Privacy policy – Jersey National Park

Privacy Notice

Jersey National Park Ltd

Effective date: August 2023

This Privacy Notice sets out how Jersey National Park Ltd deals with your personal data

The privacy and security of your personal information is extremely important to us. This privacy policy explains how and why we use your personal data to make sure you stay informed and can be confident about giving us your information.

We’ll keep this policy updated to show you all the things we do with your personal data. This policy applies if you’re a supporter of the Jersey National Park or use any of our services, visit our website, email, call or write to us.

This Privacy Policy describes how we collect and use personal information about you during and after your relationship with us, in accordance with the Data Protection (Jersey) Law 2018

Who are ‘we’?

In this policy, whenever you see the words ‘we’, ‘us’, ‘our’, ‘JNP’ or ‘Park’, it refers to Jersey National Park Ltd. (“Jersey National Park”), a registered charity with the Association of Jersey Charities, (membership number 512) and registered with the Jersey Charity Commissioner (Charity Number 416).

The Jersey National Park is a charitable organisation with 2 Key Purposes:-

The conservation and enhancement of the natural beauty, wildlife and cultural heritage of the Jersey National Park
To promote opportunities for the understanding and enjoyment of the special qualities of the Jersey National Park by the public.

If you have any questions in relation to this privacy policy or how we use your personal data you should e-mail;

info@jerseynationalpark.com

or write to us at;

Jersey National Park, Frances le Sueur Centre, La Mielle de Morville, St Ouen, Jersey, JE3 2FN

We will comply with data protection law. This says that the personal information we hold about you must be:- 

Used lawfully, fairly and in a transparent way. 
Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes. 
Relevant to the purposes we have told you about and limited only to those purposes. 
Accurate and kept up to date. 
Kept only as long as necessary for the purposes we have told you about. 
Kept securely.

We will also only transfer your information when it is safe to do so, when it is necessary to do so and your information is protected in the same way that we protect it. 

The Jersey National Park is accountable to you and the Authorities to not only show compliance with the data protection laws but also to demonstrate how we are compliant.

We have appointed a Data Protection Officer (DPO) to oversee compliance with this Privacy Policy.

If you have any questions about this Privacy Policy or, how we handle your personal information, please contact the DPO at;

info@jerseynationalpark.com

You have the right to make a complaint at any time to the Jersey Office of the Information Commissioner, the supervisory authority in Jersey for data protection issues.

Contact details are outlined at the bottom of this Privacy Notice.

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

The information that we collect may include;

Name
Title
Address
Date of Birth
Telephone number(s)
Email address
Signature
Bank Account Details

On occasions when we collect what is called Special Category data, we will always have either a clear legal basis to process this or your explicit consent. If we rely on your explicit consent, you can withdraw this at any time by contacting our DPO at;

info@jerseynationalpark.com

Special Category data is any information relating to your health, gender, race, sexual orientation, sex life, genetic or biometric data etc. 

An example of this processing would be if you request special facilities to be provided whilst you use the Frances le Sueur Centre. This information is then stored very safely in our computer system.

We will only use your personal information when the law allows us to, this is called a legal basis for processing your information (data).

Most commonly, we will use your personal information in the following circumstances:

Where we need to comply with a legal obligation.
Where you have entered into a contract with us to provide you with a service. This would be the case when you book use of the Frances le Sueur Centre or join a guided walk.
Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.

We may also use your personal information in the following situations, which are likely to be rare: 

Where you have given, your consent to contact you for a specific purpose.
In an emergency and it is in your vital interest that we share your information, when we have it recorded.

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.

If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Information about you that we share

Your personal information will be made available to those members of our staff who need to see it in order to perform their functions, roles or responsibilities at the Jersey National Park in respect of the services you have requested or agreed to use.

Your personal information may be held by us in one or more customer relationship management or CRM database(s). We may consolidate details of your dealings with us across various services to ensure we have clear and accurate records about your use of our services. This helps us to better understand your requirements and how we might provide other services to you.

For external processing

The Jersey National Park makes use of expert third party service providers to help it to provide relevant services, such as expert IT providers helping us with our IT systems, or professional auditors. Please note that certain individuals who will see your personal information may not be based with Jersey National Park.

