Data Protection Policy

Mosaic LGBT+ Young Persons’ Trust, Charity Number 1166676

 

Policy Owner: FRG Committee 

Review Cycle: 18 months

Next Review Date: Nov 2025 (Updated and re-approved May 2024)

 

 

M Mindful

O Open

S Safe

A Agile

I Inclusive

C Community

""

1. Statement of Intent 

 

This policy describes Mosaic LGBT+ Young Persons' Trust’s Data Protection Policy. It describes how personal data is collected, handled, and stored to deliver the services of the charity. 

 

2. Purpose of Policy

 

This Data Protection policy shows our commitment to:

 

  • Comply with the Data Protection Act (DPA) as well as the General Data Protection Regulation (GDPR) which was implemented on 25 May 2018. 
  • Protect the rights of the young persons we work with, employees, volunteers, and delivery partners.
  • Be open and transparent about how we store, process, and remove personal data.

 

The General Data Protection Regulations 2018 (GDPR) gives individuals the right to know what information is held about them. It provides a framework to ensure that personal information is handled properly. The new General Data Protection Regulation came into effect in the UK on 25 May 2018, and replaced the Data Protection Act 1998.

 

The Regulations work in a number of ways. Firstly, it states that anyone who processes personal information must comply with eight principles, which make sure that personal information is:

a)  processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);

b)  collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’);

c)  adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);

d)  accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);

e)  kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’);

f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).

Privacy and Electronic Communications Regulations 2003 (PECR),  sit alongside the GDPR to govern electronic marketing, cookies, and communication service security. Mosaic and our representatives must follow the rules set out in PECR regarding unsolicited communications, website cookie collection and storage and Mosaic takes proactive measures to secure the data that we hold. Where there are opposing positions between GDPR and PECR Mosaic will follow PECR rules with respect to electronic communications regulations. If anyone is unsure of regulations they may contact the DPO, Benjamin McGlynn-Moore.

 

Ed to HERE 

 

3. Policy Scope

 

This policy applies to:

 

  • All staff, Trustees and volunteers of Mosaic LGBT+ Young Persons' Trust.
  • All stakeholders and delivery partners working alongside Mosaic LGBT+ Young Persons' Trust.

 

It applies to all data that the charity holds relating to young persons, volunteers, and staff. This can include, but is not limited to:

 

  • Names of individuals
  • Postal addresses
  • Emergency contacts 
  • Email addresses
  • Telephone numbers
  • Feedback forms around youth network sessions
  • Medical and health records that are stored for safeguarding purposes 

 

4. Our commitment to Data Protection

 

This policy helps us to protect Mosaic LGBT+ Young Persons' Trust, young persons the charity works with, staff, and volunteers from the following risks:

 

  • Breaches of confidentiality (i.e. but not limited to: unauthorised release/disclosure of information, accidentally or deliberately; loss of feedback forms with young person’s views of the session; disclosure of personally identifiable information without explicit consent).
  • Failing to offer freedom in what we do with personal data (i.e. but not limited to: individuals being able to choose and know how we process their data, where we store it, and how it is disposed).
  • Reputational damage (i.e but not limited to: in the unlikely event personal data becomes disclosed due to compromise of systems where personal data is stored).

 

5. Responsibilities

 

Everyone who works for or with Mosaic LGBT+ Young Persons' Trust has responsibility for ensuring compliance with data protection regulations and the appropriate handling of data. Any individual/team who handles personal data must ensure that it is handled and processed in line with this policy and UK data protection laws and regulation. Additionally, individuals listed below has the following areas of responsibility:

 

a) The Board of Trustees is ultimately responsible for ensuring that Mosaic LGBT+ Young Persons' Trust’s staff and volunteers meet its legal obligations around data protection.

 

b) The Data Protection Officer, Benjamin McGlynn-Moore, is responsible for:

 

  • Keeping the Board updated about data protection responsibilities, risks, and issues.
  • Reviewing all data protection procedures and related policies, in the line with an agreed bi-annual review schedule (March and September).
  • Handling data protection questions from staff and anyone else covered by this policy.
  • Dealing with requests from individuals to see the Mosaic LGBT+ Young Persons' Trust holds about them (also called ‘subject access requests’). 
  • Checking and approving any contracts or agreements with third parties that may handle the charity’s and individuals’ sensitive data.
  • Training and maintaining a training schedule for all Trustees and employees.
  • Ensuring any young person’s request for data to be removed is acknowledged and addressed within 14 days.

