CROW Recycling Privacy Policy
Who we are
CROW Recycling, Sparkbrook Street, Hillfields, Coventry, CV1 5LB
The information we collect
We collect names of individuals and organisations, telephone numbers, e mail addresses, postal addresses and website cookie data. We collect next of kin details and names of GPs for employees and volunteers.
We collect bank account details for employees and occasionally volunteers if expenses need to be paid directly into their bank accounts.
Most of the personal information is provided directly by customers, employers, volunteers or people signing up to e mail marketing campaigns for the following reasons.
Reasons for processing personal data
We collect names, postal addresses, telephone numbers and e mails to administer the services we provide. These are collecting waste paper, running a membership art and craft shop, selling shredded paper animal bedding and packaging and buying or accepting donations of used drinks cans.
We collect names, names of schools and colleges and next of kin details for staff and volunteer administration including administration for people on work experience.
Financial details such as bank account numbers are collected to make payments to employees, suppliers and sometimes volunteers to cover expenses.
We collect e mail addresses and names to administer educational visits.
We collect e mail addresses for marketing and promotions including opt in e mail marketing campaigns.
Names, postal addresses and e mail addresses are collected for processing Scrapstore membership applications.
We collect cookie preferences for website visitors. The cookie records whether they have consented to cookies or not.
The lawful bases we use for processing information
The GDPR set out a number of lawful bases for processing information. These are the ones that apply to CROW Recycling.
Contractual also known as necessary
The processing of customer information, staff and volunteer information including people on work experience and the processing of Scrapstore membership applications
Consent
The e mail addresses used for opt in e mail marketing campaigns are processed on the basis of consent. People can withdraw that consent at any time.
A website cookie processes information from our website users who consent.
Legitimate interests
This applies to a small amount of our marketing and promotions. This is when we send unsolicited e mails to schools and colleges which may be interested in educational visits or work experience. From time to time we also e mail or post letters to organisations which may be interested in buying animal bedding from us.
Sharing information
We use a cloud based account system to store customer details and generate invoices. The storage complies with the Cloud Computing Compliance Controls Catalogue also known as C5.
We use webmail software which includes brute force log in attack protection, privacy protection and XSS attack protection. E mail data is stored in UK data centres which comply with the GDPR as it applies to data processors.
Certificates of destruction are created and stored in the Microsoft Azure cloud platform. This complies with the Privacy Shield Framework. It complies with the Cloud Computing Compliance Controls Catalogue also known as C5.
From time to time we use e mail marketing platforms to publicise our educational visits and work experience. People who consent to sign up to our e mail marketing campaigns are asked to consent to information being shared with the e mail marketing platform we are using. They can withdraw that consent at any time. We use e mail marketing platforms which provide an adequate level of protection in line with the UK Data Protection Act by compliance with the Privacy Shield Framework.
Scrapstore members have their names, organisations if they have one and e mail addresses stored in a customer relationship management system. This allows us to quickly and easily communicate contractual information such as holiday shutdowns and Saturday openings. It also allows us to send e mail newsletters to those who opt in to them.
We only use customer relationship management systems which comply with the Privacy Shield Framework providing a level of privacy and security in line with the UK Data Protection Act. Scrapstore members who don’t want their data shared in this way should let us know in writing and we will delete their information from the system.
We would also share information about customers, volunteers and staff if we were legally obliged to.
Transfer of data outside the UK
Those subscribing to the opt in e mail marketing campaigns have their data stored outside the UK in the USA. We only use e mail marketing platforms which provide an adequate level of protection in line with the UK Data Protection Act by compliance with the Privacy Shield Framework.
Scrapstore members have their names, organisations if they have one and e mail addresses stored in a customer relationship management system which stores their data in data centres outside the UK in locations worldwide. As with e mail marketing platforms we only use customer relationship systems which provide an adequate level of protection in line with UK Data Protection Act by compliance with the Privacy Shield Framework.
Cloud accounting data is stored in Ireland by organisations which comply with the Cloud Computing Compliance Controls Catalogue(C5)
Microsoft Azure cloud data is stored at data centres around the world both in line with the Privacy Shield Framework and the Cloud Computing Compliance Controls Catalogue (C5).
Retention periods for personal data
We will only keep your data as long as we need to for the purpose it was collected for. Please see our personal data retention policy for more information.
Rights for individuals in relation to the data processing
People have the right to see the personal data Crow Recycling holds about them. Contact Crow Recycling on 02476552444 or info@crowrecycling.co.uk to make a subject access request to see the data.
There is a right to ask CROW to correct information which is incorrect and complete information which is incomplete.
If we are processing data on the basis of consent there is a right to withdraw consent.
CROW has one month to respond to a request. Contact CROW Recycling at Orchard House, Sparkbrook Street, Coventry, CV1 5LB on 02476552444 e mail info@crowrecycling.co.uk
The right to make a complaint
Complaints can be made to the UK data commissioner
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, 03031231113 www.ico.org.uk
CROW Recycling Data Policy
1 Customers and Scrapstore members have contracted and consented with CROW to use our services or access our facilities.
2 Customers and Scrapstore members will have a signed copy of a service provider agreement as will CROW. Customers who pay Crow to destroy confidential data will also have a personal data processing contract to sign and return.
3 Data relating to persons accessing CROW be they customers, employees, volunteer work placements, school/college students will also be kept in offices secured at night, weekends and holiday closures.
4 To withdraw from the contract customers/members are required to contact CROW in writing.
5 Data relating to a company/organisation is used only for the provision of service to your company/organisation.
6 For details of when we share your data and how we keep it safe see our privacy policy
7 Documents/papers for confidential shredding and disposal are kept in a locked area at night/weekends and holiday closures.
8 Data will only be kept as long as is necessary for the purpose for which it was collected. For more details see our personal data retention policy below.
9 People have a right to complain to the Information Commissioner’s Office if they feel their data has been mishandled. The contact details are Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, 03031231113 www.ico.org.uk.
CROW Recycling personal data retention policy
Background
General Data Protection Regulations, which are law at the moment, say personal data should not be stored for longer than needed for the purpose for which it was collected.
Personal data is anything with people’s names, personal e mail addresses, addresses, job titles or telephone numbers.
Which personal data do we hold
Invoices sometimes have a name and personal contact e mail on them
e mails – many of these are from personal e mail addresses
volunteer records
employment records
trustee meeting documents including minutes, agendas and reports
staff meeting documents
photographs of people
Names, addresses and e mail addresses of Scrapstore members
Retention periods
Employment records – six years after someone has left. This is because it is possible to bring a case in civil courts for discrimination at work up to six years after leaving a job.
Volunteer records – six years in line with employment records
Records of unsuccessful candidates – six months because this is the time limit for bringing a discrimination claim
Staff meeting minutes Three years
Trustee meeting minutes – permanent
Other trustee meeting documents – three years
Invoices – six years after the end of the financial year they were raised in line with guidance on retention of accounting information
Scrapstore membership forms – during the membership and no more than a year after membership has lapsed and not been renewed
Customer information names and contact numbers on the Sage database three years after the last order
General e mails enquiries about the Scrapstore, cans and paper and other general e mails – one year
