This page is to explain what personal data Freegle keeps, why it keeps it and what it does with it, in terms of processing, protecting and deleting it. Hopefully, this is a straight forward explanation for Freegle volunteers and members. 
There are links at the bottom to other pages relevant to Data Protection such as our Policy.

== Where does Freegle keep data? ==

There are three areas that we need to consider when we talk about where the Freegle organisation keeps personal data:

{| class="wikitable"
! scope="col" style="width: 100px;" | Area
! scope="col" style="width: 600px;" | Description
! scope="col" style="width: 300px;" | Personal Data types held
|-
| 1. The Freegle System || The majority of data that Freegle has is kept in the system we call Freegle Direct see [http://ilovefreegle.org]. This is where all groups are held (apart from those in Norfolk [http://www.norfolkfreegle.org/] and the few groups still only on Yahoo groups) and the Freegle posts are shown. As Freegle Direct works with Yahoo groups where they can co-exist then Yahoo does keep other data that Freegle itself doesn't keep. Also Freegle Direct allows users to login using their Google, Yahoo or Facebook credentials that are authenticated by those services, so the data kept and the compliance of those companies with the legislation is up to them.|| Membership Details (email and Postcode) Address Book (Postcode & user supplied directions text)
|-
| 2. National volunteers || The national volunteers, who run things for Freegle that aren't directly for a local groups, keep data about their areas such as finance, media and IT development etc. We surveyed these volunteers and essentially they keep limited personal data such as email addresses and in some cases postal addresses. These tend to be kept in local or group email accounts and in Google docs with restricted access. || Email contacts (email address) Board Member & Shareholders postal details
|-
| 3. Local groups volunteers || Local volunteers tend to only have personal data of local members such as their email addresses for when they are dealing with queries. || Membership details (email addresses)
|}

== What Personal Data does Freegle keep on its system? ==

Freegle keeps little personal data, and nothing that would be called sensitive in legal terms, so nothing like health or financial data.

Personal Data on Freegle Direct :
{| class="wikitable"
! Function
! Personal data recorded
|- valign="top"
| Membership Detail || - email address - User name - Post code
|-
| Address Book || - Post Code (user could enter a different one to that stored with the membership detail) - Directions - Often this will contain the user's address and other detail to help others navigate to their address)
|}

Although this information may not directly identify an individual, it may do if their real name was in their email address and if combined with their post code.

== How does Freegle Process this data? ==

{| class="wikitable"
! Function
! Processing by Freegle direct (In summary)
|- valign="top"
| Membership Functions || Maintaining settings and groups aligned with a member; Aligning logins from other systems (Google, Yahoo, Facebook) with the user's Freegle membership
|-
| Emailing Members|| Sending emails in line with member specified preferences containing: groups posts, automatic prompts, local moderator admin messages and national campaigns
|-
| Collated member information || Creates a summary set of information about members so other members can see their previous activity
|}

== How does Freegle ensure it complies with Data Protection Law? ==

Freegle relies on trust to continue to work. Therefore, it takes its responsibilities seriously around data protection, not just to comply legally but also not to use data in a way that members wouldn't expect it to be. So we don't share data with other organisations (other than to run groups with Yahoo & TrashNothing) and never sell it. Freegle fully complies with current UK law in this area, even though we are not required by the Information Commissioner's Office to register our organisation.

We are currently reviewing what we do to ensure that we are compliant with the new EU laws called the General Data Protection Regulation, commonly known as GDPR [http://http://www.eugdpr.org/] for short, which takes effect from 25th April 2018. The UK government have stated that they will be transferring GDPR into UK law, so it will be relevant post any Brexit decisions.

