Privacy &
Confidentiality Policy

1. Purpose

Purpose of this policy

This policy explains how OCAAF collects, uses, stores, protects and discloses personal information, and how staff, volunteers, trustees and contractors must maintain confidentiality.

The charity is committed to complying with:

• UK General Data Protection Regulation (UK GDPR)
• Data Protection Act 2018
• Privacy and Electronic Communications Regulations (PECR), where applicable
• Charity Commission guidance and good governance principles

2. Scope

Who this policy applies to

This policy applies to:

• Trustees
• Employees
• Volunteers
• Contractors and consultants
• Any individual acting on behalf of the charity

It applies to all personal data held in electronic or paper format.

3. Definitions

Personal and confidential information

Personal Data

Any information relating to an identified or identifiable individual.

Special Category Data

More sensitive personal data, including information relating to:

• Health
• Ethnic origin
• Religious beliefs
• Sexual orientation
• Political opinions

Confidential Information

Information that is private, sensitive or not publicly available and has been obtained through involvement with the charity.

4. Data Protection Principles

How personal information is managed

The charity will ensure personal data is:

• Processed lawfully, fairly and transparently.
• Collected for specified legitimate purposes.
• Adequate, relevant and limited to what is necessary.
• Accurate and kept up to date.
• Retained only as long as necessary.
• Kept secure and protected against unauthorised access.
• Managed in a manner that demonstrates accountability.

5. Information We May Collect

Types of information

Depending on our activities, the charity may collect:

• Names and contact details
• Addresses and email addresses
• Financial and donation records
• Volunteer and employee records
• Safeguarding information
• Service user information
• Emergency contact details
• Criminal records information where legally required
• Health information where necessary and lawful

6. How Information Is Used

Why we process information

The charity may use personal information to:

• Deliver charitable services
• Manage volunteers and staff
• Process donations and Gift Aid claims
• Communicate with supporters and beneficiaries
• Meet safeguarding obligations
• Comply with legal and regulatory requirements
• Maintain financial and operational records

The charity will only process personal information where there is a lawful basis under UK GDPR.

7. Confidentiality Requirements

Confidentiality requirements

All trustees, staff, volunteers and contractors must:

• Keep confidential information secure.
• Use information only for authorised charity purposes.
• Not disclose information to unauthorised persons.
• Avoid discussing confidential matters in public places.
• Ensure electronic information is password protected.
• Report any suspected data breaches immediately.

Confidentiality obligations continue after employment or voluntary service ends.

8. Information Sharing

When information may be shared

Personal information will only be shared when:

• The individual has provided consent.
• Sharing is necessary to deliver services.
• There is a safeguarding concern.
• There is a legal or regulatory requirement.
• It is necessary to protect someone’s vital interests.

Information will only be shared on a need-to-know basis.

9. Data Security

Protecting information

The charity will implement appropriate security measures, including:

• Secure passwords and access controls
• Encrypted devices where appropriate
• Secure storage of paper records
• Staff and volunteer training
• Regular reviews of information-security arrangements
• Appropriate disposal of confidential records

10. Data Retention

How long information is kept

The charity will retain personal information only for as long as necessary to fulfil its purposes and comply with legal obligations.

Records will be securely destroyed when no longer required.

11. Individual Rights

Individual data-protection rights

Individuals have the right to:

• Access their personal information
• Correct inaccurate information
• Request erasure where appropriate
• Restrict processing
• Object to processing in certain circumstances
• Request data portability where applicable
• Withdraw consent where consent is the lawful basis

Requests should be made to the charity’s designated contact.

12. Data Breaches

Reporting and responding to breaches

Any actual or suspected personal-data breach must be reported immediately to:

Data Protection Lead:
Owain Williams / Chair of Board of Trustees

The charity will investigate breaches and, where required, notify the Information Commissioner’s Office and affected individuals.

13. Safeguarding Exceptions

Exceptions to confidentiality

Confidentiality may be overridden where there are concerns about:

• Abuse
• Harm to a child or vulnerable adult
• Serious criminal activity
• Threats to life or safety

Any disclosures will be made in accordance with safeguarding procedures and legal requirements.

14. Responsibilities

Who is responsible

Trustees

• Ensure compliance with legal obligations.
• Monitor implementation of this policy.

Staff and Volunteers

• Follow this policy and associated procedures.
• Protect personal and confidential information.
• Report breaches promptly.

Managers

• Promote good information-governance practices.
• Ensure staff receive appropriate training.

15. Contact Details

Privacy and confidentiality enquiries

For privacy or confidentiality enquiries: