About Us Governance & Policies Privacy Policy
Data Protection &
Privacy Policy
How Shiraz Academy collects, uses, stores and protects personal information, and the responsibilities that support responsible data handling.
Data Protection and Privacy Policy (UK GDPR)Introduction
Shiraz Academy recognises that protecting personal information is a legal and moral responsibility. The charity is committed to handling all personal data lawfully, fairly, and transparently, in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy explains how the charity collects, uses, stores, and protects personal information. It applies to trustees, employees, volunteers, contractors, and anyone working on behalf of the charity.
Back to contents ↑Purpose
The purpose of this policy is to ensure that the charity manages personal data responsibly and in compliance with current UK legislation. It outlines how data are obtained, processed, stored, shared, and disposed of, and how the rights of individuals (data subjects) are protected.
Back to contents ↑Scope
This policy covers all personal data held by Shiraz Academy, whether stored electronically, on paper, or communicated verbally. It includes information about beneficiaries, donors, supporters, service users, clients, trustees, employees, contractors, volunteers, suppliers, and professional contacts.
Back to contents ↑Principles of Data Protection
Shiraz Academy adheres to the seven key principles of the UK GDPR. Personal data will be processed lawfully, fairly, and transparently; collected for specified, explicit, and legitimate purposes; adequate, relevant, and limited to what is necessary; accurate and, where necessary, kept up to date; retained only as long as necessary; processed securely; and handled with accountability.
Back to contents ↑Lawful Bases for Processing
Personal data will be processed only when there is a lawful basis under Article 6 of the UK GDPR. Depending on context, processing may occur by consent, by contract, by legal obligation, by vital interests, or by legitimate interests. The charity does not normally rely on 'public task' or 'vital interests' as lawful bases but will review this if its operations change.
Back to contents ↑Roles and Responsibilities
The Board of Trustees acts as the Data Controller responsible for ensuring compliance with the UK GDPR and this policy. The Chief Executive Officer or Designated Officer oversees day-to-day implementation and acts as the main contact for data protection queries. All staff and volunteers must follow this policy, attend training, and report any data incidents immediately. The charity has assessed that it is not required to appoint a Data Protection Officer under Article 37 of the UK GDPR, as it does not process large-scale special-category or criminal-conviction data.
Back to contents ↑Collecting and Using Personal Data
The charity collects only the minimum personal information necessary to carry out its legitimate charitable activities. Individuals will be informed, through privacy notices, of the purpose of data collection, the lawful basis for processing, who their data may be shared with, how long their data will be retained, and their rights under data protection law. Personal data will not be used for marketing or shared with third parties without a lawful basis or explicit consent.
Back to contents ↑Data Security and Storage
All personal data are stored securely using appropriate technical and organisational measures. Electronic records are held on encrypted, password-protected systems such as Microsoft 365, Google Workspace, or other UK GDPR-compliant platforms with restricted access. Paper records are stored in locked cabinets in secure premises. Access is limited to those who need the information for legitimate work purposes. Portable devices and removable media must only be used when encryption is applied, and data can be deleted securely after use. Regular backups are performed and stored securely.
Back to contents ↑Data Retention and Disposal
Personal data is retained only for as long as necessary to fulfil the purpose for which they were collected or to meet legal or regulatory obligations. Once data is no longer required, they will be securely deleted or shredded. Retention periods are reviewed at least annually to ensure continued justification.
Back to contents ↑Sharing and Transferring Data
The charity will not sell or share personal data with unrelated third parties. Data may be shared only when required by law, necessary for safeguarding, or for legitimate purposes under written agreements. All third-party processors must provide evidence of UK GDPR compliance. The charity does not normally transfer personal data outside the United Kingdom or European Economic Area (EEA); if necessary, adequate safeguards will be applied in line with ICO guidance.
Back to contents ↑Individual Rights
Every individual has rights under the UK GDPR. The charity will uphold these rights and respond to all requests within one month. Individuals have the right to be informed, access their data, request correction, request erasure, restrict or object to processing, request portability, and object to direct marketing or automated decisions. Requests must be made in writing and will be logged, verified, and acted upon promptly.
Back to contents ↑Data Breach Procedure
A personal data breach is any event leading to accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of, or access to, personal data. If a breach occurs, it must be reported immediately to the Chief Executive Officer or Designated Officer. The charity will assess the risk to individuals and, if likely to result in harm, notify the Information Commissioner’s Office within 72 hours of becoming aware. Affected individuals will be informed where necessary, and all incidents will be recorded and reviewed to improve controls.
Back to contents ↑Data Protection by Design and Default
The charity will consider data protection and privacy at the earliest stage of any project, process, or new system. It will ensure that, by default, only the minimum personal data necessary for each purpose are processed and that data are not accessible to unauthorised individuals.
Back to contents ↑Training and Awareness
All staff, trustees, and volunteers who handle personal data will receive suitable induction and refresher training. Awareness updates will be issued when legislation or charity operations change.
Back to contents ↑Monitoring and Review
This policy will be reviewed every two years, or sooner if legislation or operational practices change. Compliance will be monitored through routine checks, feedback, and incident reviews.
Back to contents ↑Non-Adherence
Failure to comply with this policy may result in disciplinary action or termination of contract. Serious breaches may be reported to the Information Commissioner’s Office or other regulators as required by law.
Back to contents ↑