Where required by law we disclose information (for example, to meet legal obligations on the charity or to provide reasonable voluntary cooperation with a relevant police investigation).

We’ll never sell your personal data.

What personal data do we collect?

Your personal data (any information which identifies you or which can be identified as relating to you personally) will be collected and used by us in connection with specific activities and services you have signed up to (such as booking an event, donations, volunteering, property rental, fundraising and employment) and also to make you aware of additional services provided by us that you may be interested in. We’ll only collect the personal data that we need which will be held on our secure systems. Should you wish to withdraw your consent for us to hold your personal data please advise us in writing at the details set out above.

Personal data provided by you

This includes information you give when interacting with us, for example joining or registering, booking an event or communicating with us. For example:

– Personal details (name, date of birth, email, address, telephone), when you join as a member or supporter
– Financial information (payment information such as credit or debit card or direct debit details)
– Your opinions and attitudes about the Jersey National Park, activities and interests.

How we use your personal data

We’ll only use your personal data on relevant lawful grounds as permitted by the Data Protection (Jersey) Law 2018. Personal data provided to us may be used for a variety of purposes depending on the services you have requested or the contract you have entered into with us.

In addition, where agreed with you, we may tailor our communications and dealings with you to better reflect your needs and preferences, such as sending you newsletters.

In carrying out the above we process your personal data in a variety of ways, each of which may have a different legal basis. We may process your personal data because:

– You have given your consent (e.g. for the provision of marketing or correspondence)
– It is necessary for the performance of a contract with you (e.g. property rental or volunteering or employment contract)
– In specific situations, we process your data to pursue our legitimate interests in ways which might reasonably be expected and which do not materially impact your rights, freedoms or interests.

Information we generate

We conduct research and analysis on the information we hold which can in turn generate personal data. For example, by analysing your interests and involvement with our work we may be able to build a profile which helps us decide which of our communications are likely to interest you.

Information from third parties

We do not use or buy information or data from third parties.

Retention of data

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

All data is retained securely and only used for the purposes set out in the Law. Data is retained to comply with our statutory obligations and in accordance with our retention schedule. If you would like a copy of our retention schedule, please contact our DPO at;

info@jerseynationalpark.com

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

We will keep your details on record until we have completely dealt with your request, enquiry, or our contract with you and then for a reasonable period afterwards in accordance with data protection or other applicable legislation and our retention policy.

In general, we will retain the personal information that you have provided to us for up to ten years since your last contact with us, for the purposes of audit, analysis and customer management, and the defence of legal claims.

You can request our Data Retention Schedule from our DPO if required.

In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.

It is important that the personal information we hold about you is accurate and current.

Please keep us informed if your personal information changes during your relationship with us.

Volunteers

If you’re a volunteer then we may collect extra information about you (e.g. references, criminal records checks, details of emergency contacts, medical conditions etc.). This information will be retained for legal or contractual reasons, to protect us (including in the event of an insurance or legal claim) and for safeguarding purposes.

Marketing communications

Your privacy is important to us so we’ll always keep your details secure. We’d like to use your details to keep in touch about things that may matter to you.

This might be about visiting our sites, volunteering with us, membership, events, conservation work or fundraising.

We’ll only send these to you if you agree to receive them. If at a later date you can change your mind and elect not to receive marketing information. However, you will then miss out on directly being notified about events or other work we do that may be of interest to you.
There are some communications that we need to send. These are essential to fulfil our promises to you as a member, such as renewal membership reminders, our publications and notice of our Annual General Meeting.

Fundraising, donations and legacy pledges

As a supporter we may invite you to support vital conservation work by making a donation, buying a raffle ticket, getting involved in fundraising activities or leaving a gift in your will.

If you make a donation we’ll use any personal information you give us to record the nature and amount of your gift and claim tax relief where you’ve told us you’re eligible. If you interact or have a conversation with us we’ll note anything relevant and store this securely on our systems.

If you’ve told us that you’re planning to, or thinking about, leaving us a gift in your will we’ll use the information you give us to keep a record of this, including the purpose of your gift.

If we have a conversation or interaction with you (or with someone who contacts us in relation to your will, for example your solicitor), we’ll note these interactions throughout your relationship with us as this helps to ensure your gift is directed as you wanted.