== Key Elements of GDPR and what Freegle will be doing ==

{| class="wikitable"
! GDPR Area
! What this means
! What Freegle are doing
|- valign="top"
| Legal Basis for Processing || GDPR legislation requires that organisations have a legal basis for processing data. There are six basis that can be used a. Consent, b. Contract, c. Legal obligation, d. Vital Interest, e. Public task, f. Legitimate Interest || Freegle will use Legitimate Interest as the legal basis for Processing
|-
| Legitimate Interest || We believe this legal basis balances the rights of our members with the benefits that Freegle brings to society and the environment. || Freegle has chosen legitimate interest as a legal basis as we we only keep a very limited personal data, we use this only in ways directly related to providing a way to facilitate re-use transactions between members. Members have ways to see all data we keep and have the ability to remove themselves and their data from the system without hinderance.
|-
| Right to Access & Data Portability || You can obtain confirmation from an organisation if they are processing your personal data. You also have the right to get a copy of any personal data held in a standard electronic format, so you can transfer it to other organisations. || Freegle Direct will be adding in a function under the settings tab to enable you to download all of your personal data and settings.
|-
| Right to be forgotten || This means that you have the right to have your personal data erased on request, or if it is no longer relevant to the processing that consent was given for. || Freegle will enable you to have erased the personal data in the Address Book function. However if you want to erase your membership data then it will mean that your membership login will be deleted. In addition policy and guidance will ensure that we keep the minimum data needed only for the time it's appropriate.
|-
| Privacy by Design || This means that the systems your data is held on need to be designed to keep the minimum data necessary for the completion of its duties (data minimisation), as well as limiting the access to personal data to those needing to act out the processing. || Freegle already has access protection in for its Freegle Direct system and keeps the least personal data possible to deliver the Freegle services.
|-
| Breach Notification || Under the GDPR, breach notification will become mandatory where a data breach is likely to “result in a risk for the rights and freedoms of individuals”. This must be done within 72 hours of first having become aware of the breach. Organisations will also be required to notify their customers “without undue delay” after first becoming aware of a data breach. || If Freegle became aware of any breach, or hack as it's more commonly known, we will let our members know via email and the UK Data Protection Authority. Luckily we don't keep anything sensitive, and therefore its unlikely to risk anyone's rights or freedoms.
|-
| Penalties || If an organisation violates the GDPR regulations it can be fined up to 4% of its annual global turnover || We at Freegle understand this is aimed at big corporations so they take it seriously. We too take it seriously as without the trust of our members Freegle wouldn't be able to function.
|-
| Data Protection Officer || The GDPR law DPO appointment will be mandatory only for those controllers and processors whose core activities consist of processing operations which require regular and systematic monitoring of data subjects on a large scale or of special categories of data or data relating to criminal convictions and offences. ||Although the law doesn't require organisations like Freegle to appoint a Data Protection Officer we will be having a volunteer position to look at this areas for us. They can be contacted by email at DPO@ilovefreegle.org
|}

== Freegle's Legitimate Interest Assessment ==

The Information Commissioner's Office suggest that if you use a Legitimate Interest basis of processing, you should conduct a Legitimate Interest Assessment [LIA]. An LIA is a type of light-touch risk assessment based on the specific context and circumstances. It will help ensure that our processing is lawful. Having an LIA will also help Freegle demonstrate compliance in line with it's accountability obligations under Articles 5(2) and 24. Therefore here below is our LIA.

'''Identify the legitimate interest(s)'''

Why do you want to process the data – what are you trying to achieve?
Who benefits from the processing? In what way?
Are there any wider public benefits to the processing?
How important are those benefits?
What would the impact be if you couldn’t go ahead?
Would your use of the data be unethical or unlawful in any way?

'''Is the Processing Necessary'''

Does this processing actually help to further that interest?
Is it a reasonable way to go about it?
Is there another less intrusive way to achieve the same result?

'''Is the processing balanced against individual rights ?'''

What is the nature of your relationship with the individual?
Is any of the data particularly sensitive or private?
Would people expect you to use their data in this way?
Are you happy to explain it to them?
Are some people likely to object or find it intrusive?
What is the possible impact on the individual?
How big an impact might it have on them?
Are you processing children’s data?
Are any of the individuals vulnerable in any other way?
Can you adopt any safeguards to minimise the impact?
Can you offer an opt-out?

== What about groups that are on Yahoo Groups ==

There are two types of groups that use the Yahoo Groups system. 

