We will use a third-party provider (Reed Screening) to assist us in checking the identity of members of the public applying to become Volunteer Responders.
You will be required to upload one form of photographic ID to Reed Screening for the purpose of verifying your identity.
Automated processes will be used in the verification process, which will result in either:
- your identity being confirmed; or
- your identity not being confirmed, either due to;
- applicant error in the process; or
- genuine failure of ID check.
In cases where your identity is confirmed, we will proceed with the remainder of your application.
In cases where your identity is unable to be confirmed either due to applicant error or a genuine failure of the ID check, this will be reviewed to determine the reason why, and you will be contacted with an explanation of what the next steps will be in order to try and successfully confirm your identity.
The ID checking process referenced above will require the processing of biometric data, specifically facial verification.
Where we process biometric data about you, in addition to having a lawful basis for processing (as set out in the above table), we are also required to satisfy one or more additional conditions under UK data protection law. We will rely upon the following condition:
- Article 9(2)(a) – Explicit Consent
We are required to have an ‘appropriate policy document’ in relation to our processing of biometric data. If you would like to see a copy of our appropriate policy document, please contact us.
Criminal convictions data & DBS
We may process criminal convictions data about you because:
- We are required by law to screen volunteers who apply for certain volunteer roles for relevant criminal convictions;
- In relation to our Steward Volunteer (COVID-19 Vaccinations) and Non-Clinical Support role, when applying you will be asked to confirm whether you have any unspent convictions and, if you confirm that you do, for details of those convictions and certain related information. We will then use that information to undertake a risk assessment to help us determine whether you can be accepted as a Vaccination Steward and Non-Clinical Support volunteer. Our risk assessment will be based on internal guidance which reflects best practice relating to the rehabilitation of offenders.
It is also possible that we may obtain criminal convictions data about you after you have been accepted as a Volunteer Responder (e.g. if you respond to a new recruitment drive for Community Response Plus Volunteers). If so, we may use such criminal convictions data to assess your general suitability as a Volunteer Responder (which could result in your role as a Volunteer Responder being terminated). Where we use criminal convictions data for this purpose, we will again do so in accordance with our internal guidance which reflects best practice relating to the rehabilitation of offenders.
Certain volunteer roles will require you to undertake a DBS check, and a check at the required level will be undertaken on your behalf by Reed Screening. This will require the submission by you to Reed Screening of certain documentation and personal data required for a DBS check to be performed. This will vary depending on the level of check required, but could include the following:
- Passport or driving licence;
- One or more document that verifies your proof of address (e.g. utility bill or bank statement).
Whenever we need to process criminal convictions data about you, in addition to having a lawful basis for processing (as set out in the above table), we are also required to satisfy one or more additional conditions under UK data protection law. We will rely upon one of the following conditions:
- The fact that it is necessary for us to process criminal convictions data for the purpose of enabling us to carry out our obligations in the field of employment and social protection law;
- That we need to process criminal convictions data for the purpose of crime prevention; or
- That we need to process criminal convictions data for safeguarding purposes.
We are required to have an ‘appropriate policy document’ in relation to our processing of criminal convictions data. If you would like to see a copy of our appropriate policy document, please contact us.
Diversity & language data
We may process diversity and/or language data about you because:
- We would like to develop targeted plans to reduce barriers and improve access to all our services and volunteer opportunities;
- We would like to “match” you with Individuals who have expressed a preference for support in a particular language.
Whenever we need to process diversity or language data about you, in addition to having a lawful basis for processing (as set out in the above table), we are also required to satisfy one or more additional conditions under UK data protection law. We will rely upon the following condition:
- Article 9(2)(g) – processing is necessary for reasons of substantial public interest on the basis of EU or UK law. Schedule 1 Part 2 Paragraph 8 of the DPA 2018 – Equality of opportunity or treatment.
We are required to have an ‘appropriate policy document’ in relation to our processing of diversity and language data. If you would like to see a copy of our appropriate policy document, please contact us.
Next of Kin and Location Data
Certain roles will require you to volunteer in different settings. As part of our legitimate interests in ensuring your safety whilst volunteering, a defined lone volunteering process is in place where you are required to “check-in” and “check-out” of certain volunteering tasks. If you have not responded to a series of prompts to check-in or check-out, then we will attempt to contact first yourself, then your Next of Kin in order to determine and assess the situation. If these attempts are unsuccessful, we will attempt to ascertain your last known location by reviewing the relevant data held in the GoodSAM system. We may, if the situation calls for it, pass your last known location details to the emergency services.
