Privacy notice for volunteers

Royal Voluntary Service has been appointed by NHS England to run the Volunteer Responders Scheme (formerly known as the NHS Volunteer Responder Scheme). The Volunteer Responders Scheme will recruit and deploy a network of volunteers throughout England who are willing and able to provide support to communities and the wider Health & Care systems. Volunteers may also be asked to provide assistance to health care organisations (such as GP practices and hospitals) with transport and other non-clinical support.

To run the Volunteer Responder Scheme, Royal Voluntary Service will need to collect, use and store personal data relating to members of the public who apply to become and members of the public who are accepted as, Volunteer Responders. Under UK data protection law, Royal Voluntary Service will be the controller of such personal data. This means that Royal Voluntary Service is required to explain to such members of the public how their personal data will be processed and what data protection rights they have.

Please read over this privacy notice carefully, because it contains important information about who we are and how and why we collect, store, use and share your personal data. It also explains your rights in relation to your personal data and how to contact us or supervisory authorities in the event you have a complaint. In addition, it explains the role of and our and your relationship with GoodSAM Limited in relation to the Volunteer Responders Scheme.

In this privacy notice, for convenience, we use the following defined terms:

Individuals - individuals who receive support from Volunteer Responders under the Scheme

GoodSAM App - the volunteering app owned and run by GoodSAM

GoodSAM Data - has the meaning set out in the section ‘Our and your relationship with GoodSAM’

GoodSAM Limited - GOODSAM LIMITED (a company incorporated in England and Wales with registered number 8742979) whose registered office is at 1 Curtain Road, London, EC2A 3JX

GoodSAM Website - the volunteering website owned and run by GoodSAM and found at goodsamapp.org

NHSE - NHS England

Our data protection officer -

Name: Geraint Jugessur
Address: Royal Voluntary Service, PO Box 565, Unit B, RD Park, EN11 0RF
Email address: [email protected]
Telephone: 029 2073 9184

Personal data - any information relating to an identified or identifiable living individual

SAP Concur - has the meaning set out in the section ‘Our expenses system’

Scheme - the Volunteer Responders scheme

Shared Data - has the meaning set out in the section ‘Our and your relationship with GoodSAM’

We, us, our - ROYAL VOLUNTARY SERVICE (a company incorporated in England and Wales with registered number 2520413, and a registered charity with number 1015988) whose registered office is at Hanley Centre, 29 Charles St, Stoke-on-Trent, Staffordshire ST1 3JP

You, your - a member of the public who applies to become a Volunteer Responder or a member of the public who is accepted as a Volunteer Responder, and at whom this privacy notice is directed

Personal data we will collect

When you apply to become a Volunteer Responder, we will need to collect/obtain the information listed below from you:

Your full name;
Your address, email address and telephone number;
Your date of birth;
Information to enable us to check and verify your identity (e.g. a copy of your passport or driving licence);
Details of which volunteering roles you wish to opt for;
If you apply for a role which requires a criminal check we will undertake the correct level of DBS check on your behalf. All other roles that do not require a DBS check will require an ID check to be undertaken. and
If you apply for our Steward Volunteer (COVID-19 Vaccinations) and Non-Clinical Support role, confirmation of whether you have any unspent convictions and, if you confirm that you do, details of those convictions, the date of the convictions, the sentence, penalty or fine imposed and other related information.
If you choose to divulge it, we will record details around your ethnicity and diversity, including languages you are proficient in.

If you are accepted as a Volunteer Responder, we will also receive the following personal data about you:

As a result of our and your use of the technology which underpins the Scheme (see the section below ‘Our and your relationship with GoodSAM’), we will receive data about the volunteering tasks you accept and perform;
If you submit a claim to us for expenses, we will need to obtain information from you to enable us to verify the expenses you are claiming (such as copies of receipts and details of journeys you have taken when performing your role as a Volunteer Responder). We will also need your bank details so that we can reimburse you. Further information about how our expenses system will work is set out below in the section below ‘Our expenses system’);
Personal data you provide to us if you telephone our call centre or email us with a query or issue and/or personal data provided to us by Individuals or other persons or organisations you interact with as a result of your role as a Volunteer Responder; and
If you consent to being part of promotional photographs and/or videos we will collect your image data.
If you volunteer on a role that requires it, we will ask for your Next of Kin details, which will comprise the person’s name, telephone number and relationship to you. It is not compulsory to give us this information.

We will also obtain certain personal data about you if you use our Volunteer Responders website (for example, your IP address and cookie data). For more information about this, please refer to our Volunteer Responders Website Privacy Notice.

Under UK data protection law, we can only use your personal data if we have a lawful basis for doing so. For example:

to comply with our legal and regulatory obligations;
for our legitimate interests or those of a third party; or
where you have given consent.

A legitimate interest is when we have a reasonable need to use your information, so long as this is not overridden by your own rights and interests.

The table below explains what we use your personal data for and our lawful basis for doing so under UK data protection law:

What personal data we use	Why we use it	Our lawful basis
What personal data we use Copies of the documents you provide to verify your identity	Why we use it To check your identity	Our lawful basis Our legitimate interest in ensuring you are who you say you are
What personal data we use Biometric data collected in the ID verification process	Why we use it To check your identity	Our lawful basis Your consent
What personal data we use Information you provide in order to undertake a DBS check and related criminal convictions data	Why we use it To ensure you have the necessary level of DBS clearance for certain volunteer roles To make decisions about whether you are suitable to continue as a volunteer within the Scheme	Our lawful basis Our legal obligation to ensure you are a suitable person to provide certain categories of volunteering support Our legitimate interest in ensuring the safety and wellbeing of Individuals who receive support under the Scheme
What personal data we use Confirmation of whether you have any unspent convictions, and if you do, details of those convictions, the date of the convictions the sentence, penalty or fine imposed and other related personal information	Why we use it To ensure you are suitable to undertake our Steward Volunteer (COVID-19 Vaccinations) and Non-Clinical Support role	Our lawful basis Our legitimate interest in ensuring that individuals who volunteer for our Steward Volunteer (COVID-19 Vaccinations) and Non-Clinical Support role are suitable to volunteer in a medical setting where security is paramount
What personal data we use The information you input into our online application form	Why we use it To register you as a Volunteer Responder and keep a record of your details	Our lawful basis Our legitimate interest in administering the Scheme effectively
What personal data we use Information we collect about volunteering tasks you accept and perform	Why we use it To ensure that Individuals receive the support they need and to enable us to keep track of the support provided by our volunteers	Our lawful basis Our legitimate interest in ensuring that the Scheme is run effectively
What personal data we use The information you input into our online application form and the level of DBS clearance you have	Why we use it To appropriately match volunteers to Individuals	Our lawful basis Our legitimate interest in ensuring that Individuals are protected and kept safe
What personal data we use The information you input into our online application form	Why we use it So that we can deal with any queries we receive from you	Our lawful basis Our legitimate interest in ensuring that the Scheme is run effectively
What personal data we use The information you input into our online application form and the level of DBS clearance you have	Why we use it To ensure you are performing your role in accordance with our instructions and guidance and so that we can investigate any complaints we receive	Our lawful basis Our legitimate interest in ensuring that the Scheme is run properly and safely Our legal obligation to investigate complaints
What personal data we use Your full name, telephone number email address and/or postal address	Why we use it So that we can communicate/correspond with you about the Scheme	Our lawful basis Our legitimate interest in ensuring that the Scheme is run effectively
What personal data we use Information about expenses you are claiming and payment details to enable us to reimburse you	Why we use it To enable us to process claims for expenses and reimburse you	Our lawful basis Your legitimate interest in being reimbursed for such expenses
What personal data we use Information we obtain about you if you telephone our call centre with a query or as a result of communications with Individuals or other third parties about your role and/or volunteering tasks you have performed	Why we use it To enable us to manage your role as a Volunteer Responder, deal with your queries and respond appropriately to information provided to us by Individuals or other third parties	Our lawful basis Our legitimate interest in ensuring that the Scheme is run effectively Your legitimate interest in having your queries dealt with appropriately The legitimate interests of Individuals and other third parties (e.g. such as their interests in ensuring that complaints are dealt with promptly and appropriately)
What personal data we use Data we collect automatically if you use our Volunteer Responders website	Why we use it To enable us to run the website effectively	Our lawful basis Our legitimate interests and, in relation to our use of certain cookies, your consent. You can find more information about the legal bases we rely upon when we collect personal data via our Volunteer Responders website
What personal data we use Your full name, telephone number, email address and/or postal address	Why we use it To contact you for the purposes described in the section ‘Promotional Communications’	Our lawful basis Your express consent
What personal data we use Information about your volunteering journey (for example, when you became a volunteer, how often you use the GoodSAM App and how often you accept volunteering tasks).	Why we use it So that we can compile anonymous statistics to help us and NHSE make decisions about the Scheme	Our lawful basis Our and NHSE’s legitimate interests in ensuring that the Scheme supports as many individuals in need as possible and runs efficiently
What personal data we use Information relating to diversity, including age, religion/faith, language proficiency, gender, disability, sexual orientation and trans status.	Why we use it So that we can develop targeted plans to reduce barriers and improve access to all our services and volunteer opportunities	Our lawful basis Our and NHSE’s legitimate interests in ensuring that the Scheme is open to and supports as many individuals as possible.
What personal data we use Your image	Why we use it In order to produce promotional photographs and films in relation to the Scheme	Our lawful basis Your express consent
What personal data we use Name and telephone number of your Next of Kin	Why we use it To contact your Next of Kin if we are unable to make contact with you whilst you are volunteering in certain settings	Our lawful basis Our and NHSE’s legitimate interests in ensuring your safety whilst volunteering in certain settings
What personal data we use Your last known location data	Why we use it To determine your location in a potential emergency situation whilst you are volunteering in certain settings	Our lawful basis Our and NHSE’s legitimate interests in ensuring your safety whilst volunteering in certain settings

