External Privacy Notice

Voluntary Action North Lanarkshire (VANL) – External Privacy Notice

(For all VANL activities excluding website visitors – see our separate Website Privacy Notice)

Effective from: August 2025
Next review date: August 2026
Policy lead: Head of Corporate Services

1. Who we are

Voluntary Action North Lanarkshire (VANL) is the Third Sector Interface (TSI) for North Lanarkshire. We support local charities, community groups, and volunteers, and work with partners to strengthen our communities.

We are a data controller for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Our contact details for Data Protection Purposes:

Ryan Young
Head of Corporate Services
Voluntary Action North Lanarkshire
7 Scott Street, Motherwell, ML1 1PN
ryan.young@vanl.co.uk

2. What personal data we collect and why

We collect and process different categories of personal data depending on your relationship with VANL.

Relationship / ActivityExamples of personal dataPurpose of processingLawful basis*
VolunteersName, contact details, date of birth, emergency contacts, relevant health infoTo manage volunteering opportunities, provide support, and ensure safetyConsent / Contract / Legitimate Interests
TrusteesName, contact details, background checksTo manage governance and meet legal obligationsLegal Obligation
StaffName, contact details, employment history, payroll detailsTo recruit, manage, and pay staffContract / Legal Obligation
Service users / clientsName, contact details, service records, relevant health or support needs; IP addresses; usernamesTo deliver projects, services, and supportConsent / Contract / Legitimate Interests
Event attendeesName, contact details, accessibility or dietary requirementsTo run events and provide follow-up informationConsent / Legitimate Interests
Funding applicantsName, contact details, application forms, financial infoTo assess and administer funding programmesContract / Legal Obligation
Mailing list subscribersName, email address, organisationTo send news, updates, and opportunitiesConsent
Partnership contactsName, contact details, roleTo coordinate joint activities and communicationsLegitimate Interests

Where we process special category data (e.g., health information, ethnicity, disability), we will do so only where an additional lawful basis under Article 9 UK GDPR applies, and appropriate safeguards are in place.

*Lawful bases are as defined in Section 6 of VANL’s Data Protection Policy, including: consent, contractual necessity, legal obligation, vital interests, legitimate interests, public task, and recognised legitimate interest (Data (Use and Access) Act 2025).

3. How we collect your data

We may collect your personal data:

  • Directly from you (e.g., through forms, phone calls, meetings, events)
  • From your organisation (if you act on its behalf)
  • From publicly available sources (e.g., OSCR, Companies House)
  • From partner organisations (where lawful and necessary)

4. Who we share your data with

We will only share your personal data where there is a lawful basis, and it is necessary and proportionate to do so. Examples include:

  • Partner organisations involved in delivering a service or project
  • Funders, for reporting purposes
  • Regulatory bodies (e.g., OSCR, HMRC)
  • Service providers acting as data processors for VANL (e.g., IT support, mailing list software)

All processors handling personal data on behalf of VANL must have a Data Processing Agreement in place.

We do not transfer personal data outside the UK.

5. How long we keep your data

We keep personal data only for as long as necessary to fulfil the purpose it was collected for, in line with our Data Retention and Disposal Procedure and Section 11 of our Data Protection Policy.

Examples:

  • HR records (employees): 6 years after employment ends
  • Volunteer records: 3 years after service ends
  • Financial records: 6 years from end of financial year
  • Service user/client records: 6 years after last contact (unless safeguarding or legal requirements dictate otherwise)
  • Safeguarding records: up to 75 years (per statutory guidance)

Data no longer required will be securely disposed of by shredding, pulping, or secure digital erasure.

6. Your data protection rights

Under the UK GDPR, you have the right to:

  • Be informed about how we use your data
  • Access your personal data
  • Have inaccurate data corrected
  • Have your data erased (in certain circumstances)
  • Restrict processing of your data
  • Object to processing
  • Request data portability
  • Not be subject to automated decision-making and profiling

Requests will be handled in accordance with our Data Subject Rights Procedure and within statutory timescales. We may need to verify your identity before fulfilling your request.