We will only use your personal data (i.e. your name, telephone number, email address and/or postal address) to communicate with you specifically about other volunteering opportunities with Royal Voluntary Service if you have given us your express consent to do so (for example, if you agreed to this at the time you applied to become a Volunteer Responder or if, at the end of the Scheme, you give us permission to provide you with information about our other volunteering roles).
As a general rule, we will not share your personal data with other organisations for promotional or marketing purposes or contact you with promotional information about other organisations. However, when applying to become a Volunteer Responder, some individuals will have been asked:
- If they consent to Royal Voluntary Service contacting them about other volunteering opportunities;
- If they consent to Royal Voluntary Service contacting them about other opportunities with NHS organisations; and
- If they consent to GoodSAM contacting them about becoming a GoodSAM cardiac volunteer responder.
If you have consented to Royal Voluntary Service contacting you about other opportunities with NHS organisations, from time to time Royal Voluntary Service will use your name, telephone number, email address and/or postal address to provide you with information about other NHS opportunities which are brought to our attention by NHSE as a result of our partnership with NHSE in relation to the Scheme. If you consent to GoodSAM contacting you about becoming a GoodSAM cardiac volunteer responder, we will share your name and email address with GoodSAM and GoodSAM will subsequently get in touch with you directly.
Please note that if you decide to volunteer for NHSE or GoodSAM, you will be doing so independently of your relationship with Royal Voluntary Service and any use of your personal data by NHSE or GoodSAM will not be controlled or overseen by Royal Voluntary Service and will be subject to the privacy notices used by those organisations.
You have the right to withdraw your consent to us contacting you about Royal Voluntary Service or NHSE volunteering opportunities at any time. To do so, please contact us in any of the ways set out in the section ‘How to contact us’ below. However, if you consent to us sharing your name and email address with GoodSAM but you subsequently change your mind about becoming a GoodSAM cardiac responder, you will need to contact GoodSAM directly to withdraw your consent.
Photography & filming
If you have given us your consent to use your image contained in photographs or films, we will retain these images indefinitely or until you withdraw your consent. If you would like to withdraw your consent for us to use your image, please email [email protected]
Our and your relationship with GoodSAM
The effective operation of the Scheme relies upon technology made available to NHSE, Royal Voluntary Service and you by GoodSAM.
- To apply to become a Volunteer Responder, you will need to fill out the online application form on the GoodSAM Website;
- If you are accepted as a Volunteer Responder, you will need to download, install and use the GoodSAM App so that we can notify you of volunteering tasks in your area and you can accept and perform volunteering tasks; and
- We will use a software platform made available to us by GoodSAM (which will interface with the GoodSAM App) to help us run the Scheme.
This means that we will need to share your personal data with GoodSAM. It also means that you will provide some personal data to GoodSAM directly. Consequently, GoodSAM’s role under UK data protection law will vary depending on what personal data it is processing and why. In this section, we provide more information about our and your relationship with GoodSAM.
GoodSAM as our data processor
In relation to the following personal data, GoodSAM will act as our data processor and process your personal data on our behalf:
- GoodSAM’s use of the personal data you provide to us when you apply to become a Volunteer Responder;
- Other personal data about you which is input into the GoodSAM software platform as a result of your dealings with us as a Volunteer Responder; and
- Personal data relating to the acceptance and performance by you of volunteering tasks which we obtain as result of the interface of the GoodSAM software platform with the GoodSAM App.
Where GoodSAM processes your personal data as our data processor, GoodSAM will be subject to contractual obligations to us only to process your personal data in accordance with our instructions, not to use your personal data for other purposes and to keep your personal data safe and secure.
GoodSAM as joint controller
If you are accepted as a Volunteer Responder, to enable GoodSAM to create an account for you on the GoodSAM App, Royal Voluntary Service will need to make available to GoodSAM your full name and email address (‘Shared Data’).
GoodSAM and Royal Voluntary Service will then become joint controllers of the Shared Data. This means that both Royal Voluntary Service and GoodSAM will have certain rights to use the Shared Data but must also comply with the obligations and restrictions set out in UK data protection law.
For the duration of the Scheme, GoodSAM will be subject to contractual obligations to us only to use the Shared Data for the purposes of providing and running the technology which underpins the Scheme. However, once the Scheme has come to an end, GoodSAM’s use of the Shared Data will be in accordance with its privacy notices and policies (subject to its obligation to use the Shared Data in accordance with UK data protection law). GoodSAM should be able to provide you with a copy of such notices and policies.
While the Scheme is ongoing, you may submit a request to exercise any of the rights referred to in the section ‘Your rights’ below in relation to the Shared Data to either GoodSAM or Royal Voluntary Service.