Identity checks

We will use a third-party provider (Reed Screening) to assist us in checking the identity of members of the public applying to become Volunteer Responders.

You will be required to upload one form of photographic ID to Reed Screening for the purpose of verifying your identity.

Automated processes will be used in the verification process, which will result in either:

your identity being confirmed; or
your identity not being confirmed, either due to;
1. applicant error in the process; or
2. genuine failure of ID check.

In cases where your identity is confirmed, we will proceed with the remainder of your application.

In cases where your identity is unable to be confirmed either due to applicant error or a genuine failure of the ID check, this will be reviewed to determine the reason why, and you will be contacted with an explanation of what the next steps will be in order to try and successfully confirm your identity.

Biometric data

The ID checking process referenced above will require the processing of biometric data, specifically facial verification.

Where we process biometric data about you, in addition to having a lawful basis for processing (as set out in the above table), we are also required to satisfy one or more additional conditions under UK data protection law. We will rely upon the following condition:

Article 9(2)(a) – Explicit Consent

We are required to have an ‘appropriate policy document’ in relation to our processing of biometric data. If you would like to see a copy of our appropriate policy document, please contact us.

Criminal convictions data & DBS

We may process criminal convictions data about you because:

We are required by law to screen volunteers who apply for certain volunteer roles for relevant criminal convictions;
In relation to our Steward Volunteer and Non-Clinical Support role, when applying you will be asked to confirm whether you have any unspent convictions and, if you confirm that you do, for details of those convictions and certain related information. We will then use that information to undertake a risk assessment to help us determine whether you can be accepted as a Vaccination Steward and Non-Clinical Support volunteer. Our risk assessment will be based on internal guidance which reflects best practice relating to the rehabilitation of offenders.

It is also possible that we may obtain criminal convictions data about you after you have been accepted as a Volunteer Responder (e.g. if you respond to a new recruitment drive for Community Response Plus Volunteers). If so, we may use such criminal convictions data to assess your general suitability as a Volunteer Responder (which could result in your role as a Volunteer Responder being terminated). Where we use criminal convictions data for this purpose, we will again do so in accordance with our internal guidance which reflects best practice relating to the rehabilitation of offenders.