 

c) The Chair (or co-chairs) along with the Board of Trustees’ are responsible for: 

 

  • Ensuring all systems, services, and equipment used for storing data meet best practice security standards. This can include ongoing training of staff alongside practical security measures, such as implementing 2FA. 
  • Performing regular checks and scans to ensure security hardware and software function properly.
  • Evaluating any third-party services the charity is considering to use storing or processing data.
  • Approving any data protection statements attached to communications such as emails and letters.
  • Addressing any data protection queries from media outlets and/or the public.
  • Working with the Board of Trustees to ensure Mosaic’s initiatives and communications abide by UK data protection laws and regulations.

 

d) The Executive Director, Łukasz Konieczka, is responsible for: 

 

  • Ensuring all young persons providing any form of personally identifiable information provide consent for the charity to store and process their data.
  • Ensuring all new and existing volunteers are aware of their responsibilities to ensure compliance with UK data protection laws and regulations.
  • Working with other staff and the Board to ensure Mosaic services, volunteers, staff, and collaborators abide by UK data protection laws and regulations.
  • Arranging data protection training and advice for individuals covered by this policy.

 

e) The Data Controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’):

 

  • Processed fairly and lawfully and, in particular, shall not be processed unless specific conditions are met;
  • Obtained only for one or more of the purposes specified in the Act, and shall not be processed in any manner incompatible with that purpose or those purposes;
  • Adequate, relevant and not excessive in relation to those purpose(s);
  • Accurate and, where necessary, kept up to date;
  • Not kept for longer than is necessary;
  • Processed in accordance with the rights of data subjects under the GDPR;
  • Kept secure by the Data Controller who takes appropriate technical and other measures to prevent unauthorised or unlawful processing or accidental loss or destruction of, or damage to, personal information; and
  • Not transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal information.
  • The second area covered by the Regulations provides individuals with important rights, including the right to find out what personal information is held on computer and most paper records. Individuals have the right to request to see their information, and to ask for their information to be amended or erased.

 

6. General volunteer and staff guidelines 

 

  1. Mosaic LGBT+ Young Persons' Trust recognises the public and voluntary/community sector expectation that personal information will be handled in accordance with the law.
  2. Mosaic LGBT+ Young Persons' Trust regards the lawful and correct treatment of personal information as important to successful operations and to maintaining the confidence of those people it deals with.
  3. Mosaic LGBT+ Young Persons' Trust fully endorses and will adhere to the eight principles of the Data Protection Act 1998 and General Data Protection Regulation (from 25 May 2018).
  4. The Board of Trustees have a zero tolerance rule to deliberate non-compliance to data protection law. Where the circumstances are necessary, the Board will not hesitate to dismiss or prosecute staff, trustees and volunteers who breach data protection regulation by negligently failing to follow Mosaic data protection procedures and/or intentionally causing data breaches. 

  5. DO ensure consent for the charity to store and process personally identifiable data has been explicitly given and documented as appropriate.

  6. DO treat personal data with care and respect. 

  7. DO check and verify identities of people soliciting personal data by either asking a question that only a bone-fide caller/requestor would know before disclosing information by phone or email. If in doubt DO NOT disclose and refer the incident to DPO.

  8. DO ensure consent has been given by the individual whose information will be disclosed to another party, unless required by law or for exceptional circumstances such as national security or criminal investigation (i.e. investigation warrant). If in doubt, refer the request to the DPO.

  9. DO check and review if an individual has a valid and legitimate need to know before disclosing to colleagues.

  10. DO use confidential waste bins to dispose of documents containing personal data and where that is not possible, you must cross-shred those documents securely.

  11. DO ensure other people cannot see personal data on your computer system (also known as ‘shoulder surfing’) or the documents you are using.

  12. DO ensure a clear desk policy when you leave Mosaic LGBT+ Young Persons' Trust premises or the venue where a meeting was held. 

  13. DO make sure you have adequate secure storage for documents in both paper and electronic formats.

  14. DO use strong and complex passwords to protect the data on your computer system. Never share your personal and Mosaic individual email login and password with anyone.

