EPAfrica Privacy Notice

Education Partnerships Africa

Privacy Notice

Last modified November 2019

About this Privacy Notice

In this Privacy Notice, references to “we”, “us” and “our” are to Education Partnerships Africa.

We are committed to protecting your personal data. Personal data is any information relating to an identifiable living person who can be directly or indirectly identified by reference to this data.

This privacy notice relates to our use of any personal data that you directly provide us.

We will comply with applicable data protection laws, including the EU General Data Protection Regulation, which requires that personal data we hold about you is:

  • used lawfully, fairly and in a transparent way;
  • collected only for valid purposes that we have clearly explained to you and not used in any way incompatible with those purposes;
  • relevant to the purposes we have told you about and limited only to those purposes;
  • accurate and kept up to date;
  • kept only as long as necessary for the purposes we have told you about;
  • kept securely.

This privacy notice will therefore inform you as to who we are, what personal data we collect, the purposes for which we use it, for how long we retain it and how we keep it secure, your rights in relation to you personal data, and how you can contact us to discuss, query or obtain details of the personal data we hold about you.

Topics

  1. Who we are
  2. Whose personal data we process
  3. Why we process your personal data
  4. Personal data sources
  5. How we will inform you about our privacy notice
  6. The purposes for which your personal data is collected and processed
  7. Who we will share your personal data with
  8. Transferring your data outside of the European Economic Area
  9. Safeguarding your personal data
  10. How long we retain your personal data
  11. Your rights as a data subject
  12. Reporting a concern to us or to the Information Commissioner’s Office
  13. Your right to lodge a complaint with a supervisory authority
  14. Getting in touch with us

 

  1. Who We Are

 Education Partnerships Africa is a registered charity in England and Wales, with charity number 1104888 and company number 4970135. The registered address is 86 Gibson Gardens, London, N16 7HD.

Education Partnerships Africa is a charity which aims to improve the quality of education in East Africa through working with rural communities there. We also enable talented students in the UK to experience grassroots international development and provide them with the awareness, knowledge and skills to become leaders of the future.

Education Partnerships Africa is the controller of the data that it collects and stores.

As a charity which is a not-for-profit organisation and which only stores the minimum information required about its members or individuals with which it has regular contact, Education Partnerships Africa is exempted from the registration with the Information Commissioner’s Office and does not have a Data Protection Officer.

If you would like to contact Education Partnerships Africa, you can do so with the following contact details:

Address:          Education Partnerships Africa

                        86-90 Paul St

                        London    EC2A 4NE

Telephone:      02039200476

Email:              itmanager@epafrica.org.uk

Website:          www.epafrica.org.uk

  1. Whose Personal Data We Process

We collect and process personal data about our:

  • Current Volunteers
  • Previous Volunteers
  • Employees
  • Donors
  • Individuals/contacts in Partner Schools
  • Contacts in East Africa

 

  1. Why We Process Your Data

We only collect and process your personal data on the following legal grounds:

  • with your consent;
  • and/or to perform the agreement we have entered with you (or discharge other contractual obligations);
  • and/or to comply with our legal obligations;
  • and/or to protect the vital interests of yourself, a member of Education Partnerships Africa, or a third party;
  • and/or to perform a task in the public interest;
  • and/or to pursue the legitimate interests of yourself, Education Partnerships Africa, or a third party, so long as your rights do not override those legitimate interests.
  1. Personal Data Sources

We can collect personal data from a number of sources, including but not limited to:

  • Information you provide us directly, for example in forms you fill in online or emails you send us. If you are a school partner or a contact in East Africa you are more likely to provide information on hard copies or orally. In this case too the data Protection Policy apply;
  • Publicly available information online, for example from LinkedIn or Google;
  • Third party providers such as contractors, website hosts and cookies
  1. How We Will Inform You About Our Privacy Notice

This Privacy Notice as well as our Data Protection is publicly available on our website www.epafrica.org.uk. We will provide a link to this privacy notice whenever we collect your personal data online.

We will not use your personal data for any purposes other than those set out below without first informing you.

Changes made to this privacy notice will be updated on our website and clearly signposted on our key documents.

  1. The Purposes For Which Your Personal Data is Collected and Processed

We collect your personal data with the overall aim of enabling successful charitable work in our partner schools in East Africa.

6.1 Volunteers and employees

6.1.1 – Name and Contact Details (including address, telephone numbers and email addresses)

This data allows us to coordinate our activities and communicate with you in order to carry out the agreement we have made with you.

Your name and occasionally your contact details will be disclosed when necessary to third parties when carrying out agreements we have made, for example the school you will be volunteering in, and any companies we use when arranging transport and accommodation. As we rely on our network as a source of personnel and donations, subject to your consent, you may receive communication from us after you have been a project worker. You have the absolute right to object to this communication, in which case we will cease further communication.

6.1.2 – University and Course

This data allows us to coordinate our activities via the University Committees in our project worker hubs in order to carry out the agreement we have made with you.