'''1. Freegle groups that use Yahoo Groups system only''' - These groups come under the policies of Yahoo in terms of compliance with Data Protection Laws, however we expect the Freegle volunteers who run these groups to comply with any policies and guidance for Data Protection published by the Freegle board. So for instance Yahoo would need to supply a way of users having access to their records (Right to access), however we would expect the group volunteers to deal with issues such as ensuring members were notified about a breach if Yahoo were first to tell group owners.

'''2. Freegle Yahoo groups that are linked to the Freegle System''' - These groups will utilise the functions of both Yahoo and Freegle systems to comply with the regulations. This may cause some members a little confusion if they are registered with both systems. So volunteers will be asked to ensure that policy and guidance is followed in instances such as deleting data (The right to be forgotten) that members are reminded to delete from both systems. Where practical the Freegle system will take deletions made in Yahoo as a signal to remove the user data from the Freegle system, however this does not work the other way around.

== What about groups on the Norfolk Freegle system? ==

The Norfolk system is a separate system from the main Freegle system. Therefore, it will have its own mechanisms to satisfy the Data Protection laws whilst coming under the general Freegle Data Protection policies. For more information on the Norfolk system you can click here [https://norfolkfreegle.org/Home/Terms]

== What about users of TrashNothing? ==

Trashnothing is a system that fronts Freegle and other systems such as Freecycle. If you have a TrashNothing account then the TrashNothing system keeps your membership details (email address & Postcode) and any Freegle group in connects you with also has this data. Trashnothing has its own Data Protection mechanisms, for more information see here [https://trashnothing.com/privacy].

== Useful Links ==
*[[Data Protection Policy]] - Policies for dealing with Personal Data
*[[Data Protection Guidelines]] - Guidelines for Volunteers
*[[Data Protection Compliance - Volunteer Task list]] - Ongoing and completed tasks
*[[Spam]] - further explanation to counter accusations that we spam!
*[[Basic Information]]
*[[Admin]]

[[category: Admin]] [[category: Freegle Direct]] [[category: Data Protection]]

Data Protection Policy

2018-04-02T12:33:43Z

Jc4freegle: /* Personal Data Protection Policy */

== Personal Data Protection Policy ==

'''Policy aims :'''

* To maintain the trust of our membership by keeping data safe and only using it as members would expect
* To comply with all UK laws on Data Protection
* To be open about all of the data we have associated to members, allowing them to ensure it is accurate.

'''Definition of Personal Data''' - Any data that separately or in combination with other elements may identify a living individual.

'''Scope of Personal Data held''' - Freegle will aim to minimise the amount of data it keeps to only that necessary to deliver the services to members.

'''Use of Data''' - Freegle will only use members personal data to help aid the purpose of furthering to stated [[Freegle Aims|aims]] of Freegle in the communities it serves. These are the reuse of materials and sharing local charity events and volunteer opportunities.

'''Allowing Members Access to Data''' - Freegle will allow its members to see all the personal data (and other associated data if possible) we have on the Freegle system directly from the system. In addition members may request other data Freegle may have about, such as correspondence with volunteers, via a Subject Access Request made to DPO@ilovefreegle.org

'''Age Restrictions''' - We will not maintain children's personal data, as we would then require some way to ensure that guardians consented to this. The definition of children in this respect is taken as 13 years old.

'''Data Retention''' - Freegle will maintain data for the period of membership, and up to 6 months after membership has ceased as part of our anti-SPAM measures. However, during these 6 months these details will not be visible. Should members wish to have their data removed immediately this can be arranged via the Data Protection Officer DPO@ilovefreegle.org 
Freegle Volunteers who correspond with others in relation to Freegle and its activities are advised to do so via the Freegle Direct system if possible. Freegle policy on correspondence outside of the FD system is also subject to a 6 month retention period unless the volunteer obtains consent from the correspondent that they may keep the information for an agreed longer period.

'''Storing Data Securely''' - Freegle will use industry standard techniques (e.g. access restriction, encryption, taking backups etc) to ensure that data we hold will be kept safe from unauthorised access or loss on its system. We also advise all volunteers who store personal information to keep it secure with access limited to known individuals, .