  15. DO dispose of any personally identifiable information when that data is no longer needed. There is no need to wait for an individual to tell the charity to do so.

  16. ONLY use personal data for the purpose it was collected.

  17. ONLY disclose personal data to those people who have a right and a need to know.

 

IF IN ANY DOUBT, DO NOT DISCLOSE ANY INFORMATION AND SEEK ADVICE FROM THE EXECUTIVE DIRECTOR, CHAIR OF TRUSTEES OR THE DPO.

 

7. Data Storage

 

These rules describe how and where data should be stored securely. Questions about storing data securely (electronically and on paper) should be directed to the Board of Trustees or the DPO. 

 

7.1. Where data is stored on paper,

 

  • It should be kept away in a locked drawer or filing cabinet. As best practice, storage of paper copies should be kept within a secure premise instead of a bag or vehicle.
  • Staff and volunteers should ensure paper and printouts are not left where unauthorised individuals can see them (i.e. open spaces in the venue of a youth network meeting, meeting venue, train table, printer/scanner).
  • Paper copies with personally identifiable information and sensitive records should be cross-shredded and disposed of securely when no longer required data should not be archived indefinitely and only stored for the duration of its intended use. This does not require the individual to request for their data to be disposed of.

 

7.2. Where data is stored electronically,

 

  • It must be protected from the following circumstances such as but not limited to unauthorised access, accidental deletion, hacking, and malware.
  • Data should be protected by strong passwords that are changed frequently and unrepeated. Individual login and passwords should never be shared. All accounts should have 2FA enforced. 
  • If data is stored on removable media, these should be kept locked away when not in use and must be purged of any personally identifiable information when no longer required. These should also be password protected.
  • Personal Data should ONLY be stored on Mosaic LGBT+ Young Persons' Trust’s designated drives and servers (G-Drive), or Mosaic owned hardware.
  • Electronic devices used as means to gather data must be stored securely when not in use.
  • All electronic devices containing personally identifiable data must be patched regularly and protected by the appropriate anti-malware software (AVS). 

 

8. Use of Data

 

  • While working with personal data, staff and volunteers must ensure that the screens of their devices are locked when left unattended.
  • Personally identifiable information should never be shared informally and without a justifiable, legitimate need. It should never be sent unencrypted over the Internet. 
  • Personally identifiable information must never be shared with any third party unless explicit, documented consent is given. Mosaic LGBT+ Young Persons' Trust will never sell the data of young persons, staff, and volunteers with third parties or marketing agencies. 
  • Where there is a need to share data with another party as part of the delivery of our services, a Privacy Impact Assessment (PIA) and Data Sharing Agreement (DSA) must be in place before and sharing of data takes place. Individuals whose data will be shared will be notified of this. Their consent will be sought and documented before any sharing takes place.

 

9. Data Integrity

 

The law requires Mosaic LGBT+ Young Persons' Trust to take reasonable steps in ensuring data is kept accurate and up to date. It is the responsibility of all staff and volunteers who have data to keep it as accurate and up to date as possible. Therefore, 

 

  • Data will be held in as few places as necessary. Staff and volunteers must not create any unnecessary additional/spare copies of data.
  • Staff and volunteers must take every opportunity to ensure data is updated and accurate (i.e. but not limited to: validating contact details and address with young persons and staff).
  • Mosaic LGBT+ Young Persons' Trust will make it as simple as possible for data subjects to update the data the charity holds about them. For example, via Mosaic email.
  • Data should be updated as inaccuracies are discovered. Should a young person no longer be reached on the stored contact number, it should be removed from the database. Likewise, if a young person has mentioned that they will no longer participate in Mosaic’s activities, their data should be removed appropriately.
  • It is the responsibility of the Board of Trustees, who have delegated this responsibility to the DPO or their delegated representative, to ensure the charity’s databases are checked for accuracy every six months.

 

10. Subject Access Requests

 

All individuals who have personal data held by Mosaic LGBT+ Young Persons' Trust are entitled by law to:

 

  • Ask what information the charity holds about them and why
  • Ask how to gain access to it
  • Be informed about how it is kept up to date
  • Be informed about how the charity is meeting its data protection obligations

 

If an individual requests the above information, it is called a subject access request (SAR). SARs from individuals should be submitted by email to the data controller at [chair@mosaic.co.uk]. The data controller will aim to provide the relevant information within 14 days. 

