interests.

Specifically, we have a legitimate interest in:

  • Processing your information when it is essential for us to run The Access Project, for example setting you up as a volunteer, sending you important volunteering updates/ safeguarding reminders and sharing your contact details with your student partner
  • Providing parents with the name and place of work of the tutor their child is matched with, to keep them informed in the matching process
  • Sharing tutor information with organisations that help us to evaluate The Access Project, to determine the effectiveness of The Access Project and make it more effective for future students
  • Recording training sessions for quality assurance purposes.

    If you don’t want us to use your data for these legitimate interests, please contact info@theaccessproject.org.uk.
  • We share your information when we have a legal obligation to do so. For example, we may report a safeguarding concern to Children’s Services. We may also have to disclose your information to third parties such as the courts, the local authority or the police where legally obliged to do so
  • ​We will share information to prevent someone from coming to serious harm, in accordance with the legal basis of vital interests.

Special category data

We may, with your consent, process “special categories” of personal data (sensitive personal data). We will never share this information without your consent.

We won’t do anything with your information that you wouldn’t reasonably expect. If you have any queries regarding how we process your data, please contact us at info@theaccessproject.org.uk

We will only hold your information for as long as is necessary in line with our retention policy, which is usually for as long as you have an active relationship with The Access Project or as long as the law requires.

Transfers outside of the EEA

We may share personal information to third parties outside of the European Economic Area (EEA). Any personal information transferred will only be processed on our instruction and we ensure that information security at the highest standard would be used to protect any personal information as required by the Data Protection laws. Where personal data is transferred outside of the EEA to a country without an adequacy decision, we will ensure appropriate safeguards are in place prior to the transfer. These could include standard contractual clauses.

For more information about transfers and safeguarding measures, please contact us using the information provided in this policy.

Your rights

You have the following rights relating to your personal information:

  • The right to see all of your personal information that we use
  • The right to ask us to correct any of your personal information that is inaccurate or out of date
  • The right to ask us to erase your information when we are no longer using it
  • The right to withdraw your consent to the processing at any time
  • The right to request your personal information in a transferrable format (the right to data portability)
  • The right to request a restriction on the processing of your personal information
  • The right to object to us using your personal information
  • The right to make a complaint with the Information Commissioner’s Office by visiting www.ico.org.uk.

You have the right to stop us and our partners from using your personal information at any time, but this would mean that you can no longer participate in The Access Project.

If you would like to know more about your privacy and how we use your information, please email us.