PRIVACY POLICY

  1. INTRODUCTION 

This policy sets out information about the processing of customer data, and how customers‘ privacy in relation to their data is protected. This policy does not confer any contractual rights. 

A simplified Privacy Notice is set out at Appendix 1. 

Recyke y’Bike Ltd. is a registered charity, constituted as a company limited by guarantee. We are registered in the UK as Charity No. 1124639, and Company No. 5839547. Our website address is: http://www.recvke.bike 

  1. OUR OBLIGATIONS IN RELATION TO PROCESSING PERSONAL DATA 

Recyke y’Bike must comply with the following obligations when processing your personal data: 

That your data is used lawfully, fairly, and in a transparent way 

That your data is collected only for valid purposes, which have been clearly explained to you 

That the data collected is relevant to the purposes Recyke y’Bike has told you about, and limited only to those purposes 

That your data is accurate and up–to–date 

That your data is kept in a format which allows for you to be identified for only as long as necessary 

That your data is kept securely 

  1. WHAT DATA WE HOLD 

The data we hold about you is set out in the table at Appendix 2. 

  1. WHY WE HOLD YOUR YOUR PERSONAL DATA 

Recyke y’Bike is a ‘data controller‘ and needs to collect and hold data about customers in order to undertake the work you have asked us to do (e.g. we need to know your contact details so that we can tell you when your bike is ready to collect). 

Recyke y‘ Bike is allowed to hold and process data about you because: 

You have consented to our doing so and/or 

We have a legitimate interest in doing so. 

That consent and/or legitimate interest is (or are) the main lawful basis (or bases) for processing your information. 

Recyke y’Bike is registered with the Information Commissioner’s Office (ref. ZA478423). 

  1. HOW WE COLLECT YOUR DATA 

Recyke y’Bike collects your personal data by the following means: 

5.1 Citrus Lime: When you book your bike in for repairs or a service, or (if you consent) when you make a purchase from us. 

5.2: Eventbrite: When you sign up for an event. 

5.3: Mailchimp: When you subscribe to the email newsletter, or when you give your consent at an event (e.g. women’s bike nights). 

5.4 Google Forms: We use Google Forms to collect data for volunteer applications. This is retained long term in paper format, which is securely held at our office (how long we keep 

this is set out in our Volunteer Data Protection policy). The original Google Form submission is deleted once it has been printed off. 

5.6 Embedded content from other websites: Articles on this site may include embedded content (e.g. videos, images, articles, etc.). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website. These websites may collect data about you, use cookies, embed additional third–party tracking, and monitor your interaction with that embedded content, including tracing your interaction with the embedded content if you have an account and are logged in to that website. 

5.7 Analytics: We use WordPress.com and Jetpack to measure visitor and site usage. 

Data Used: WordPress.com records the following details: IP address, WordPress.com user ID (if logged in), WordPress.com username (if logged in), user agent, visiting URL, referring URL, timestamp of event, browser language, country code. We are unable to see this detail but can only see the data in aggregate form. IP addresses are shared with Defiant (who own WordPress). 

Activity Tracked: Jetpack records post and page views, video plays (if videos are hosted by WordPress.com), outbound link clicks, referring URLS and search engine terms, and country. 

5.8 Photos and videos 

We may take still and/or moving images of you. Before we do so we will ask for your consent. A consent form is set out at Appendix 3. 

  1. HOW WE USE YOUR DATA 

Recyke y’Bike will generally use your personal data for one of the following lawful reasons: 

To respond to your query 

To process an application to volunteer with or work for us 

To perform the contract we have entered into with you 

To remind you when your next bike service falls due 

To keep you informed of special offers 

To keep you updated with information about our work 

To monitor and evaluate the effectiveness and spread of our services 

With your consent, we will use your information for the following purposes: 

To publicise the work of Recyke y’Bike 

To apply for grant funding 

To understand the diversity of our customers 

There are other rare occasions when your personal data or special category data will be used: 

Where we need to protect your interests, or someone else’s interests Where it is needed in the public interest, or has already been made public 

Where Recyke y’Bike has to process this data for legal claims, or to comply with legal obligations 

If Recyke y’Bike considers that it is necessary to use your personal data for a different and unrelated purpose, you will be notified of this in writing with an explanation of the legal basis for doing so. There may be exceptional circumstances where Recyke y’Bike has to process your data without your knowledge or consent where this is required by law. 