 

We will always verify the identity of anyone making a SAR before disclosing any information.

 

11. Exceptional Circumstances for disclosing data

 

In certain circumstances, the DPA and GDPR (takes effect from 25 May 2018) allows personal data to be disclosed to law enforcement agencies without the data subject’s consent. Under these exceptional circumstances, Mosaic LGBT+ Young Persons' Trust will cooperate and disclose data to the relevant authorities. However, the charity will make every effort to ensure the request is legitimate, seeking assistance from the Board of Trustees and from the charity’s legal advisers where necessary. 

 

12. Providing information

 

Mosaic LGBT+ Young Persons' Trust aims to ensure that individuals are aware that their data is being processed, and that they understand: 

 

  • How the data is being used
  • How to exercise their rights under UK data protection laws and regulations

 

Appendix 1 CCTV POLICY

 

Introduction

Mosaic LGBT+ Young Persons’ Trust (“the Charity”) uses Closed-Circuit Television (CCTV) images to protect its property, ensure safety and security, and safeguard its members, staff, volunteers, guests, and contractors. 

 

This policy outlines how CCTV images will be collected, used, and stored in compliance with the Data Protection Act 2018 and the UK General Data Protection Regulation (GDPR). For more information on your privacy rights regarding personal data collected through CCTV, please refer to the Charity’s privacy notice and data protection policy.

 

Unless there are exceptional circumstances (see “Covert Recording” below), the Charity’s CCTV system will only record images; no audio will be recorded.

 

Purpose of CCTV

A Data Protection Impact Assessment has been carried out, and based on its findings, the Charity considers the use of CCTV necessary and proportionate for the following purposes:

• To maintain the security of the premises

• To deter, detect, and prevent crime, vandalism, and anti-social behaviour

• To provide a safe and secure environment for staff, volunteers, members, visitors, and contractors

• To assist law enforcement agencies in carrying out their lawful duties, including the identification and prosecution of offenders

 

Location of Cameras

Cameras are strategically placed to cover internal and external areas on the Charity’s premises, capturing only relevant areas to meet the above-mentioned purposes. Care has been taken to avoid infringing on reasonable privacy expectations. All cameras are visible, and prominent signage is displayed to ensure individuals are aware they are in a CCTV-monitored area. These signs also provide details of the Data Controller responsible for the system.

 

Recording and Retention of Images

The CCTV system records digital images continuously. The images are intended to be clear and high-quality to serve the above-mentioned purposes. Regular maintenance checks are conducted to ensure the equipment functions effectively.

Recorded images are stored on the hard drive of a server or PC and are deleted or overwritten on a recycling basis every 30 days.

 

Access to and Disclosure of Images

Access to CCTV images is strictly limited to authorised personnel. Disclosure of images to third parties will only occur for the purposes for which they were collected and in accordance with this policy. Authorised disclosures are limited to:

The police and other law enforcement agencies where images could assist in preventing or detecting crime or in identifying an offender, victim, or witness.

The Charity’s Executive Director (or an appointed representative) is responsible for authorising any external disclosures of CCTV images.

 

Individual Access Rights

Under UK data protection laws, including the GDPR, individuals have the right to request access to personal data that the Charity holds about them, including CCTV images where they are identifiable. To request access to any CCTV images relating to you, please submit a written request to the Charity’s Executive Director.

 

Covert Recording

Covert recording is not used. In exceptional cases, covert CCTV may be considered if required for a specific investigation and authorised under relevant legal standards, ensuring minimal intrusion.

 

Implementation and Compliance

The Charity’s designated Data Protection Officer is responsible for implementing and ensuring compliance with this policy. Regular reviews will confirm that CCTV use remains lawful, necessary, and proportionate and that all processing of personal data complies with relevant data protection laws and guidelines.

 

Data Protection

The Charity processes personal data collected through CCTV in accordance with its Data Protection Policy. This ensures that all data is handled securely and aligned with the Charity’s commitment to privacy and transparency.

Let me know if you want any additional modifications or details included in this draft.