7. How we keep your data safe

We use appropriate technical and organisational measures to protect your personal data, including:

  • Role-based access controls
  • Strong password policies
  • Encryption of portable devices and sensitive files
  • Regular backups
  • Secure storage and disposal of paper records
  • Physical building security measures
  • Specific controls for remote working, including secure VPN access and encrypted devices
  • Staff and volunteer training on data protection

Full details of our information security measures are set out in our Information Security Policy, Acceptable Use Policy, and Clear Desk and Clear Screen Policy.

8. How to complain

If you have concerns about how we handle your personal data, please contact us first so we can try to resolve the issue:

Ryan Young
Head of Corporate Services
Voluntary Action North Lanarkshire
7 Scott Street, Motherwell, ML1 1PN
01236 748011
ryan.young@vanl.co.uk

If you are still unhappy, you can contact the Information Commissioner’s Office (ICO):
Website: www.ico.org.uk
Helpline: 0303 123 1113

9. Changes to this notice

We review this notice annually or sooner if our processing activities change. The latest version will always be available on our website.

VANL Staff and Volunteer Privacy Notice

VANL Staff and Volunteer Privacy Notice

Effective from: August 2025
Next review date: August 2026
Policy lead: Head of Corporate Services

1. Who we are

Voluntary Action North Lanarkshire (VANL) is the Third Sector Interface (TSI) for North Lanarkshire.
We are a data controller for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Contact details:

Head of Corporate Services
Voluntary Action North Lanarkshire
7 Scott Street, Motherwell, ML1 1PN
07780 442147
ryan.young@vanl.co.uk

2. The purpose of this notice

This notice explains how VANL collects, uses, stores, and shares personal data relating to:

  • Current and former employees (permanent, temporary, fixed-term)
  • Volunteers
  • Trustees in a voluntary capacity

It should be read alongside VANL’s Data Protection Policy and related procedures.

3. What personal data we collect

The personal data we collect and process may include:

Staff:

  • Name, address, contact details, date of birth
  • Emergency contact details
  • Employment history, qualifications, skills, and training records
  • Payroll information (bank details, tax and NI information, pension details)
  • Sickness absence records, medical or health information
  • Performance reviews, disciplinary and grievance records
  • Photographs (for ID or promotional purposes)

Volunteers:

  • Name, address, contact details, date of birth
  • Emergency contact details
  • Relevant skills, qualifications, and experience
  • References and recruitment records
  • Relevant health or support needs (where necessary for your role)
  • Photographs (for ID or promotional purposes)

4. How we collect your data

We collect personal data:

  • Directly from you (e.g., through application forms, onboarding documents, meetings)
  • From referees, previous employers, or volunteer coordinators
  • From publicly available sources (where relevant)
  • From third parties where lawful (e.g., Disclosure Scotland for PVG checks)

5. Why we process your data and our lawful bases

We process your personal data to:

  • Recruit and onboard staff and volunteers
  • Manage our working or volunteering relationship with you
  • Pay employees and reimburse expenses
  • Provide training, supervision, and support
  • Comply with legal and regulatory obligations
  • Protect health, safety, and welfare
  • Promote VANL’s work (where you have agreed to this)

Our lawful bases for processing include:

  • Contractual necessity (for employees)
  • Legal obligation (e.g., tax, safeguarding requirements)
  • Legitimate interests (e.g., internal communications, recognising contributions)
  • Consent (e.g., for use of photographs in publicity)
  • Recognised legitimate interest under the Data (Use and Access) Act 2025 (where applicable)
  • Vital interests (in emergencies)

Where we process special category data (e.g., health information, ethnicity, PVG results), we will do so only where an additional lawful basis under Article 9 UK GDPR applies, and with appropriate safeguards in place.

6. Who we share your data with

We may share your personal data with:

  • HMRC, pension providers, and payroll processors (for staff)
  • Training providers (for agreed courses)
  • Funders (where necessary for grant compliance)
  • Regulators (e.g., OSCR, Disclosure Scotland)
  • IT service providers and other contractors acting as our data processors

We do not transfer personal data outside the UK.

7. How long we keep your data

We keep personal data only as long as necessary, in line with our Data Retention and Disposal Procedure

After this time, data is securely disposed of (shredding, pulping, or secure digital erasure).