  1. HOW WE KEEP YOUR DATA 

7.1 Accuracy: Recyke y’Bike will take reasonable steps to ensure personal data is accurate and up to date. 

7.2 Retention: to ensure that personal data is kept for no longer than necessary, Recyke y’Bike has in place a Records Retention Policy for each area in which personal data is processed and reviews this policy annually. The Records Retention Policy considers what data should/must be retained, for how long, and why. 

7.3 Security: Recyke y’Bike will ensure that personal data is stored securely using modern software that is kept–up–to–date. Access to personal data shall be limited to personnel who need access and appropriate security should be in place to avoid unauthorised sharing of information. Paper copies will be kept in a locked cupboard. 

7.3 Deletion: when personal data is deleted this will be done safely such that the data is irrecoverable. 

  1. YOUR RIGHTS AND OBLIGATIONS 

Recyke y’Bike will only ask you to provide data which is necessary for the performance of your contractual relationship, or any associated legal obligations. If you do not provide this data, Recyke y’Bike may not be able to meet its contractual or legal obligations to you. It is important that you inform us of any changes to your data so that we can make sure the information we hold is accurate. 

You have the following rights in relation to your personal data: 

The right to request a copy of your personal data that Recyke y’Bike holds about you The right to request that Recyke y’Bike corrects any personal data if it is inaccurate or out of date 

The right to withdraw your consent to the processing at any time 

The right to request that Recyke y’Bike provide you with your personal data and, 

where possible, transmit that data directly to another data controller 

The right, where there is a dispute about the accuracy or processing of your personal data, to request a restriction on further processing 

The right to lodge a complaint with the Information Commissioner’s Office Rights in relation to automated decision–making and profiling. 

  1. SPECIAL CATEGORY DATA 

Any personal data which identifies ethnic origin, political opinions, religious and philosophical beliefs, trade union membership, genetic, biometric or health data, sex life and sexual orientation is passed as special category data. Recyke y’Bike doesn’t collect special category data from customers. 

  1. SUBJECT ACCESS REQUESTS 

You are entitled to make a subject access request (SAR) for copies of any personal data Recyke y’Bike holds about you. 

Any request should be made in writing to the General Manager. You may (but do not have to use) the SAR request form at Appendix 4 

If you make an SAR, Recyke y’Bike may ask you to confirm your identity so we can ensure that personal data is released to the correct person. 

Recyke y’Bike will reply to an SAR within 30 calendar days, and may extend this for particularly complex requests. Recyke y’Bike may withhold personal data if disclosing it would adversely affect the rights and freedoms of others. 

Recyke y’Bike will only charge you a fee for an SAR if your request is manifestly unfounded or excessive, or if further copies of the same data are requested. 

  1. DATA BREACHES 

Where any personal data is lost, destroyed, corrupted or disclosed, this will amount to a data breach. 

If you become aware of a data breach, you must inform the General Manager immediately. 

If a data breach occurs, Recyke y’Bike will: 

Investigate the cause of the breach 

Take action to contain the breach 

Assess the likelihood and severity of risk to any of a data subject’s rights 

Where personal data has been sent to someone who is not authorised to have access to it, Recyke y’Bike will: 

Inform the recipient not to distribute it in any way or discuss it with anyone else Inform the recipient to destroy or delete the data, and require them to confirm in writing that they have done so 

Where relevant, inform the data subject(s) so they can take any necessary action 

If there is a risk to any individual’s rights, Recyke y’Bike will notify the ICO within 72 hours of becoming aware of the breach. If a risk is low, there is no requirement on Recyke y’Bike to report the data breach to the ICO.