Site Hire

We process customer data in order to fulfil site hire bookings. Your data will be used to communicate with you throughout the process, including to confirm we’ve received your order and payment, to clarify where we might need more detail to fulfil an order or booking, or to resolve issues that might arise with your booking.

Recruitment and employment

In order to comply with our contractual, statutory, and management obligations and responsibilities, we process personal data, including ‘sensitive’ personal data, from job applicants and employees.

Such data can include, but isn’t limited to, information relating to health, racial or ethnic origin, and criminal convictions. In certain circumstances, we may process personal data or sensitive personal data without explicit consent. Further information on what data is collected and why it’s processed is given below.

Contractual responsibilities: Our contractual responsibilities include those arising from the contract of employment. The data processed to meet contractual responsibilities includes, but is not limited to, data relating to: payroll, bank account, postal address, sick pay, paternity leave, pension and emergency contacts.

Statutory responsibilities: Our statutory responsibilities are those imposed through law on the organisation as an employer. The data processed to meet statutory responsibilities includes, but is not limited to, data relating to: tax, social security, sick pay, paternity pay, family leave, work permits.

Management responsibilities: Our management responsibilities are those necessary for the functioning of the charity. The data processed to meet management responsibilities includes, but is not limited to, data relating to: recruitment and employment, training and development, absence, disciplinary matters, e-mail address and telephone numbers.

How we Store Information

Information collected in relation to your personal details are held on our CRM database Microsoft Excel, which is backed up to web based cloud storage. We also keep information on our computer system together with some hard copy files, such as correspondence and letters we will have received from you.

How we protect the information that we collect

Hard copy files are held in fire proof cabinets. Electronic information is password protected by authorised users. Our information is backed up regularly to a server.

Updating your data and marketing preferences

We want you to remain in control of your personal data. If, at any time, you want to update or amend your personal data or marketing preferences please contact us in one of the following ways:

Email: info@jerseynationalpark.com
Telephone: 01534 721404
Write to us at: Jersey National Park, Frances le Sueur Centre, La Mielle de Morville, St Ouen, Jersey, JE3 2FN

Your data protection rights

Under data protection law, you have rights including:

Your right of access –You have the right to ask us for copies of your personal information.

Your right to rectification –You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

Your right to erasure –You have the right to ask us to erase your personal information in certain circumstances.

Your right to restriction of processing – You have the right to ask us to restrict the processing of your information in certain circumstances.

Your right to object to processing –You have the right to object to the processing of your personal data in certain circumstances.

Your right to data portability –You have the right to ask that we transfer the information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have four weeks to respond to you.

If you require any more details or wish to exercise your rights please contact us via email, phone or letter.

Under certain circumstances, by law you have the right to:

Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below). 
Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
Request the transfer of your personal information to another party.

If you want to review, verify, correct or request erasure of your personal information, object to the processing or request that we transfer a copy of your personal information to another party, please contact our DPO at info@jerseynationalpark.com

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances. 

For Data subject Access requests, or if you have any questions about how we use your data, please contact our DPO at; info@jerseynationalpark.com

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights).  

This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it. 

We will respond to your request within 4 weeks after and upon satisfactory verification of your identity. 

In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time.  

To withdraw your consent, please contact our DPO at info@jerseynationalpark.com

Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates.

We may also notify you in other ways from time to time about the processing of your personal information or requesting you to confirm the accuracy of the information we hold on you. 

We would like the chance to resolve any complaints you have about the way we process your information; however, you do have the right to complain to the Jersey Office of the Information Commissioner about how we have used your personal data. 

Upon receipt of a Complaint about one of the products or services we offer it may be required that we share your data and the subject of the complain with a supplier or producer of the product or service you have complained about. This is part of the investigation into your complaint, and we can assure you that your data will be protected as well as it is outlined in the notice. 

If you do not want your data shared with a supplier or producer of the product or service you want to complain about, please inform the member of staff taking your Complaint, or email our DPO at info@jerseynationalpark.com

How to complain

If you are unhappy with the way the Jersey National Park Ltd, has dealt with your Data Protection request you can also complain to the Jersey Office of the Information Commissioner (JOIC).

JOIC’s address:

2nd Floor, 5 Castle Street, St. Helier, Jersey JE2 3BT

enquiries@jerseyoic.org 01534 716530

Approved by the Board on [x] August 2023