Privacy Notices and Records Retention Policy

Section 1Purpose

This policy does two jobs. It sets out the privacy notices Being The Cure must publish under Articles 13 and 14 of the UK GDPR, and it sets the periods for which BTC keeps records. It sits under the Data Protection Policy, which contains the wider framework.

Section 2Privacy notices

A privacy notice must be given at the point personal data is collected. BTC maintains three, each stating who BTC is, what data is collected, the purposes and lawful bases, who it is shared with, how long it is kept, the individual’s rights, how to complain to BTC under section 164A of the Data Protection Act 2018, and the right to complain to the Information Commissioner.

• A notice for children and their parents and carers, given at registration, written so that a parent can understand it, with a short child-friendly version.
• A notice for volunteers, given at application.
• A notice for staff and trustees, given on appointment.

The children’s notice explains expressly that BTC will share information without consent where that is necessary to protect a child, and that it will comply with a statutory information notice from the local authority. Saying so at the outset is fairer than relying on it later.

Section 3Retention periods

Personal data is kept no longer than necessary. The periods below apply unless a longer period is required by law or by an ongoing investigation, claim or inquiry, in which case the record is placed on hold and not destroyed. Periods run from the end of the relationship or of the financial year, as stated.

• Child registration, attendance, consent and medical records: three years from the child leaving the provision.
• Safeguarding and child protection records, including concerns, referrals and the actions taken: until the child’s twenty-fifth birthday. Records relevant to a known claim, inquiry or investigation are retained until it concludes and are not destroyed in the meantime.
• Allegations against staff, volunteers or trustees, including the outcome: until the person reaches normal pension age or for ten years from the allegation, whichever is longer. Allegations found to be false, unsubstantiated, unfounded or malicious are removed from the personnel file.
• Low-level concerns records: for the duration of the person’s engagement, reviewed periodically for patterns.
• Recruitment and vetting record entries: for the duration of the engagement and six years after.
• Unsuccessful applicant records: six months from the decision.
• Employee personnel and payroll records: six years from the end of employment. Working time and holiday records: six years.
• Accident and first aid records: three years from the date of the entry, and for an accident involving a child, until the child’s twenty-fifth birthday.
• Accounting records: at least six years from the end of the financial year to which they relate, as required by section 131 of the Charities Act 2011.
• Trustee minutes, the register of members, the register of trustees and the register of interests: permanently.
• Images of children: as set out in the Photography, Filming and Image Consent Policy, and deleted on withdrawal of consent.

Section 4Disposal and review

• Paper records are destroyed by cross-cut shredding or confidential waste. Electronic records are deleted from live systems and from backups in accordance with the backup cycle.
• A disposal log records what was destroyed, when, by whom and under what part of this schedule.
• The charity reviews records for disposal at least annually and records that the review took place.