'''Data Protection Officer''' - due to the nature of Freegle we are not legally obliged to have a Data Protection Officer [DPO]. However, we have a volunteer who undertakes this role who can be reached via email at DPO@ilovefreegle.org

== Useful Links ==
*[[Data Protection Policy]] - Policies for dealing with Personal Data
*[[Data Protection Guidelines]] - Guidelines for Volunteers
*[[Data Protection Compliance - Volunteer Task list]] - Ongoing and completed tasks
*[[Spam]] - further explanation to counter accusations that we spam!
*[[Basic Information]]
*[[Admin]]

[[category: Data Protection]]

Data Use & Protection

2018-04-02T12:21:43Z

Jc4freegle:

2017-09-15T18:19:15Z

Jc4freegle:

This page is to explain what personal data Freegle keeps, why it keeps it and what it does with it, it terms of processing, protecting and deleting it. Hopefully this is a straight forward explanation for freegle volunteers and members.
There is also a link to our Data Protection Policy which is more detailed and it so we can show our compliance to relevant data protection legislation.

== Where does Freegle keep data? ==

There are three areas that we need to consider when we talk about where the Freegle organisation keeps personal data:

{| class="wikitable"
! Area
! Description
! Personal Data types held
|-
| 1. The Freegle System || The majority of data freegle has is kept in the system we call Freegle Direct see [http://ilovefreegle.org]. This is where all groups are held (apart from those in Norfolk [http://www.norfolkfreegle.org/] and the few groups still only on Yahoo groups) and the freegle posts are shown. As Freegle Direct works with Yahoo groups where they can co-exist then Yahoo does keep other data that Freegle itself doesn't keep. Also Freegle Direct allows users to login using their Google, Yahoo or Facebook credentials that are authenticated by those services, so the data kept and the compliance of those companies with the legislation is up to them.|| Membership Details (email and Postcode) Address Book (Postcode & user supplied directions text)
|-
| 2. National volunteers || The national volunteers who run things for Freegle that aren't directly for a local groups, they keep data about their areas such as finance, media and IT development etc. We surveyed these volunteers and essentially they keep limited personal data such as email addresses and in some cases postal addresses. These tend to be kept in local or group email accounts and in Google docs with restricted access. || Email contacts (email address) Board Member & Shareholders postal details
|-
| 3. Local groups volunteers || Local volunteers tend to only have personal data of local members such as their email addresses for when they are dealing with queries and other may keep information about how the group is running. We are currently (Sept 2017) looking into what local groups typically keep so we can advise them and come up with the appropriate guidance and policy.

== What Personal Data does Freegle keep on its system? ==

Freegle keeps little personal data, and nothing that would be called sensitive.

Personal Data on Freegle Direct :
{| class="wikitable"
! Function
! Personal data recorded
|- valign="top"
| Membership Detail || - email address - User name - Post code
|-
| Address Book || - Post Code (user could enter a different one to that stored with the membership detail) - Directions - Often this will contain the user's address and other detail to help others navigate to their address)
|}

Although this information may not directly identify an individual, it may do if their real name was in their email address.

== How does Freegle ensure it complies with Data Protection Law? ==

Freegle relies on trust to continue to work. Therefore it takes its responsibilities seriously around data protection. We fully comply with current UK law in this area, even though we are not required by the Information Commissioner's Office to register.

We are currently reviewing what we do to ensure that we are compliant with the new EU laws called the General Data Protection Regulation, commonly known as GDPR [http://http://www.eugdpr.org/] for short that takes effect from 25th April 2018. The UK government have stated that they will be transferring GDPR into UK law, so it will be relevant post any Brexit decisions.