It will not be shared with third parties. We will use the information to notify you of events happening at your project worker hub or ask for your assistance when coordinating our activities there.

6.1.3 Special Categories of Personal Data – Health and Criminal Offences

If you are travelling to East Africa, we will collect your health data to safeguard your health in a medical emergency. This will only be disclosed to third parties, such as medical staff, with your explicit consent, unless you are physically incapable of doing so.

As part of your health declaration, we will request a copy of your yellow fever vaccination certificate, as this is a legal requirement for entering Kenya and Uganda or certain countries.

We will also process your personal information relating to criminal offences. This will be done in accordance with the legal obligations set by the Child Protection Act 2004. If an incident occurs, it may be necessary to disclose the certificate number, name and expiry date on your Disclosure and Barring Service (DBS) certificate to an insurance company.

We will not collect any other sensitive personal data (special category data) from you, such as information relating to race or ethnic origin, political opinions, religious beliefs or other beliefs of a similar nature, trade union membership, physical or mental health, sexual life orgenetics or biometrics.

6.1.4 – Copy of Passport, Flight Confirmation, Visa Details and Insurance Policy

If you are travelling to East Africa, this data is required to carry out the agreement we have made with you when we:

  • arrange transport and accommodation on your behalf
  • coordinate logistics in East Africa
  • reimburse you for valid expenses

It will be shared with relevant third parties where necessary to carry out the agreement, for example airlines and accommodation.

6.1.5 – Bank Details

This data is required to carry out the agreement we have made with you to reimburse valid expense claims and to transfer to you your upfront living allowance.

6.2 East African contacts and partner schools

6.2.1 – Name and Contact Details (including address, telephone numbers and email addresses)

This data allows us to coordinate our activities and communicate with you in order to carry out our charitable work as discussed with you at the first point of contact. You have the absolute right to object to this communication, in which case we will cease further communication.

Your name and occasionally your contact details will be disclosed when necessary to third parties when carrying out arrangements we have made, for example the volunteer you will be hosting or working with.

 

  1. Who We Will Share Your Personal Data With

We may also share any of your personal data with:

  • Regulatory authorities, government departments or the police in order to comply with any legal obligations or to assist in crime prevention and detection
  • Other third parties where we reasonably believe that such action is necessary to comply with legal obligation, or to protect our rights and property, or act in urgent circumstances to protect the personal safety of our volunteers, the individuals and organisations we work with, or members of the public
  • Our partners and third party vendors such as travel agencies, airlines and insurance companies as well as IT system providers such as Salesforce and Google

7.1 Links to third party websites

To allow you to interact with other non-EP Africa websites on which you may have accounts (such as social media sites) may provide links or embed third-party applications that allow you to sign up, login or post content from our websites.

Your use of these links and applications is subject to the third parties’ privacy policies, and you should become familiar with the third-party sites’ privacy policies before using the links or applications. We are not responsible for the privacy practices or the content of those other websites.

 

  1. Transferring Your Data Outside of the European Economic Area

Your personal data will be securely transferred to East Africa once per year for use by our Summer Team based there, all of whom are members of Education Partnerships Africa.

In the event, your personal data is required to be transferred to non-European Economic Area, we will only perform it with an appropriate level of protection for the fundamental rights of the data subjects, in accordance with the GDPR.

We will ensure that all subsidiaries and business partners outside the EEA, process your personal data in accordance of this Privacy Notice. Where required, we will implement Standard Contractual Clauses approved by the EU Commission, or similar contractual clauses in other jurisdictions.

  1. Safeguarding Your Personal Data

We take all reasonable steps to ensure that appropriate safeguards are in place to protect your personal data. Access to your data is limited to those who need it. Your data is secured through passwords. Internal training is carried out within the organisation to ensure those who handle your personal data understand and comply with GDPR regulation.

  1. How Long We Retain Your Personal Data

Your personal data will be retained by us for in accordance with our data retention policy and as long as it is necessary to fulfill the purposes for which it is processed and as long as there remains a valid legal basis for retaining it. We will keep the data to comply with legal and regulatory obligations, handling disputes, and for the establishment, exercise or defense of legal claims. We will keep data retention under regular review.

For more information about retention periods for specific types of information, see our Data Protection Policy on our website.

  1. Your Rights as a Data Subject

To ensure fair and transparent processing, it is important that we inform you of your rights with regards to how your personal data is processed. Were you wish to exercise a right, we have indicated the best contact details for you to get in touch with us.

We may ask for further information to narrow down the scope of your request, locate the information and to verify your identity.

11.1 Your Right to Be Informed

This is our privacy notice which informs you of who we are, why we are processing your personal data, with whom we share your personal data and how we have collected it. These details are out above.

Our privacy notice can be found on our website and a link to it will be provided whenever we collect your personal data digitally.

If you would like to discuss this privacy notice to find out more information, or suggest ways in which we could improve the content or its communication, then please email us at itmanager@epafrica.org.uk or write to us at at Education Partnerships Africa, 86-90 Paul St, London, EC2A 4NE.