Certain volunteer roles will require you to undertake a DBS check, and a check at the required level will be undertaken on your behalf by Reed Screening. This will require the submission by you to Reed Screening of certain documentation and personal data required for a DBS check to be performed. This will vary depending on the level of check required, but could include the following:

Passport or driving licence;
One or more document that verifies your proof of address (e.g. utility bill or bank statement).

Whenever we need to process criminal convictions data about you, in addition to having a lawful basis for processing (as set out in the above table), we are also required to satisfy one or more additional conditions under UK data protection law. We will rely upon one of the following conditions:

The fact that it is necessary for us to process criminal convictions data for the purpose of enabling us to carry out our obligations in the field of employment and social protection law;
That we need to process criminal convictions data for the purpose of crime prevention; or
That we need to process criminal convictions data for safeguarding purposes.

We are required to have an ‘appropriate policy document’ in relation to our processing of criminal convictions data. If you would like to see a copy of our appropriate policy document, please contact us.

Diversity & language data

We may process diversity and/or language data about you because:

We would like to develop targeted plans to reduce barriers and improve access to all our services and volunteer opportunities;
We would like to “match” you with Individuals who have expressed a preference for support in a particular language.

Whenever we need to process diversity or language data about you, in addition to having a lawful basis for processing (as set out in the above table), we are also required to satisfy one or more additional conditions under UK data protection law. We will rely upon the following condition:

Article 9(2)(g) – processing is necessary for reasons of substantial public interest on the basis of EU or UK law. Schedule 1 Part 2 Paragraph 8 of the DPA 2018 – Equality of opportunity or treatment.

We are required to have an ‘appropriate policy document’ in relation to our processing of diversity and language data. If you would like to see a copy of our appropriate policy document, please contact us.

Next of Kin and location data

Certain roles will require you to volunteer in different settings. As part of our legitimate interests in ensuring your safety whilst volunteering, a defined lone volunteering process is in place where you are required to “check-in” and “check-out” of certain volunteering tasks. If you have not responded to a series of prompts to check-in or check-out, then we will attempt to contact first yourself, then your Next of Kin in order to determine and assess the situation. If these attempts are unsuccessful, we will attempt to ascertain your last known location by reviewing the relevant data held in the GoodSAM system. We may, if the situation calls for it, pass your last known location details to the emergency services.

Promotional communications

We will only use your personal data (i.e. your name, telephone number, email address and/or postal address) to communicate with you specifically about other volunteering opportunities with Royal Voluntary Service if you have given us your express consent to do so (for example, if you agreed to this at the time you applied to become a Volunteer Responder or if, at the end of the Scheme, you give us permission to provide you with information about our other volunteering roles).

As a general rule, we will not share your personal data with other organisations for promotional or marketing purposes or contact you with promotional information about other organisations. However, when applying to become a Volunteer Responder, some individuals will have been asked:

If they consent to Royal Voluntary Service contacting them about other volunteering opportunities;
If they consent to Royal Voluntary Service contacting them about other opportunities with NHS organisations; and
If they consent to GoodSAM contacting them about becoming a GoodSAM cardiac volunteer responder.

If you have consented to Royal Voluntary Service contacting you about other opportunities with NHS organisations, from time to time Royal Voluntary Service will use your name, telephone number, email address and/or postal address to provide you with information about other NHS opportunities which are brought to our attention by NHSE as a result of our partnership with NHSE in relation to the Scheme. If you consent to GoodSAM contacting you about becoming a GoodSAM cardiac volunteer responder, we will share your name and email address with GoodSAM and GoodSAM will subsequently get in touch with you directly.

Please note that if you decide to volunteer for NHSE or GoodSAM, you will be doing so independently of your relationship with Royal Voluntary Service and any use of your personal data by NHSE or GoodSAM will not be controlled or overseen by Royal Voluntary Service and will be subject to the privacy notices used by those organisations.