GoodSAM as sole controller
In relation to your use of the GoodSAM Website and the downloading, installation and use by you of the GoodSAM App, you will have a direct relationship with GoodSAM. This means that, in relation to GoodSAM’s collection and use of the following personal data, GoodSAM will be acting as sole controller:
- Personal data automatically collected from you by GoodSAM as a result of your use of the GoodSAM Website (for example, your IP address and cookie data);
- Personal data collected from you by GoodSAM when you download, install and use the GoodSAM App (other than personal data that relates to your volunteering role in relation to the Scheme). For example, data relating to your mobile phone or other device, location data and any profile you create on the GoodSAM App.
GoodSAM will use such personal data (referred to from here on as ‘GoodSAM Data’) in accordance with its own privacy policies and notices (subject to compliance by GoodSAM with the requirements of UK data protection law). Such policies and notices should be available on GoodSAM’s website and when you download and install the GoodSAM App. Any requests to exercise any of the rights referred to in section ‘Your rights’ below will need to be made to GoodsAM and any claims you have for misuse of the GoodSAM Data will need to be made against GoodSAM.
Our expenses system
As a Volunteer Responder, you will be able to submit claims to us for the reimbursement of certain expenses (we will email you with details of what expenses you can claim and how to do this). To assist us with the administration and processing of expenses claims and payments, we will use an expenses system provided by Concur Holdings (Netherlands) B.V. (‘SAP Concur’).
The expenses system will work in the following way:
- Once you have completed your first volunteering task, we will share your name, email address and your unique volunteer identification number with SAP Concur. This will enable SAP Concur to create a user account for you on its expenses system;
- Before you can submit any claims for expenses, you will need to have downloaded and installed the SAP Concur App onto your mobile phone or other device. Once you have done so, to access your account on the SAP Concur App, you will need to verify your email address and unique volunteer identification number;
- To submit an expenses claim you will need to access your account on the SAP Concur App and input details about the expenses you are claiming. The details will vary depending on what expenses you are claiming (for example, to make a mileage claim you will need to enter the start and end point of your journey and to claim for hand sanitiser you will need to upload a photograph of your sales receipt). In most cases, you will also need to provide the job identification number to which the claim relates. In addition, you will be asked to input details of the bank account into which you require any payment to you to be made.
- If your expenses claim is accepted, we will pay the amount of expenses you are entitled to directly into your bank account.
We have entered into an agreement with SAP Concur relating to the provision of its expenses system. Under that agreement, SAP Concur will process any personal data relating to you which comes into its possession as a result of: (i) us sharing information with SAP Concur so that an account can be created for you; and (ii) you making an expenses claim (‘Expenses Data’) as the processor of Royal Voluntary Service. This essentially means that SAP Concur will be required to process Expenses Data strictly in accordance with our instructions and for no other purposes.
Under our agreement, SAP Concur has authorisation to share Expenses Data with sub-contractors that it uses to provide its expenses system, but any such sharing by SAP Concur must be on and subject to equivalent terms to those set out in our agreement with SAP Concur and will therefore restrict the processing of Expenses Data by such sub-contractors.
SAP Concur will retain Expenses Data for a period of 6 months following the end of our agreement with SAP Concur. After the expiry of this period, SAP Concur will erase your personal data.
Sharing of your personal data with other third parties
As well as GoodSAM and SAP Concur, we will also need to share your personal data with certain other trusted organisations who are providing essential services to us in relation to the Scheme. This includes:
- Ventrica Limited, the organisation which operates our Volunteer Responder call centre and undertakes certain other work on our behalf;
- Reed Screening, an organisation which helps us check the identity of members of the public who apply to become Volunteer Responders;
- Our mailing partners The Woods Group Limited and Honeycomb Print Services Ltd;
- The organisations which host our websites and software systems;
- Our insurers and our banks; and
- Our professional advisers (such as lawyers and accountants).
We only allow our service providers to handle your personal information if we are satisfied they take appropriate measures to protect your personal information. We also impose contractual obligations on service providers relating to ensure they can only use your personal information to provide services to us and to you.
We may also disclose and exchange information with law enforcement agencies and regulatory bodies to comply with our legal and regulatory obligations.
If you are accepted for our Vaccination Steward and Non-Clinical Support role and agree to attend a vaccination site, we will share your name with NHSE and/or other organisations that are running vaccination sites on its behalf. This will be to assist with the safe running of a vaccination site including for example any identity checks on arrival at a vaccination site. Similarly, if you are accepted for our Ambulance Staff Welfare role, we will share your name with the relevant Ambulance Trust.
As stated above (see ‘How and why we use your personal data’), we will use information we obtain about your journey as a Volunteer Responder to create anonymous statistics about the Scheme. For example, statistics about how many people have volunteered as Volunteer Responders or how often our Volunteer Responders use the GoodSAM App. We will include such statistics in reports we share with NHSE and other government bodies (who may, in turn, share those reports more widely). No personal data about you will be included in any such reports.