1.2 Your Right of Access

As a data subject, you have the right to access the personal data we hold about you.

Making a data subject access request (DSAR) is free and can be done in writing by emailing us at itmanager@epafrica.org.uk or alternatively writing to us at Education Partnerships Africa, 86-90 Paul St, London, EC2A 4NE. You can also speak to us if you have any questions or queries relating to a DSAR.

Once we receive your request, we will ask you to verify your identity and ask you to specify the data or processing activity that you require so that we can confirm your expectations and respond within a month.

If your request is manifestly unfounded,  excessive or repetitive in nature, we have the right to refuse it or apply a reasonable fee. If the request is complex or extensive, we have the right to extend the time to respond, in which case we will inform you about it within a month of the request.

11.3 Your Right to Rectification

Where personal data is inaccurate or incomplete, you have the right for it to be rectified on our systems. In such cases, we will act promptly to apply the rectifications.

So that we can quickly resolve your query, we may ask you to provide some supporting evidence to show that the data needs to be altered.

If you require your personal data to be rectified, this can be done in writing by emailing us at itmanager@epafrica.org.uk or alternatively writing to us at Education Partnerships Africa, 86-90 Paul St, London, EC2A 4NE.

11.4 Your Right to Erasure

This enables you to ask us to delete or remove personal data where there is no good reason for us to continue to process it. You also have the right to ask us to delete or remove your personal data where you have exercised your right to withdraw consent (see below).

Sometimes however, we may refuse a request to erase certain data in order, for example, to comply with a legal or regulatory obligation and applicable law or to be able to execute the contract.

If you require your personal data to be erased, this can be done in writing by emailing us at itmanager@epafrica.org.uk or alternatively writing to us at Education Partnerships Africa, 86-90 Paul St, London, EC2A 4NE.

11.5 Your Right to Restrict Processing

This enables you to ask us to restrict the processing of your personal data, so that the processing is limited to certain uses of data. For example, if you do not want us to erase your data, you may ask us to restrict our processing activities instead or where retention of data beyond the retention period is required to defend a legal claim.

11.6 Your Right to Data Portability

To help strengthen your control over your data, you have the right, in certain circumstances, to receive personal data from us in a format which allows you to transfer the data to other data controllers. For example, you may want your donation data in CSV format.

We may ask you to specify what data you wish us to provide you.

If feasible, we will transfer the data in a common format to other data controllers.

Should you wish to exercise your right to data portability, this can be done in writing by emailing us at itmanager@epafrica.org.uk or alternatively writing to us at Education Partnerships Africa, 86-90 Paul St, London, EC2A 4NE.

11.7 Your Right to Withdraw Consent

In circumstances where you have provided your consent to the processing of your personal data for a specific purpose, you have the right to withdraw your consent for that specific processing activity at any time.

If you wish to withdraw consent from receiving communications for marketing purposes, this can be done by you directly by unsubscribing from our mail-list.

To withdraw your consent, you can email itmanager@epafrica.org.uk or alternatively write to us at Education Partnerships Africa, 86-90 Paul St, London, EC2A 4NE.

Once we have received notification that you have withdrawn your consent, we will no longer process your data for the purpose or purposes you originally agreed to, unless we have another legal basis for doing so such as contractual or legal reason. Please be aware that although an unsubscription/withdrawal request is processed by us at our earliest convenience, it can take up to a month to take effect.  

  1. Reporting a Concern to Us or to the Information Commissioner’s Office

 If you have a concern regarding how we handle your personal data then we kindly request that you inform us about it first so that we can work with you in an effort to resolve it.

You can report a concern or raise a complaint with us initially by contacting emailing us at itmanager@epafrica.org.uk or alternatively writing to us at Education Partnerships Africa, 86-90 Paul St, London, EC2A 4NE.

We aim to acknowledge your complaint within one week and provide a resolution within 28 days. If we are unable to meet this timescale, we will write to notify you in advance.

If you are not satisfied with our proposed resolution to your complaint, you can raise the matter directly with the Information Commissioner’s Office (ICO). The ICO will take steps to address your concern and provide guidance and support to us so that we can put things right.

Details as to how to get in touch with the ICO or report a concern can be found on their website www.ico.org.uk/concerns

  1. Your Right to Lodge a Complaint with a Supervisory Authority

 If you consider that the processing of personal data infringes any of your rights set out in Section 11, you have the right to lodge a complaint with the relevant supervisory authority in the European State that you reside or work in, or the place of the alleged infringement. The relevant supervisory authority for the UK is the Information Commissioner’s Office.

The supervisory authority which the complaint has been lodged shall inform you of its progress and the outcome of the complaint including the possibility of a judicial remedy.

The names and contact details of the Data Protection Authorities in the European Union can be found here https://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm

 

  1. Getting In Touch With Us

If you would like to discuss this privacy notice or suggest way in which we could improve the content or its communication, then please email us at itmanager@epafrica.org.uk or write to us at Education Partnerships Africa, 86-90 Paul St, London, EC2A 4NE.