You have the right to withdraw your consent to us contacting you about Royal Voluntary Service or NHSE volunteering opportunities at any time. To do so, please contact us in any of the ways set out in the section ‘How to contact us’ below. However, if you consent to us sharing your name and email address with GoodSAM but you subsequently change your mind about becoming a GoodSAM cardiac responder, you will need to contact GoodSAM directly to withdraw your consent.

Photography & filming

Photography & filming If you have given us your consent to use your image contained in photographs or films, we will retain these images indefinitely or until you withdraw your consent. If you would like to withdraw your consent for us to use your image, please email [email protected]

Our and your relationship with GoodSAM

The effective operation of the Scheme relies upon technology made available to NHSE, Royal Voluntary Service and you by GoodSAM.

In particular:

To apply to become a Volunteer Responder, you will need to fill out the online application form on the GoodSAM Website;
If you are accepted as a Volunteer Responder, you will need to download, install and use the GoodSAM App so that we can notify you of volunteering tasks in your area and you can accept and perform volunteering tasks; and
We will use a software platform made available to us by GoodSAM (which will interface with the GoodSAM App) to help us run the Scheme.

This means that we will need to share your personal data with GoodSAM. It also means that you will provide some personal data to GoodSAM directly. Consequently, GoodSAM’s role under UK data protection law will vary depending on what personal data it is processing and why. In this section, we provide more information about our and your relationship with GoodSAM.

GoodSAM as our data processor

In relation to the following personal data, GoodSAM will act as our data processor and process your personal data on our behalf:

GoodSAM’s use of the personal data you provide to us when you apply to become a Volunteer Responder;
Other personal data about you which is input into the GoodSAM software platform as a result of your dealings with us as a Volunteer Responder; and
Personal data relating to the acceptance and performance by you of volunteering tasks which we obtain as result of the interface of the GoodSAM software platform with the GoodSAM App.

Where GoodSAM processes your personal data as our data processor, GoodSAM will be subject to contractual obligations to us only to process your personal data in accordance with our instructions, not to use your personal data for other purposes and to keep your personal data safe and secure.

GoodSAM as joint controller

If you are accepted as a Volunteer Responder, to enable GoodSAM to create an account for you on the GoodSAM App, Royal Voluntary Service will need to make available to GoodSAM your full name and email address (‘Shared Data’).

GoodSAM and Royal Voluntary Service will then become joint controllers of the Shared Data. This means that both Royal Voluntary Service and GoodSAM will have certain rights to use the Shared Data but must also comply with the obligations and restrictions set out in UK data protection law.

For the duration of the Scheme, GoodSAM will be subject to contractual obligations to us only to use the Shared Data for the purposes of providing and running the technology which underpins the Scheme. However, once the Scheme has come to an end, GoodSAM’s use of the Shared Data will be in accordance with its privacy notices and policies (subject to its obligation to use the Shared Data in accordance with UK data protection law). GoodSAM should be able to provide you with a copy of such notices and policies.

While the Scheme is ongoing, you may submit a request to exercise any of the rights referred to in the section ‘Your rights’ below in relation to the Shared Data to either GoodSAM or Royal Voluntary Service.

GoodSAM as sole controller

In relation to your use of the GoodSAM Website and the downloading, installation and use by you of the GoodSAM App, you will have a direct relationship with GoodSAM. This means that, in relation to GoodSAM’s collection and use of the following personal data, GoodSAM will be acting as sole controller:

Personal data automatically collected from you by GoodSAM as a result of your use of the GoodSAM Website (for example, your IP address and cookie data);
Personal data collected from you by GoodSAM when you download, install and use the GoodSAM App (other than personal data that relates to your volunteering role in relation to the Scheme). For example, data relating to your mobile phone or other device, location data and any profile you create on the GoodSAM App.

GoodSAM will use such personal data (referred to from here on as ‘GoodSAM Data’) in accordance with its own privacy policies and notices (subject to compliance by GoodSAM with the requirements of UK data protection law). Such policies and notices should be available on GoodSAM’s website and when you download and install the GoodSAM App. Any requests to exercise any of the rights referred to in section ‘Your rights’ below will need to be made to GoodsAM and any claims you have for misuse of the GoodSAM Data will need to be made against GoodSAM.

Our expenses system

As a Volunteer Responder, you will be able to submit claims to us for the reimbursement of certain expenses (we will email you with details of what expenses you can claim and how to do this). To assist us with the administration and processing of expenses claims and payments, we will use an expenses system provided by Concur Holdings (Netherlands) B.V. (‘SAP Concur’).

The expenses system will work in the following way:

Once you have completed your first volunteering task, we will share your name, email address and your unique volunteer identification number with SAP Concur. This will enable SAP Concur to create a user account for you on its expenses system;
Before you can submit any claims for expenses, you will need to have downloaded and installed the SAP Concur App onto your mobile phone or other device. Once you have done so, to access your account on the SAP Concur App, you will need to verify your email address and unique volunteer identification number;
To submit an expenses claim you will need to access your account on the SAP Concur App and input details about the expenses you are claiming. The details will vary depending on what expenses you are claiming (for example, to make a mileage claim you will need to enter the start and end point of your journey and to claim for hand sanitiser you will need to upload a photograph of your sales receipt). In most cases, you will also need to provide the job identification number to which the claim relates. In addition, you will be asked to input details of the bank account into which you require any payment to you to be made.
If your expenses claim is accepted, we will pay the amount of expenses you are entitled to directly into your bank account.

We have entered into an agreement with SAP Concur relating to the provision of its expenses system. Under that agreement, SAP Concur will process any personal data relating to you which comes into its possession as a result of: (i) us sharing information with SAP Concur so that an account can be created for you; and (ii) you making an expenses claim (‘Expenses Data’) as the processor of Royal Voluntary Service. This essentially means that SAP Concur will be required to process Expenses Data strictly in accordance with our instructions and for no other purposes.

Under our agreement, SAP Concur has authorisation to share Expenses Data with sub-contractors that it uses to provide its expenses system, but any such sharing by SAP Concur must be on and subject to equivalent terms to those set out in our agreement with SAP Concur and will therefore restrict the processing of Expenses Data by such sub-contractors.

SAP Concur will retain Expenses Data for a period of 6 months following the end of our agreement with SAP Concur. After the expiry of this period, SAP Concur will erase your personal data.

As stated above, however, before you can make any claims for expenses, you will need to download and install the SAP Concur App. If you do so, you will be entering into a direct relationship with SAP Concur in relation to your use of the SAP Concur App. Also, SAP Concur will become a controller of certain of your personal data (such as data it obtains relating to the device on which you install and use the SAP Concur App and your location data). SAP Concur’s terms of use and privacy information relating to its App should be available to you at the time you download and install the SAP Concur App.

Sharing of your personal data with other third parties

As well as GoodSAM and SAP Concur, we will also need to share your personal data with certain other trusted organisations who are providing essential services to us in relation to the Scheme. This includes:

Ventrica Limited, the organisation which operates our Volunteer Responder call centre and undertakes certain other work on our behalf;
Reed Screening, an organisation which helps us check the identity of members of the public who apply to become Volunteer Responders;
Our mailing partners The Woods Group Limited and Honeycomb Print Services Ltd;
The organisations which host our websites and software systems;
Our insurers and our banks; and
Our professional advisers (such as lawyers and accountants).

We only allow our service providers to handle your personal information if we are satisfied they take appropriate measures to protect your personal information. We also impose contractual obligations on service providers relating to ensure they can only use your personal information to provide services to us and to you.

We may also disclose and exchange information with law enforcement agencies and regulatory bodies to comply with our legal and regulatory obligations.

If you are accepted for our Vaccination Steward and Non-Clinical Support role and agree to attend a vaccination site, we will share your name with NHSE and/or other organisations that are running vaccination sites on its behalf. This will be to assist with the safe running of a vaccination site including for example any identity checks on arrival at a vaccination site. Similarly, if you are accepted for our Ambulance Staff Welfare role, we will share your name with the relevant Ambulance Trust.