8. Your data protection rights

You have the right to:

  • Be informed about how we use your data
  • Access your personal data
  • Have incorrect data corrected
  • Have your data erased (in certain circumstances)
  • Restrict processing of your data
  • Object to processing
  • Request data portability
  • Not be subject to automated decision-making and profiling

Requests will be handled in line with our Data Subject Rights Procedure and within statutory timescales. We may need to verify your identity before responding.

9. How we keep your data safe

We use a range of technical and organisational measures, including:

  • Role-based access controls
  • Strong password policies
  • Encryption of portable devices and sensitive files
  • Regular system backups and disaster recovery measures
  • Secure storage and disposal of paper records
  • Physical building security
  • Specific controls for remote working (secure VPN access, encrypted devices)

Full details are in VANL’s Information Security Policy, Acceptable Use Policy, and Clear Desk and Clear Screen Policy.

10. How to raise a concern

If you have concerns about how your personal data is handled, contact:

Head of Corporate Services
Voluntary Action North Lanarkshire
7 Scott Street, Motherwell, ML1 1PN
07780 442147
ryan.young@vanl.co.uk

If you are still unhappy, you can contact the Information Commissioner’s Office (ICO):
Website: www.ico.org.uk
Helpline: 0303 123 1113

11. Review

We review this notice annually or sooner if our processing changes. The most up-to-date version will be available from the Head of Corporate Services and stored in VANL internal SharePoint system.

VANL Website Privacy Notice

Who we are
This website is operated by Voluntary Action North Lanarkshire (VANL).
Website: https://www.voluntaryactionnorthlanarkshire.org

We are committed to protecting your privacy and handling your personal data responsibly, in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

What personal data we collect and why
Contact Forms
When you use the contact form on our website, we collect the following information:
· First name
· Last name
· Email address
· Message subject
· Message content

We collect this information so we can respond to your enquiry and provide relevant support or information. Your submission will be sent to our info@VANL.co.uk mailbox and may be stored there as part of our correspondence records.

We do not use the information you submit for marketing purposes unless you explicitly request or consent to this.

Please do not include sensitive personal information (e.g. health details, financial data, or anything confidential) unless it is necessary for your enquiry.
We retain messages for as long as necessary to respond to your request and in accordance with our data retention policies. If you would like us to delete your message or personal details at any time, you can contact us at the above address.

Cookies
Our website uses cookies to:
· Improve user experience
· Collect anonymous usage data via Google Analytics

You can control or disable cookies via your browser settings. Blocking some types of cookies may affect your experience of the site.

Google Analytics
We use Google Analytics to understand how visitors interact with our website. This helps us improve our content and functionality. Google Analytics collects anonymous data such as:
· Pages visited
· Time spent on the site
· Browser and device information
· General geographic location (not precise)

Google may store this data on servers located outside the UK.

You can read their privacy policy here: https://policies.google.com/privacy

You can opt out of Google Analytics tracking using the following tool:
https://tools.google.com/dlpage/gaoptout

Embedded content from other websites
Articles on our site may include embedded content (e.g. videos, images, or articles). Embedded content behaves in the same way as if you visited the original website directly.
These third-party websites may collect data about you, use cookies, and track your interactions, especially if you’re logged into those sites.

Who we share your data with
· We share anonymous data with Google Analytics for reason listed above

We do not sell or share your personal data with third parties for marketing purposes.

How long we retain your data
· Google Analytics data is retained for a maximum period of 14 months in line with Google Analytics user level data retention policies
· We retain contact form submissions for up to 18 months, unless they relate to an ongoing matter or are required for legal or safeguarding purposes.

Your rights under UK GDPR
You have the right to:
· Access the personal data we hold about you
· Request correction or deletion of your data
· Object to certain types of data processing
· Request data portability (in some circumstances)
· Withdraw consent at any time, if processing is based on consent

To exercise these rights, please contact us using the details below.

How to contact us
If you have any questions or concerns about this privacy notice or how your data is handled, please contact:
Ryan Young
ryan.young@vanl.co.uk
01236 748011