Our privacy notice for trustees

1. About this notice

This notice explains how we use your personal data as a current or former StepChange Trustee.

It covers what personal data we collect, how we use it, who we share it with and your rights.

We collect and use your personal data to support you in your role, meet legal and governance requirements, manage conflicts of interest and eligibility, and keep in contact with you.

A StepChange Trustee is an individual appointed as a trustee of the Foundation for Credit Counselling (the 'Charity'). Trustees are responsible for governing the Charity and are also company directors under applicable company law.

'Personal data' is any information that identifies you, either directly or indirectly. Some data may be more sensitive, such as health or diversity information.

2. Who is responsible for your personal data?

The Foundation for Credit Counselling (FCC), trading as StepChange Debt Charity and StepChange Debt Charity Scotland, is the parent company of Consumer Credit Counselling Service Voluntary Arrangements Limited (VA), trading as StepChange Voluntary Arrangements. Trustees are directors of FCC and may also be appointed as directors of VA.

Together, FCC and VA (the "Companies", referred to in this notice as "we", "us" or "our") act as Data Controllers for the purposes of this notice. We decide what personal data is collected, how it is used and how it is stored.

Only colleagues who need access to your data can see it. We have controls in place to ensure this.

Our Data Protection Officer oversees how we meet data protection requirements. Their contact details are in Section 12.

3. Where do we collect your personal data from?

We usually collect your data directly from you.

We may also collect data, during your time as a trustee, from regulators or public bodies where required, and through technology we provide to you, or that you use to access our systems, such as IP address information.

4. What personal data do we collect about you and why?

We only collect data relevant to your role as trustee. This may include contact and biographical details, CVs, skills and experience information, communications, meeting records, governance records, financial details relating to expenses or payments, optional diversity information and, where needed, sensitive information where needed to support you in your role.

We process your personal data to meet our legal obligations relating to trustees and directors, and for our legitimate interests in managing and supporting trustees and the governance of the Companies.

Where sharing information with us is optional, we will make this clear.

5. Recruitment and appointment

If you apply to become a trustee, we will use your personal data to assess your suitability for the role, arrange interviews and meetings, carry out necessary checks, understand any support requirements and meet legal or regulatory obligations.

We may collect this data directly from you (for example, application forms or CVs), from referees, recruitment partners, regulators and publicly available records.

If you are appointed, your data will continue to be used in line with this notice; if not, it will be retained in line with our retention policy.

6. Who do we share your personal data with and why?

We only share your data where necessary, including where we have a legitimate business reason, a legal obligation, a contractual requirement or your consent.

This may include sharing information with regulators, government bodies, auditors and legal advisors, law enforcement agencies where required, organisations that carry out governance, due diligence or director verification checks and service providers who support our governance and board management processes.

We may also share your personal data if you have asked us to or told us we can.

We will keep records of what has been shared and why.

7. Do we carry out any Trustee vetting checks?

We may carry out checks before and during your appointment to confirm your suitability as a trustee. These checks may include the Disclosure and Barring Service (DBS), the Credit Industry Fraud Avoidance System (CIFAS), the Insolvency Register, the Companies House disqualified directors register, and the Charity Commission's register of individuals removed or disqualified from acting as charity trustees.

These may involve sharing basic details such as your name and date of birth.

The results may affect your ability to act as a trustee for the Charity.

8. How long will we keep your personal data for?

We keep your data in line with our record retention policy.

In most cases, personal data is retained for six years after you leave your role. Some governance records, including board and committee records, may be retained for longer where required for legal or regulatory purposes.

If you agree to take part in StepChange events and publicity, photographs and videos may be recorded as part of this. If you are participating in any of these activities, you should read our Events & Publicity Privacy Notice.

9. How do we keep your personal data secure?

We take appropriate technical and organisational measures to keep your data secure.

Access is limited to those who need it and all our colleagues and contractors are subject to confidentiality requirements.

We regularly review our security controls and have processes in place to respond to any breaches.

10. Will we transfer any of your personal data outside of the UK?

We may transfer your data outside the UK where necessary, for example when suppliers store data overseas.

Where we do this, we ensure appropriate safeguards are in place in line with UK data protection law.

11. What are your data protection rights?

You have rights over your personal data, including the right to access, correct, delete or transfer your data. You also have the right to restrict or object to how we use it.

To make a request, contact DPO@stepchange.org.

We may need you to share extra details so we can confirm your identity and understand what you need from us.

In most cases, we will respond within one calendar month. We will let you know if there's any delay.

12. How can you complain about how we use your personal data?

If you are unhappy with how we have used or handled your personal data, or if you are unhappy with how a data protection request was handled, please email DPO@stepchange.org with details.

You can also contact the Information Commissioner's Office (ICO), the UK's Data Protection regulator:

• Website: (www.ico.org.uk)
• Telephone: 0303 123 1113.

Please note that the ICO expects you to raise concerns with us first where possible.

13. Will we tell you about any changes in how your personal data is used?

We reserve the right to update this privacy notice at any time.

We will let you know about significant changes where appropriate.

We will only use your personal data for the reasons we collected it, unless we reasonably believe we need to use it for a compatible purpose. If this happens, we will explain why.