As stated above (see ‘How and why we use your personal data’), we will use information we obtain about your journey as a Volunteer Responder to create anonymous statistics about the Scheme. For example, statistics about how many people have volunteered as Volunteer Responders or how often our Volunteer Responders use the GoodSAM App. We will include such statistics in reports we share with NHSE and other government bodies (who may, in turn, share those reports more widely). No personal data about you will be included in any such reports.

Volunteer Segmentation project

We will share certain bits of data with Eden Stanley for the purpose of undertaking a volunteer segmentation project. This data will be limited to transactional and basic demographic data, along with a unique identifying reference for each individual volunteer. The unique identifier will be used to match up transactional and basic demographic data with data received from those volunteers who choose to participate in a related quantitative survey. At no point will Eden Stanley be able to identify natural living persons from this data.

If you choose to participate in the related quantitative survey (and give us your consent to process your data), your data will be collected and held securely by Eden Stanley and will be used to segment the volunteer population into various categories, for the purposes of better understanding the motivations and drivers of the NHSCVR volunteer population.

Eden Stanley will become joint controllers of the data used in the volunteer segmentation project. A joint controller agreement has been entered into between RVS and Eden Stanley, which specifies data security requirements and states that data will only be used for the purposes of undertaking the segmentation project, and will be deleted once processing of the data is no longer necessary for the purposes of the project.

How long your personal information will be kept

Unsuccessful applications

In the event that we are unable to accept your application to become a Volunteer Responder, we will delete your application form from our system as soon as reasonably practicable. This will include any copy documentation you have provided to us to verify your identity and any copies of DBS certificates. We will, however, retain your name and email address for the duration of the Scheme (this is necessary for our general record keeping and audit purposes and so that we can compile statistics relating to the total number of applications received).

Please note, should you navigate past the first page of the application form without completing and submitting it, we will retain your name and email address for a period of 1 month, to give us the option of contacting you to enquire as to whether you require support in completing the form.

If you apply for our Vaccination Steward and Non-Clinical Support role, although we will delete your application form if your application is unsuccessful, we will need to retain any information you provide to us relating to unspent convictions and a copy of any risk assessment we carry out. We will do so for the duration of the Scheme plus an additional period of 6 months.

Successful applications

If you are accepted as a Volunteer Responder, our general retention policy will be to retain your personal data for the duration of your time registered as a volunteer with the Scheme plus an additional period of 6 months. Retention for a further period of 6 months after your time as a registered volunteer with the Scheme has ceased is necessary for our general business purposes (including audit and processing expenses claims) and to enable us to deal with any ad hoc queries and/or complaints which arise.

Please note that it is currently envisaged that the Scheme will run until November 2025, with options to further extend until November 2026 and November 2027.

Our general retention policy referred to above is subject to the following exceptions:

If you submit an expenses claim to us (see section above ‘Our expenses system’) we will retain Expenses Data for a period of 7 years from the end of the financial year in which the claim is submitted. This is necessary to enable us to comply with statutory requirements relating to accounting and taxation.
We may need to retain your personal data for a longer period to deal with any complaints, grievances, investigations or legal claims or actions involving or relating to you. In this situation, we will retain such personal data as is necessary to deal fully with the relevant complaint, grievance, investigation or legal claim or action;
If a safeguarding concern arises, we will retain such personal data relating to you as may be necessary to deal with the issue and/or meet our obligations in relation to safeguarding (including any regulatory or legal obligations); and
We will retain information relating to the Scheme for the purposes of archiving in the public interest and historical research. Such information may include your personal data. Any such retention and subsequent processing of your personal data will be in accordance with the National Archives Guide to Archiving Personal Data 2018.

In addition, if, at the end of the Scheme, you agree to take up a broader volunteering role for us, we will retain such of your personal data as is necessary to register you as a general Royal Voluntary Service Volunteer. Subsequently, our use and retention of your personal data will be in accordance with our general privacy notice and retention policy (you can find links to these documents on our main Royal Voluntary Service website).

Deletion of personal data

Once it is no longer necessary for us to retain your personal data, we will ensure that it is permanently and securely deleted or anonymised.

Our retention Schedule

Further details about our retention policy can be found in our retention schedule relating to the Scheme. Please contact us if you would like to be provided with a copy of this.