== Key Elements of GDPR and what Freegle are doing ==

{| class="wikitable"
! GDPR Area
! What this means
! What Freegle are doing
|- valign="top"
| Consent || GDPR has strengthen the consent needed, so organisations can't assume that you consent to them keeping your data, they must get positive confirmation from you to retain it, and they need to tell you what they will use if for in plain language. Plus they need to give you the ability to withdraw consent. || Freegle is ensuring that all the personal data you are asked for is the minimum required to run the, has clear information about how it will be used, buttons that clearly allow consent or not (usually "OK xxxxx" or "cancel") and a way to later withdraw consent (this may be leaving freegle).
|-
| Right to Access & Data Portability || You can obtain confirmation from an organisation if they are processing your personal data. You also have the right to get a copy of any personal data held in a standard electronic format, so you can transfer it to other organisations. || Freegle will be adding in a function under the settings tab to enable you to download all of your personal data and settings.
|-
| Right to be forgotten || This means that you have the right to have your personal data erased on request, or if it is no longer relevant to the processing that consent was given for. || Freegle will enable you to have erased the personal data in the Address Book function. However if you want to erase your membership data then it will mean that your membership login will be deleted. In addition policy and guidance will ensure that we keep the minimum data needed only for the time its appropriate.
|-
| Privacy by Design || This means that the systems your data is held on need to be designed to keep the minimum data necessary for the completion of its duties (data minimisation), as well as limiting the access to personal data to those needing to act out the processing. || Freegle already has access protection in for its Freegle Direct system and keeps the least personal data possible to deliver the Freegle services.
|-
| Breach Notification || Under the GDPR, breach notification will become mandatory where a data breach is likely to “result in a risk for the rights and freedoms of individuals”. This must be done within 72 hours of first having become aware of the breach. Organisations will also be required to notify their customers “without undue delay” after first becoming aware of a data breach. || If Freegle became aware of any breach or hack as its more commonly known we will let our members know via email and the UK Data Protection Authority. Luckily we don't keep anything sensitive, and therefore its unlikely to risk anyone's rights or freedoms.
|-
| Penalties || If an organisation violates the GDPR regulations it can be fined up to 4% of its annual global turnover || We at Freegle understand this is aimed at big corporations so they take it seriously. We too take it seriously as without the trust of our members Freegle wouldn't be able to function.
|-
| Data Protection Officer || The GDPR law DPO appointment will be mandatory only for those controllers and processors whose core activities consist of processing operations which require regular and systematic monitoring of data subjects on a large scale or of special categories of data or data relating to criminal convictions and offences. ||Although the law doesn't require organisations like Freegle to appoint a Data Protection Officer we will be having a volunteer position to look at this areas for us. They can be contacted by email at DPO@ilovefreegle.org
|}

== What about groups that are on Yahoo Groups ==

There are two types of groups that use the Yahoo Groups system. 
1. Freegle groups that only use Yahoo and no other system, and
2. freegle groups that use Yahoo Groups linked to the Freegle system.

1. Freegle groups that use Yahoo Groups system only - These groups come under the policies of Yahoo in terms of compliance with Data Protection Laws, however we expect the Freegle volunteers who run these groups to comply with any policies and guidance for Data Protection published by the Freegle board. So for instance Yahoo would need to supply a way of users having access to their records (Right to access), however we would expect the group volunteers to deal with issues such as ensuring members were notified about a breach if Yahoo were first to tell group owners.

2. Freegle groups that are linked to the Freegle System - These groups will utilise the functions of both Yahoo and Freegle systems to comply with the regulations. This may cause some members a little confusion if they are registered with both systems. So volunteers will be asked to ensure that policy and guidance is followed in instances such as deleting data (The right to be forgotten) that members are reminded to delete from both systems. Where practical the Freegle system will take deletions made in Yahoo as a signal to remove the user data from the Freegle system, however this does not work the other way around.

== What about groups on the Norfolk Freegle system? ==

The Norfolk system is a separate system from the main Freegle system. Therefore, it will have its own mechanisms to satisfy the Data Protection laws whilst coming under the general Freegle Data Protection policies. For more information on the Norfolk system you can click here [https://norfolkfreegle.org/Home/Terms]

== What about users of TrashNothing? ==

Trashnothing is a system that fronts Freegle and other systems such as Freecycle. If you have a TrashNothing account then the TrashNothing system keeps your membership details (email address & Postcode) and any Freegle group in connects you with also has this data. Trashnothing has its own Data Protection mechanisms, for more information see here [https://trashnothing.com/privacy].

== Useful Links ==
*[[Spam]] - further explanation to counter accusations that we spam!
*[[Basic Information]]
*[[Admin]]

[[category:Admin]] [[category:Freegle Direct]]