Last updated: August 2025

1. What does this Privacy Notice cover?

This Notice explains how Volunteer Centre Tower Hamlets (“we”, “us”, or “our”) collects, uses, and shares personal data about individuals who register as volunteers through our website and the Volunteer Connect platform (the “Site”). It applies to all personal information provided by you when creating a volunteer account or using our services. By using our Site, you acknowledge that your personal data will be processed as described in this Notice. We are committed to handling your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and all relevant data protection legislation.

2. Who is responsible for your personal data?

Data Controller – Volunteer Centre Tower Hamlets: Volunteer Centre Tower Hamlets is the Data Controller for the volunteer information collected via the Site. This means Volunteer Centre Tower Hamlets decides how and why your personal data is processed. You can find our contact details in Section 11 below.

Data Processor – Simply Connect Solutions Ltd: Simply Connect Solutions Ltd (“Simply Connect”) operates the Volunteer Connect platform on our behalf as a Data Processor. Simply Connect is a company registered in England and Wales (Company No. 11321193), with its registered office at 4 Cromwell Court, New Street, Aylesbury, Buckinghamshire, England, HP20 2PB, UK. Simply Connect processes your personal data only on our instructions and for the purposes described in this Notice.

Volunteer Centre Tower Hamlets and Simply Connect work together to ensure your data is handled properly. If you have questions about how your data is used, you can contact us (the Data Controller) using the details in Section 11.

3. What personal data do we collect about you?

When you register as a volunteer on the Site or engage with our services, we collect certain personal data about you. This may include:

• Identification and Contact Details: Your name, postal address (including house number, street and postcode), email address, and (if provided) phone number.
• Personal Details: Your date of birth and gender. We ask for this information to ensure you are matched with appropriate opportunities (some roles have age or gender restrictions) and for demographic monitoring.
• Demographic and Sensitive Information: Information such as your ethnicity, religion/faith, sexual orientation, gender reassignment, disabilities or health conditions, immigration or employment status. We use this information to monitor diversity and inclusion and to help us reach all communities., or to help us tailor suitable opportunities. We collect this data with your consent (UK GDPR Article 6(1)(a) and Article 9(2)(a)) when you consent to this Volunteers’ Privacy Notice. You are under no obligation to provide this demographic/sensitive information, and your access to services will not be affected if you choose not to. You can remove this information from your record at any time, by logging into your account and changing it to ‘prefer not to say’. The information is stored securely, anonymised where possible, and never used for decision making about individuals without their explicit consent.
• Volunteer Profile Information: Details you provide about your skills, interests, volunteering preferences, availability, photo and a personal profile or biography describing yourself.
• Referral Information: How you heard about us

We only collect the data that is necessary for providing the volunteer matching service and related activities. If you choose not to provide certain optional information, you can still use the Site, though some features (such as specific matching) may be less tailored to you.

4. For what purposes do we use your personal data, and on what legal basis?

We process your personal data only for specific, legitimate purposes and in accordance with the law. The main purposes for which we use your information are:

• Account Setup and Administration: To create your volunteer account, maintain your profile, and manage our relationship with you (eg keeping track of roles you are interested in). (Legal basis: Legitimate interests – it is in our legitimate interest to manage volunteer registrations and accounts)
• Matching and Referral to Opportunities: To match you with suitable volunteering opportunities and allow you to “Register your interest” in roles. When you express interest in a volunteer role, we forward relevant personal details to the organisation offering that role so they can consider you as a candidate. We will only share your name, email address and phone number. (Legal basis: Legitimate interests – to facilitate volunteer placements at your request).
• Communications and Service Updates: To communicate with you about volunteer opportunities, events or updates, or to inform you of changes to the service (such as new features on the Site). You can unsubscribe at any time. (Legal basis: Legitimate interests – to keep you informed about volunteer activities and our services. If these communications are marketing in nature or not about our service, we will only send them with your consent).
• Service Customisation and Improvement: To personalise your experience (for example, suggesting opportunities you may like) and to improve and optimise our volunteer programme and the functionality of the Site. We may analyse usage patterns to make the platform more user-friendly and effective. (Legal basis: Legitimate interests – to improve and enhance our volunteer programme and platform).
• Monitoring and Reporting: To monitor the inclusivity and effectiveness of our services (for instance, using aggregate demographic information to ensure we are engaging all sections of the community and to report to funders on volunteer engagement). Wherever possible, we use pseudonymised or aggregated data for reporting. (Legal basis: Legitimate interests – to evaluate and demonstrate the impact of our services).
• Safety and Legal Compliance: To protect the welfare of volunteers and service users, including meeting safeguarding and health & safety requirements, and to comply with any other legal obligations applicable to us. For example, we may need to ensure volunteers meet certain legal criteria or we may be required by law to conduct certain checks or provide information to authorities. (Legal basis: Legal obligation – to fulfil our duties under UK law).
• Optional Programmes and Features (Consent): If you have given us your consent, we will use your data for certain additional purposes that you have agreed to. (Legal basis: Consent – you can withdraw your consent at any time (see Section 8 on Your Rights)).

We will only use your personal data for the purposes we have disclosed. If we need to use your information for an unrelated purpose, we will notify you and explain the legal basis, unless otherwise required by law.

Lawful Bases Under UK GDPR:

• Legitimate Interests: For most of the operational purposes described above, we rely on our legitimate interests (or those of third parties) in running an effective volunteer matching service. We always consider and balance any potential impact on your rights before relying on legitimate interests.
• Contract: Where we provide you with access to a digital platform or service (eg, matching you to a volunteer opportunity), we may process your data as necessary to fulfil that service under a functional agreement. This does not constitute an employment or volunteer contract.
• Legal Obligation: When processing is necessary for us to comply with a legal or regulatory obligation (eg verifying your eligibility to volunteer under certain laws, or providing information to authorities when legally required).
• Consent: Where you have explicitly consented to a specific use of your data, especially for any sensitive information (such as health or ethnicity data) or for receiving optional communications. You have the right to withdraw your consent at any time.

5. Who do we share your personal data with?

We treat your personal data with care and confidentiality. We will share it only when necessary for the purposes outlined above, and always with appropriate safeguards in place. The main parties with whom we may share your data are:

• Volunteer Centre Staff and Authorised Personnel: Employees, contractors and volunteers of Volunteer Centre Tower Hamlets who need to access your information to manage volunteer services will have access to your data. This access is tightly controlled and granted on a need-to-know basis.
• Simply Connect (Platform Provider): As our Data Processor, Simply Connect’s technical team may have access to your data in order to host, maintain, and support the Volunteer Connect platform. They are contractually obliged to keep your data secure and only process it according to our instructions.
• Volunteer-Involving Organisations: If you apply for or express interest in a volunteering opportunity with an external organisation through our Site, we will share the necessary personal data with that organisation so they can contact you about the role. These organisations will then handle your data as independent Data Controllers under their own privacy policies. We encourage you to review the Privacy Notice of any organisation before volunteering with them.
• Partner Organisations: For certain projects where we recruit volunteers on behalf of other organisations, we will have a Data Sharing Agreement in place.
• Service Providers: We may share your data with trusted third-party service providers that help us run our operations. For example, IT hosting companies, software support teams, or communication services (such as Survey Monkey, MailChimp, WhatsApp) may process data on our behalf. Any such providers are bound by confidentiality and data protection agreements, meaning they cannot use your data for their own purposes and must protect it in line with this Notice and the law.
• Legal and Regulatory Requirements: If required by law or regulation, we may disclose your information to relevant authorities. For instance, we might need to share data with law enforcement, regulatory bodies, or government agencies if we are compelled by law, or if disclosure is necessary to exercise or defend legal claims, to protect the rights and safety of our staff, volunteers or service users, or to cooperate with an investigation.
• Business Transfer or Service Transition: In the event that the volunteer service is transferred to a different provider or if Volunteer Centre Tower Hamlets ceases to provide the service, we may transfer your personal data to the new provider as part of that transition. This would be done to ensure continuity of the volunteering service and would rely on a lawful basis (such as legitimate interests). We will inform you of any such transfer.

We do not sell, rent, or trade your personal data to third parties for marketing or any other purposes.

International Data Transfers: Your personal data is stored and processed primarily in the UK in the Simply Connect platform. We also use MailChimp for our email alerts, and Survey Monkey for some surveys and questionnaires, whose servers are based in the USA. Before any such transfer takes place, we will carry out appropriate due diligence and enter into a Data Processing Agreement (DPA) with the new provider, including the UK Addendum where applicable, to ensure they are contractually required to protect you data and process it only for specified purposes or that other appropriate safeguards are in place (e.g. Standard Contractual Clauses) in accordance with data protection law to protect your information.

6. How do we protect your personal data?

We take the security of your personal data seriously. We have implemented appropriate technical and organisational security measures to prevent unauthorised access, loss, or disclosure of your information. These measures include, for example, using secure servers, encryption technologies, firewalls, and security audits of our systems. We also restrict access to personal data: only personnel and service providers who have a valid need to access your information for the purposes described in this Notice are permitted to do so. They are subject to strict confidentiality obligations.

While we strive to protect your data, please be aware that no website or internet transmission is completely secure. However, we continuously review and enhance our security practices to protect your personal data against ever-evolving threats.

7. How long do we keep your personal data?

We will retain your personal data only for as long as necessary to fulfil the purposes outlined in this Notice, unless a longer retention period is required or permitted by law. In general, this means we will keep your information for as long as you have an active volunteer account with us and for a reasonable period afterwards. Keeping your data allows you to re-engage with new opportunities without needing to re-register from scratch.

If you decide to deactivate your account or if you request that your data be removed from our system, we will delete or anonymise your personal data (subject to any legal obligations that require us to retain certain information for a specified time). We also periodically review the data we hold and safely delete or anonymise information that is no longer needed.

Specific details of our data retention practices are outlined in our internal data retention policy. If you have questions about how long we keep specific types of data, please contact us.

8. What are your rights regarding your personal data?

Under data protection law, you have several rights regarding the personal data that we hold about you. You can exercise these rights by contacting us (see Section 11). Your principal rights include:

• Right to Access: You have the right to request a copy of the personal data we hold about you, as well as information about how we process it.
• Right to Rectification: If any of your personal data is inaccurate or incomplete, you have the right to have it corrected or updated.
• Right to Erasure: You can ask us to delete your personal data in certain circumstances – for example, if the data is no longer necessary for the purposes for which it was collected, or if you withdraw consent and we have no other legal basis to continue processing it.
• Right to Restrict Processing: You have the right to request that we limit the processing of your data in certain situations. This might apply if you contest the accuracy of your data, or if you want us to preserve data while a complaint is being resolved.
• Right to Data Portability: For data you have provided to us, you have the right to request that we provide it to you in a structured, commonly used, and machine-readable format, or (where technically feasible) to have that data transmitted directly to another organisation. This right applies when we are processing your data based on your consent or on a contract with you, and the processing is carried out by automated means.
• Right to Object: You have the right to object to our processing of your personal data when that processing is based on our legitimate interests. If you object, we will review whether your privacy rights outweigh our legitimate interests in continuing the processing. You can always object to the use of your personal data for direct marketing purposes, and if you do so we will stop using your data for that purpose.
• Rights Related to Automated Decision-Making: You have the right not to be subject to a decision based solely on automated processing (including profiling) if it produces legal or similarly significant effects on you, unless it is necessary for entering into or performing a contract, is allowed by law, or you have given your explicit consent. (Note: Our volunteer platform does not make decisions about volunteers without human involvement, but we mention this right for completeness.)
• Right to Withdraw Consent: If we are processing any of your personal data based on your consent, you have the right to withdraw that consent at any time. Once you withdraw consent, we will stop the specific processing that was based on consent. Withdrawal of consent will not affect the lawfulness of processing performed prior to your withdrawal.
• Right to Complain: If you believe your data protection rights have been violated, you have the right to lodge a complaint with the supervisory authority. We kindly ask that you contact us first so we can address your concerns directly. (The relevant supervisory authority in the UK is the Information Commissioner’s Office – see Section 11 for contact details.)

We will handle any requests to exercise these rights in accordance with applicable law. Please note that some rights are not absolute – for instance, we might not erase data that we are required by law to keep, or we might decline a request if it adversely affects the rights and freedoms of others – but we will explain our reasoning if we cannot fulfil a request in full.

9. Cookies and third-party links

Our Site uses cookies and similar technologies to ensure the website functions correctly and to enhance your user experience. We are currently reviewing and updating our cookie management systems to ensure full compliance with the UK GDPR and PECR (Privacy and Electronic Communications Regulations). We are in the process of implementing a consent logging mechanism and will provide further details in our updated Cookies Policy (which will be available at www.vcth.org.uk).

The Site may contain links to websites operated by third parties, such as the websites of volunteer-involving organisations or other partner services. This Notice only applies to our own collection and handling of your data on our Site. If you follow links to any other websites, those sites will have their own privacy policies which may differ from ours. We are not responsible for the privacy practices or content of external websites. We recommend that you review the Notice of any external website you visit or any organisation that you engage with. In particular, if you volunteer with or provide information to an organisation through our platform, please read that organisation’s privacy policy to understand how they will handle your data.

10. Updates to this Notice

We may update or revise this Notice from time to time to reflect changes in our services or to comply with new legal requirements. When we make changes, we will update the “Last updated” date at the top of this Notice. For significant changes, we may also notify you directly (for example, by email or via a notification on the Site). We encourage you to review this Notice periodically to stay informed about how we protect your personal data.

11. How to contact us or make a complaint

If you have any questions, concerns, or requests regarding this Notice or your personal data, please contact us – we are here to help.

Volunteer Centre Tower Hamlets (Data Controller)
Email: info@vcth.org.uk
Website: www.vcth.org.uk

We will endeavour to respond to your enquiries and resolve any issues promptly and courteously.

If you have a complaint about how we have handled your personal data, please consider contacting us first to allow us the opportunity to address your concerns. We will do our best to resolve any complaints.

However, if you are not satisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO), which is the supervisory authority for data protection issues. You can contact the ICO by visiting https://ico.org.uk/make-a-complaint/ or by calling their helpline at 0303 123 1113.