Where your personal information is held

Your personal data will be held in the UK on the GoodSAM software platform. It will not be transferred by us or GoodSAM outside the UK and/or EEA.

However, in relation to the GoodSAM Data, it is possible that GoodSAM may store or transfer your personal data outside the UK and/or EEA. Where GoodSAM does so, GoodSAM should make available to you information about how it safeguards your personal information.

If we need to store any criminal convictions data about you or copies of any risk assessments, this information will be stored in secure location within our own IT system.

Your rights

Under data protection law, you have a number of different rights which you can exercise free of charge. These are described in the table below. Some of the rights only apply in certain circumstances and not all of the rights will be relevant in relation to our use of your personal data:

Access - The right to be provided with a copy of your personal data (the right of access)

Rectification - The right to require any mistakes in your personal data to be corrected

To be forgotten - The right, in certain circumstances, to require that your personal data is deleted

Restriction of processing - The right, in certain circumstances, to require use of your personal data to be restricted (for example, if you contest the accuracy of the data)

Data portability - The right, in certain circumstances, to receive your personal data in a structured, commonly used and machine-readable format and/or transmit that data to a third party

To object - The right to object to your personal data being processed for direct marketing (including profiling) and the right, in certain circumstances, to object to the continued processing of your personal data on the basis of legitimate interests

Not to be subject to automated individual decision making - The right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you.

For further information on each of these rights, including the circumstances in which they apply, please contact us or see the Guidance from the UK Information Commissioner’s Office (ICO) on individuals’ rights under the General Data Protection Regulation.

If you would like to exercise any of your rights, please email, call or write to our Data Protection Officer (see below: ‘How to contact us’). Please note that we will ask you to:

Let us have enough information to identify you;
Provide us with proof of your identity and address (e.g. a copy of your driving licence or passport); and
Let us know what right you want to exercise and the information to which your request relates.

Keeping your personal information secure

If you are accepted as a Volunteer Responder, the personal data you provide to us in your application form will be stored in a secure database made available to us by GoodSAM for the purpose of the Scheme. Your personal data will be kept separate from other personal data stored by GoodSAM.

In addition, we have appropriate security measures to prevent personal data from being accidentally lost or used or accessed unlawfully. We limit access to your personal information to those who have a genuine business need to access it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

Registering an interest

If, at the time you attempt to apply to become a Volunteer Responder, and we are not recruiting in your area, you will be given the option to register your interest in volunteering for the role. We will then automatically email you when we are next recruiting for Volunteer Responders in your area.

If you decide to register your interest with us, please note the following information:

You will be required to provide us with your name, email address, date of birth and your Local Authority;
We will retain this information for the duration of the Scheme;
We will only use this information to contact you for the purpose of notifying you that we are recruiting in your area;
We will rely on our legitimate interests as our legal basis for retaining and using the information;
The information will be securely held by one of our trusted service providers.

Transferring your data to NHS

We will contact you towards the end of the Scheme to ask whether you consent to your data being transferred to the NHS at the end of the Scheme. We will only transfer your data should you provide us with your explicit consent to do so.

How to complain

We hope that our Data Protection Officer can resolve any query or concern you may raise about our use of your personal data.

The General Data Protection Regulation also gives you right to lodge a complaint with a supervisory authority, in particular in the European Union (or European Economic Area) state where you work, normally live or where any alleged infringement of data protection laws occurred. The supervisory authority in the UK is the Information Commissioner who may be contacted at ico.org.uk/make-a-complaint or telephone: 0303 123 1113.

Changes to this privacy policy

This privacy notice was first published on 20 February 2023.

This version of the privacy notice was published on 14 October 2024.

We will make updated versions of our privacy notice available on our Volunteer Responders website.

How to contact us

Please contact us/our Data Protection Officer by post, email or telephone if you have any questions about this privacy policy or the personal data we hold about you.

Our data protection officer: Geraint Jugessur

Our postal address: Royal Voluntary Service, PO Box 565, Unit B, RD Park EN11 0RF.

Our email address: [email protected]

Our telephone number: 029 2073 9184