Volunteer Segmentation project
We will share certain bits of data with Eden Stanley for the purpose of undertaking a volunteer segmentation project. This data will be limited to transactional and basic demographic data, along with a unique identifying reference for each individual volunteer. The unique identifier will be used to match up transactional and basic demographic data with data received from those volunteers who choose to participate in a related quantitative survey. At no point will Eden Stanley be able to identify natural living persons from this data.
If you choose to participate in the related quantitative survey (and give us your consent to process your data), your data will be collected and held securely by Eden Stanley and will be used to segment the volunteer population into various categories, for the purposes of better understanding the motivations and drivers of the NHSCVR volunteer population.
Eden Stanley will become joint controllers of the data used in the volunteer segmentation project. A joint controller agreement has been entered into between RVS and Eden Stanley, which specifies data security requirements and states that data will only be used for the purposes of undertaking the segmentation project, and will be deleted once processing of the data is no longer necessary for the purposes of the project.
How long your personal information will be kept
In the event that we are unable to accept your application to become a Volunteer Responder, we will delete your application form from our system as soon as reasonably practicable. This will include any copy documentation you have provided to us to verify your identity and any copies of DBS certificates. We will, however, retain your name and email address for the duration of the Scheme (this is necessary for our general record keeping and audit purposes and so that we can compile statistics relating to the total number of applications received).
Please note, should you navigate past the first page of the application form without completing and submitting it, we will retain your name and email address for a period of 1 month, to give us the option of contacting you to enquire as to whether you require support in completing the form.
If you apply for our Vaccination Steward and Non-Clinical Support role, although we will delete your application form if your application is unsuccessful, we will need to retain any information you provide to us relating to unspent convictions and a copy of any risk assessment we carry out. We will do so for the duration of the Scheme plus an additional period of 6 months.
If you are accepted as a Volunteer Responder, our general retention policy will be to retain your personal data for the duration of your time registered as a volunteer with the Scheme plus an additional period of 6 months. Retention for a further period of 6 months after your time as a registered volunteer with the Scheme has ceased is necessary for our general business purposes (including audit and processing expenses claims) and to enable us to deal with any ad hoc queries and/or complaints which arise.
Please note that it is currently envisaged that the Scheme will run until November 2025, with options to further extend until November 2026 and November 2027.
Our general retention policy referred to above is subject to the following exceptions:
- If you submit an expenses claim to us (see section above ‘Our expenses system’) we will retain Expenses Data for a period of 7 years from the end of the financial year in which the claim is submitted. This is necessary to enable us to comply with statutory requirements relating to accounting and taxation.
- We may need to retain your personal data for a longer period to deal with any complaints, grievances, investigations or legal claims or actions involving or relating to you. In this situation, we will retain such personal data as is necessary to deal fully with the relevant complaint, grievance, investigation or legal claim or action;
- If a safeguarding concern arises, we will retain such personal data relating to you as may be necessary to deal with the issue and/or meet our obligations in relation to safeguarding (including any regulatory or legal obligations); and
- We will retain information relating to the Scheme for the purposes of archiving in the public interest and historical research. Such information may include your personal data. Any such retention and subsequent processing of your personal data will be in accordance with the National Archives Guide to Archiving Personal Data 2018.
In addition, if, at the end of the Scheme, you agree to take up a broader volunteering role for us, we will retain such of your personal data as is necessary to register you as a general Royal Voluntary Service Volunteer. Subsequently, our use and retention of your personal data will be in accordance with our general privacy notice and retention policy (you can find links to these documents on our main Royal Voluntary Service website).
Deletion of personal data
Once it is no longer necessary for us to retain your personal data, we will ensure that it is permanently and securely deleted or anonymised.
Our retention Schedule
Further details about our retention policy can be found in our retention schedule relating to the Scheme. Please contact us if you would like to be provided with a copy of this.
Where your personal information is held
Your personal data will be held in the UK on the GoodSAM software platform. It will not be transferred by us or GoodSAM outside the UK and/or EEA.
However, in relation to the GoodSAM Data, it is possible that GoodSAM may store or transfer your personal data outside the UK and/or EEA. Where GoodSAM does so, GoodSAM should make available to you information about how it safeguards your personal information.
If we need to store any criminal convictions data about you or copies of any risk assessments, this information will be stored in secure location within our own IT system.
Under data protection law, you have a number of different rights which you can exercise free of charge. These are described in the table below. Some of the rights only apply in certain circumstances and not all of the rights will be relevant in relation to our use of your personal data: