Employee and volunteer privacy policy

In this policy, whenever you see the words ‘we’, ‘us’, ‘our’ or ‘National Trust', it refers to The National Trust for Places of Historical Interest or Natural Beauty. Our ICO registration number for National Trust is Z5945928. You’ll find further information on our legal status, charitable and investment activities, and associations in our privacy policy for supporters on our website.

If you have any questions relating to this privacy policy or how we use your personal data, please email them to dpo@nationaltrust.org.uk or post them to:

Data Protection Officer,
National Trust,
Heelis,
Kemble Drive,
Swindon,
SN2 2NA.

Personal data or personal information refers to any information which identifies you, or which relates to you.

During the application and recruitment process, we will collect, store and use the following types of personal data in order to:

• to assess your application and manage the selection process

• to support our obligations with regards to equality and diversity

• to provide any reasonable adjustments you may need

• to confirm your right to work in the UK and your driving licence (where applicable).

• to carry out pre-employment background checks including, when relevant, of public facing social media accounts and employment related history

• to collect references from third parties including former employers, schools or colleges or credit reference agencies. Personal data may also be collected from the Disclosure and Barring Service (DBS) or Access NI when undertaking necessary DBS checks. This is in collaboration with official authorities where we have a lawful basis to do so under the UK General Data Protection Regulation (UK GDPR) or Data Protection Act 2018.

• if successful, to share your information with our Trustees or Managers of pension arrangements operated by the Group company.

During the time you work with us, we typically process the following types of personal data:

• Contact details such as your name, title, address(es), telephone numbers and personal email addresses

• Date of birth

• Gender

• Marital status

• Next of kin

• Emergency contact information

• National Insurance number

• Bank account details, payroll records and tax status information

• Salary, annual leave, parental or maternity leave

• Military Reservist leave, pension and benefits information

• Start date and, if different, the date of your continuous employment

• Leaving date and your reason for leaving

• Location of employment or workplace

• Copy of your ID documentation, such as your driving licence or passport

• Recruitment information (including copies of right to work documentation, references and other information included in a CV or cover letter or as part of the application process)

• Employment records (including job titles, work history, working hours, holidays, training records and professional memberships)

• Compensation history

• Performance information

• Disciplinary and grievance information

• CCTV footage and other information obtained through electronic means such as swipe card records

• Photographs or other images of yourself

• Results of HMRC employment status checks, details of your interest in and connection with the intermediary through which your services are supplied

• Records about your use of our information and communications systems, for example, internet usage in accordance with our Policies and Guidelines accessible to employees on National Trust’s intranet.

• We may collect special category personal data and criminal offences data in some circumstances. Special category personal data includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data. For processing this type of information, we apply a higher level of protection, adding additional safeguards and thorough assurance. We only collect such information where necessary and where we have lawful grounds to do so under the UK General Data Protection Regulation (UK GDPR) and Data Protection Act (DPA 2018). We also have an appropriate internal Special Category Personal Data and Criminal Convictions Data Policy document in place, as required by data protection legislation. See the Rulebook instruction on data protection and information security, accessible to employees on National Trust’s intranet.

The types of special category personal data and criminal offence data that we may collect, store and use, where required, include the following:

• Information about your race or ethnicity, religious or philosophical beliefs, sexual orientation, gender identity, trade union memberships and political opinions

• Information about relevant criminal convictions and offences through DBS or Access NI checks or as otherwise notified to us

• Information about your health, including pregnancy or accessibility needs, medical condition(s) or sickness records (including for the purposes of pensions and permanent health insurance), for example:

  • Details of any absences recorded
  • Reasons for leaving our employment or otherwise ceasing to work for us if related to ill-health, injury or disability
  • Accessibility or dietary requirements, including reasonable adjustments
  • Occupational health records
  • Details of any health conditions or disabilities which may affect your ability to work for us (so that we can make sure we can support you and provide adjustments for you).

We may also collect, use and share aggregated data such as statistical or demographic data. Aggregated data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity.

We collect personal data initially about our Employees through the application and recruitment process. The information is provided either directly from candidates or sometimes from recruitment agencies, background check providers and/or former employers.

We will collect additional personal data in the course of job-related activities throughout the period of you working for us. You may give us your personal data directly by filling in forms or by corresponding with us by phone, email or otherwise. Additionally, information you enter onto our systems and devices will be stored and processed by us. This will include any emails or other electronic messages and any documents, photos or other files stored or processed through our systems or devices. Please be aware that by entering information onto these systems you are sharing that information with us.

We may sometimes collect additional information from third parties including but not limited to tax and regulatory authorities such as HMRC, credit reference agencies, agencies who provide criminal background checks such as the DBS and Access NI, other background check agencies and publicly available resources including personal information that you make publicly available on social media. We may also collect personal data from the trustees or managers of pension arrangements operated by a group company.

If you fail to provide personal data

If you fail to provide full or accurate information when requested, we may not be able to fulfil any contract with you (such as paying you or providing a benefit), or we may be prevented from complying with our legal obligations (for example, ensuring the health and safety of our workers).

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• To perform or enter into a contract with you (for example, an employment contract)

• Where necessary for legitimate interests (whether those of the individual, the National Trust or a third party) and your interests and fundamental rights do not override those interests

• To comply with a legal obligation

• To protect your vital interests (or someone else’s vital interests), for example where you are physically or legally incapable of giving consent.

• In limited circumstances, we may process personal data on the basis of your consent although this will be drawn to your attention at the time if relevant.

We need to have further justification for collecting, storing and using any special category personal data and criminal offence data. In line with our dedicated policy document, we may process special category personal data and criminal offence data in the following limited circumstances, as applicable:

• With your explicit written consent

• To meet our legal obligations or to exercise necessary rights in the field of employment and social security, for example right to work criteria and ensuring that we meet our employment and financial legal obligations

• In line with substantial public interest conditions, such as for the purposes of equality of opportunity and treatment

• To enable us to appropriately deal with legal claims

• To protect your vital interests (or someone else's vital interests), for example where you are physically or legally incapable of giving consent

• Where you have already made the information public

• For the purposes of aggregated reporting such as gender pay gap data.

We rely on the following lawful bases to process your personal data and we’ve included details of our legitimate interests where appropriate. Please note that we may rely on more than one lawful basis depending on the specific purpose(s) for which we are using your data. Please contact us if you need details about the specific lawful ground we are relying on to process your personal data where more than one ground has been set out in the table below.

Purpose/ Processing Activity	Lawful basis for processing including basis of legitimate interest where applicable
Making a decision about your recruitment or appointment for a role.	Necessary steps to enter into a contract / performance of a contract.
Conducting pre-employment checks, including confirming the existence of any unspent criminal convictions, Right to Work in UK evidence, references.	Necessary to comply with a legal obligation. Necessary for performance of a contract.
Engaging you as an Employee, including determining the terms of that engagement.	Necessary for performance of a contract.
Exercising our rights and fulfilling our obligations under the terms of the contract we have entered into with you.	Necessary for performance of a contract.
To comply with our safeguarding obligations, including when undertaking DBS checks.	Necessary to comply with a legal obligation.
Paying you. If you are an employee or deemed an employee for tax purposes, deducting tax and National Insurance contributions. This includes compliance with County Court and other relevant judgments.	Necessary for performance of a contract. Necessary to comply with a legal obligation.
Administering benefits and providing your benefits to you. Please note that this may include administering benefits such as statutory maternity pay, statutory sick pay, pensions and permanent health insurance. This may require the processing of special category personal data including information about a disability status or your physical or mental health or condition in order to exercise rights and perform obligations in connection with the work that you do for us.	Necessary for performance of a contract. Necessary to comply with a legal obligation.
Enrolling you in a pension arrangement in accordance with our statutory automatic enrolment duties.	Necessary to comply with a legal obligation.
Liaising with the provider of the defined contribution (DC) pension arrangement operated by a group company, your pension provider and any other provider of employee benefits. Please note, legacy defined benefit (DB) scheme is covered by a separate privacy policy operated by the pension scheme Trustee.	Necessary for performance of a contract.
Business management and planning, including accounting and internal or external auditing.	Necessary for our legitimate interests to allow us to administer our business effectively.
Conducting appraisals and performance reviews, managing performance and determining performance requirements.	Necessary for performance of a contract.
Making decisions about salary reviews and compensation.	Necessary for performance of a contract.
Assessing qualifications for a particular job or task, including decisions about promotions. Identifying individual education, training and development requirements and providing the platform and the tools to undertake the most appropriate professional development.	Necessary for performance of a contract. Necessary for our legitimate interests to ensure our employees are effectively managed and qualified for required tasks.
Gathering evidence for possible grievance or disciplinary hearings. Dealing with any complaints received, including whistleblowing complaints that are not recorded through our anonymous channels. We may need to process special category personal data (for example, information about a disability status or your physical or mental health) for this purpose to exercise rights and perform obligations in connection with the work you do for us.	Necessary to comply with a legal obligation. Necessary for performance of a contract. Necessary for our legitimate interests to ensure our employees are properly informed and supported throughout their engagement with the Trust.
Making decisions about your continued employment or engagement and, where relevant, making arrangements for the termination of your employment or engagement, including redundancy. This may require sharing information including special category personal data with an employee’s solicitor/representative, insurer, trade union representative, ACAS or the Tribunal Service.	Necessary for performance of a contract. Necessary for our legitimate interests to ensure our employees are effectively supported. Explicit Consent.
Dealing with legal disputes involving you, or other employees, workers and contractors, including accidents at work. We may need to process special category personal data for this purpose where processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity.	Necessary to comply with a legal obligation. Necessary in our legitimate interests to deal appropriately with prospective or actual legal claims.
To ensure your health and safety in the workplace, to assess your fitness to work and to provide appropriate workplace adjustments. This may require the processing of special category personal data, including information about a disability status or your physical or mental health, in order to exercise rights and perform obligations in connection with the work you do for us.	Necessary to comply with a legal obligation. Necessary in our legitimate interests to provide a safe workplace for Employees.
To monitor and manage sickness absence. This may require the processing of special category personal data, including information about a disability status or your physical or mental health, in order to exercise rights and perform obligations in connection with the work you do for us.	Necessary for performance of a contract. Necessary to comply with a legal obligation.
To carry out regular health surveillance and make referrals (where appropriate) to our occupational health service. This may require the processing of special category personal data, including information about a disability status or your physical or mental health, in order to exercise rights and perform obligations in connection with the work you do for us.	Necessary for performance of a contract. Necessary to comply with a legal obligation.
To detect and prevent fraud.	Necessary to comply with a legal obligation. Necessary in our legitimate interests to detect and prevent fraudulent activities.
To monitor your use of our information and communication systems to ensure compliance with our IT policies. To ensure network and information security, including preventing unauthorised access to our computer and electronic communications systems and preventing malicious software distribution. To administer and protect our business and our website (including troubleshooting, data analysis, testing, system maintenance, support, reporting, hosting and migration of data). To perform due diligence and testing to support our cyber resilience including forensic investigation activities by authorised specialist organisations as required.	Necessary for performance of a contract. Necessary for our legitimate interests to ensure that our systems are used appropriately.
To record meetings where necessary and when notified to attendees to provide a referenceable resource for individuals who are unable to attend, to document decisions and actions or where requested for reasonable adjustment purposes.	Necessary for our legitimate interests to effectively evidence meeting content, outcomes and actions.
To send you employee surveys, or to invite a third party to send you a survey about your employment with the National Trust, and to analyse the results of such surveys. In order to fulfil our legal obligation for Equality of Opportunities and Diversity.	Necessary for our legitimate interests to effectively manage our employees and to identify areas where improvement or further engagement may be required. Necessary to comply with a legal obligation.
To conduct data analytics studies to review and better understand Employee retention and attrition rates, employee Performance Development Review (PDR) scores, sickness, grievances and staff surveys.	Necessary for performance of a contract.
Equal opportunities and diversity. We will use information about your age, disability, gender, gender identity, sexual orientation, race, religion or belief, to ensure meaningful equal opportunity monitoring and reporting.	Necessary for performance of a contract. Necessary to comply with a legal obligation.
To send communications to you, including where required as part of your employment, or as part of your employee journey with us.	Necessary for performance of a contract. Necessary for our legitimate interests to ensure that you receive the information required in exceptional circumstances e.g. pandemic.
To send marketing communications to you about National Trust offers, products, services, membership and properties generally and, where relevant and applicable, about our third-party partners.	On the basis of your consent.
To respond to reference requests from prospective employers, landlords and financial institutions. This may involve some pay, health and contract status questions.	Necessary for performance of a contract. Necessary to comply with a legal obligation. Necessary for our legitimate interests to assist our Employees with references where required.
To share personal data with approved National Trust partners in relation to joint projects or initiatives that you may be involved with.	Necessary for our legitimate interests to engage in joint projects and initiatives with National Trust partners.
To provide support to individuals asking questions and sharing information, enquiries and complaints received via different channels including but not limited to social media and phone calls (that may be recorded).	Necessary for our legitimate interests to ensure that we can provide you with effective support.
To capture photographs, film or audio recordings of you to promote the Trust’s charitable and commercial interests including via printed products, social media, TV or digital channels. This may include sharing with National Trust partners, funding providers or sub- licensing to third parties.	Necessary for our legitimate interests to share the benefits of working at the National Trust to a wider audience. On the basis of your consent.
To capture and share content on recording platforms, such as webinars, lectures, meetings.	Necessary for our legitimate interests to promote the Trust’s charitable interests and for development purposes.
Some of our properties and events have image and audio recording devices such as CCTV and you may be recorded as part of your role; this is to provide security and protect our employees, members and visitors. We have appropriate signage at our properties where CCTV and other similar devices are being used.	Necessary for our legitimate interests to ensure that our properties and people are secure.

Automated decision-making takes place when an electronic system uses personal data to make a decision without human intervention.

At the National Trust, automated decision-making is only performed in limited circumstances in relation to recruitment. Personal data is processed in order to support with assessment and selection of some National Trust roles where we may use an online “strengths based” assessment questionnaire. Detailed explanation about this process will be provided at the point of application.

Applicants can choose to opt out of this automated decision-making process and apply in an alternative way. More information about this process can be obtained by emailing recruitmentenquiries@nationaltrust.org.uk.

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes for which we collected it. To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other authorised requirements.

We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

Details of retention periods for different aspects of your personal information are available on Acorn within our retention schedule or you can email the Records and Archives team on RecordsandArchives@nationaltrust.org.uk.

For the purposes set out in the ‘Why do we collect this information?’ section above, we may share your personal information with the categories of recipients listed below. These may be acting as approved data processors, joint or independent controllers in their own right:

• Third-party service providers to provide the following activities: payroll, pension administration, benefits provision, whistleblowing, driver eligibility checks, health surveillance, occupational health provision and administration, training, case management and IT services (including support and hosting);

• Government agencies, for example HMRC for tax purposes;

• Other entities in the National Trust Group (National Trust Enterprises and Historic House Hotels);

• Your participation in any pension arrangement operated by a Group company may be shared with the Trustees or Scheme Managers of the arrangement to allow the relevant administration;

• Online survey providers, such as WTW, appointed to perform analysis and research connected with your employment;

• Our Trustees, to the extent required to allow them to fulfil their functions and responsibilities as Trustees;

• Solicitors or insurers acting on behalf of employees or the Trust, ACAS, Tribunal system;

• Prospective employers, landlords and financial establishments seeking references.

Additionally, we may disclose your personal information to the relevant third party:

• In the event that we sell or buy any business or assets, including in relation to any of our Group companies, your personal data will be disclosed to the prospective seller or buyer of such business or assets

• If we dispose of or acquire any assets, which may include properties, leases, or visitor attractions, we may be required to share personal data with the person or organisation disposing of or acquiring those assets

• In the event of our transfer or restructure of our assets or otherwise

• If we are under a duty to disclose or share your personal data in order to comply with any legal obligation such as police enquiries, or in order to enforce or apply our terms of use and other agreements;

• If we are under an obligation to protect the rights, property, or safety of our supporters, our regulators (including the Charity Commission, the Information Commissioner’s Office or the Fundraising Regulator), or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and prevention of money laundering and credit risk reduction.

The sharing of special category and sensitive data will be done in limited circumstances and will only be done when we have a valid purpose and after ensuring the appropriate safeguards are in place.

We take your safety and security very seriously and are committed to protecting your personal and financial information. All information kept by us is stored on our secure servers. We have a robust process for assessing, managing and protecting all of our new and existing systems to ensure they are up to date and secure.

Where we have given you (or where you have chosen) a password that enables you to access certain parts of our National Trust website, you are responsible for keeping this password confidential. We ask you not to share your password with anyone. More information can be found on the National Trust’s intranet page ‘Passwords and access to Trust IT systems and services’.

When we receive, store or transmit your information, we will use strict procedures and security features to prevent any unlawful destruction, loss, unauthorised disclosure of, or access to your personal data held in our care.

Further information on how to process personal data securely can be found within the ‘How to Guide - Data Security Responsibility’ page accessible to employees on the National Trust’s intranet.

In addition to this privacy policy, we may provide additional information at the point of data collection informing you of the lawful basis, the purpose and retention periods that apply where the National Trust is processing your personal data.

You have the following rights in relation to our processing of your personal data. You can exercise these rights at any time using the contact details below:

• You can withdraw your consent at any time, where the processing of your personal data is based on consent
• You can object to the processing of your personal data - where it is processed on the basis of legitimate interests - provided that there are no compelling reasons for that processing
• You can object to the processing of your personal data for direct marketing purposes
• You can request access to copies of your personal information that we process. This is commonly known as a “subject access request”
• You can ask for information we process about you to be corrected if it is inaccurate or incomplete, although we may need to verify the accuracy of the new data you provide to us
• You can ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see above), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request for specific legal reasons which will be notified to you, if applicable, at the time of your request
• You can ask for the processing of your personal data to be restricted in the following circumstances:
  • The accuracy of the data is contested and you want us to confirm the accuracy of that data that we hold;
  • Where the processing is unlawful but you do not want us to erase it;
  • Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or
  • You have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
• You can ask for “data portability” (the transfer of your personal data to you or a third-party in certain circumstances). We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you
• You have the right not to be subject to a decision based solely on automated processing, this might include the right to obtain human intervention, the right to present your point of view and the right to challenge the decision made by automated processing.

Should you wish to exercise any of the individual rights listed above please let us know by emailing us at dpo@nationaltrust.org.uk, or by writing to:

Data Protection Office,
National Trust,
Heelis,
Kemble Drive,
Swindon,
SN2 2NA

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

In the event that you are not satisfied with our processing of your personal data, you have the right to lodge a complaint with the relevant supervisory authority, which is the Information Commissioner’s Office (ICO) in the United Kingdom, at any time.

The National Trust website may include links to third-party websites, plug-ins and applications. We will indicate where a website link will connect to a third-party page. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. We encourage you to read the privacy policy of every website you visit.

We use YouTube API services to display video across our website. By viewing videos on our website, you agree to be bound by third party terms of service, for example: Vimeo Terms of Service, YouTube Terms of Service. Find out more information on Google Privacy policy.

We’ll amend this privacy policy from time to time to ensure it remains up to date and accurately reflects how and why we use your personal data. The current version of our privacy policy will always be posted on our employee intranet and www.nationaltrustjobs.org.uk

This privacy policy was last updated on 1 October 2024.

Questions, comments and requests regarding this privacy policy are welcomed and should be addressed to our dedicated Data Protection Office. Please contact us via email on dpo@nationaltrust.org.uk or by post at the following address and we'll do all we can to assist:

Data Protection Office,
National Trust,
Heelis,
Kemble Drive,
Swindon
SN2 2NA

Personal data or personal information refers to any information which identifies you, or which relates to you. The information may be collected from you directly or from partner or corporate organisations that you engage with as a volunteer.

We collect personal data about volunteers through the application process to become a National Trust volunteer (including from any reference requests or driver eligibility checks). We also collect personal data over the course of an individual’s time volunteering with us.

Personal data may also be collected from the Disclosure and Barring Service (DBS) or Access NI when undertaking appropriate DBS checks for roles where a check is required. This is in collaboration with official authorities where we have a lawful basis to do so under the UK General Data Protection Regulation (UK GDPR) or Data Protection Act 2018.

We may collect, store and use the following categories of personal information depending on your volunteer journey with us:

• Personal contact details such as name, title, addresses, telephone numbers and personal email addresses.

• Date of birth.

• Gender.

• Emergency contact information.

• Financial information such as bank account details (when necessary to claim expenses).

• Start and end dates of your period of volunteering with us.

• Your reason for leaving, should you choose to stop volunteering with us.

• Preferred volunteer location(s).

• ID documentation (such as a copy of your driving licence if you drive as part of your volunteering activity).

• Information about any complaints or issues raised by yourself or others relating to your volunteering, including any subsequent appeals.

• CCTV footage and other personal information obtained through electronic means such as swipe card records.

• Records about your use of our information and communications systems – for example our dedicated volunteering system(s) in line with our policies.

• Photographs, film and / or audio footage.

• The relationship you have to other volunteers (such as whether you live at the same address, or whether you volunteer to support a relative).

We may collect special category personal data and information about criminal convictions and offences where necessary in connection with your volunteering journey. Special category personal data includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data.

The types of special category personal data and criminal offence data that we collect about you may include the following.

• Information about your health, including pregnancy or accessibility needs and any medical condition(s) or sickness records for example:

  • Absence from volunteering due to sickness or other reasons

  • Accessibility or dietary requirements

  • Reasons for leaving volunteering if related to ill-health, injury or disability

  • Details of any health conditions or disabilities which may affect your ability to volunteer with us (so that we can make sure we can support you and provide adjustments for you)

  • Information about your race or ethnicity, religious beliefs, sexual orientation and political and philosophical beliefs

  • Information about relevant criminal convictions and offences through DBS or Access NI checks or as otherwise notified to us from time to time.

Further information can be found on the Special Category Data and Criminal Convictions Data Policy (please contact your Volunteering Manager or the Data Protection Office to request a copy).

For children and young people volunteers under the age of 18, we require parental/legal guardian consent prior to processing their data and request that they be accompanied by a responsible adult if volunteering under the age of 16. When communicating with children, the National Trust will ensure we are transparent about how we use their personal data using plain, clear language that they can understand.

We may also collect, use and share aggregated data such as statistical or demographic data for any purpose. Aggregated data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. However, if we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy policy.

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• Where it is necessary for our legitimate interests (or those of an authorised third party) and your interests and fundamental rights do not override those interests.

• Where we have your consent to process your personal data.

• Where we need to comply with a legal obligation.

• Where we need to perform an agreement we are about to enter into or have entered with you.

• We may also use your personal data where we need to protect your vital interests (or someone else’s vital interests), although such situations will be rare.

We need to have further justification for processing special category personal data and criminal offence data. We have in place an appropriate policy document and safeguards as per our legal requirements.

We may process special category personal data in the following circumstances:

• With your explicit written consent.

• For the purposes of equality of opportunity and treatment.

Less commonly, we may process this type of personal data in relation to legal claims; where it is needed to protect your vital interests (or someone else's vital interests) and you are not capable of giving your consent; or where you have already made the information public.

You will find descriptions below of how we may use your personal data, and which lawful grounds we rely on to do so. We have also identified what our legitimate interests are where appropriate. Note that we may process your personal data with more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific lawful ground that we are relying on to process your personal data where more than one ground has been set out in the table below.

If you fail to provide certain information when requested, we may not be able to continue support of your volunteering journey with us or we may be prevented from complying with our legal obligations (for example, ensuring the health and safety of our volunteers).

Purpose/Processing Activity	Lawful grounds for processing including basis of legitimate interest where applicable
Engaging with you as a volunteer, including determining the terms of your volunteering role with us. We may need to process special category personal data for this purpose to exercise rights and perform obligations in connection with your volunteering journey.	Necessary for the performance of the volunteering agreement. Necessary for our legitimate interests to engage volunteers to support our charitable aims and objectives.
To adhere to the National Trust’s confidentiality and copyright mandate.	On the basis of your consent to maintain confidentiality in regards to any commercial and sensitive material and copyright during your volunteer role.
To comply with our safeguarding obligations, including undertaking DBS checks for certain volunteer roles.	Necessary to comply with a legal obligation. Necessary for our legitimate interests to fulfil our safeguarding obligations.
Providing volunteers with relevant training for their role.	Necessary to comply with a legal obligation. Necessary for our legitimate interests to ensure that our volunteers receive the correct training and skills.
Supporting you as an active volunteer. This includes volunteer management, planning, recording and amending rotas as required. We may need to process special category personal data for this purpose to exercise rights and perform obligations in connection with your volunteering journey.	Necessary for the performance of the volunteering agreement. Necessary to comply with a legal obligation. Necessary for our legitimate interests to ensure our volunteers are managed effectively.
Gathering evidence and feedback to help us manage and resolve any concerns or incidents that may occur during your volunteering. We may need to process special category personal data for this purpose to exercise rights and perform obligations in connection with your volunteering journey.	Necessary to comply with a legal obligation. Necessary for our legitimate interests to ensure our volunteers are effectively managed.
To help us make decisions about your volunteering roles, including ending the volunteering relationship or your role(s) if necessary. We may need to process special category personal data for this purpose to exercise rights and perform obligations in connection with your volunteering journey.	Necessary for the performance of the volunteering agreement. Necessary to comply with a legal obligation. Necessary for our legitimate interest to ensure our volunteers are effectively managed.
Dealing with legal disputes involving you, or other individuals. We may need to process special category personal data for this purpose as required for the exercise, establishment, or defence of legal claims.	Necessary to comply with a legal obligation.
To ensure your health and safety during your volunteering, and to provide reasonable adjustments to enable you to volunteer. This might require processing special categories of data.	Necessary to comply with a legal obligation.
To monitor your use of our information and communication systems such as myvolunteering or yourvolunteering (where used) to ensure compliance with our IT policies and promote network and information security, including preventing unauthorised access to our electronic devices, IT systems and preventing malicious software distribution. To perform due diligence and testing to support our cyber resilience including forensic investigation activities by authorised specialist organisations as required.	Necessary for our legitimate interest to ensure that our systems are used appropriately and in line with National Trust instructions.
To send you volunteer surveys, or to invite a third party to send and analyse a survey about your experience as a National Trust volunteer.	Necessary for our legitimate interests to effectively manage our volunteers and involve them in relevant surveys.
To process your responses to volunteer surveys, about your experience as a National Trust volunteer. This may be managed internally or by an authorised third party. We may need to process special category personal data for this purpose to exercise rights and perform obligations in connection with your volunteering journey.	On the basis of your explicit consent. Necessary to comply with a legal obligation. Necessary for our legitimate interests to effectively manage our volunteers and to identify areas where improvement or further engagement may be required.
To analyse the data that we hold in order to better understand the volunteering experience, e.g. how many volunteers leave the Trust or whether volunteers are giving more or less hours since the previous year.	Necessary for our legitimate interests to effectively understand and improve our volunteers’ experience and participation.
Equal opportunities monitoring. We may collect information about your age, gender, gender identity, sexual orientation, ethnic group, disability, religion or beliefs to ensure meaningful equal opportunity monitoring and reporting.	Necessary for our legitimate interests to ensure our volunteers are treated inclusively and fairly. Necessary to comply with a legal obligation. On the basis of your explicit consent.
To send communications to you, including where required as part of your volunteering role, or as part of your volunteering journey. We have included further information below on the types of communications that we send to volunteers.	Necessary for our legitimate interests to ensure that you receive relevant information. Necessary to comply with a legal obligation. On the basis of your consent.
To capture photographs, film or audio recordings of you to promote the Trust’s charitable and commercial interests including via printed products, social media, TV or digital channels. This may include sharing with National Trust partners, funding providers or sub- licensing to third parties	Necessary for our legitimate interests to share the benefits of working at the National Trust to a wider audience. On the basis of your consent.
To capture and share content on recording platforms, such as webinars, lectures, meetings.	Necessary for our legitimate interests to promote the Trust’s charitable interests and for development purposes.
Some of our properties and events have image and audio recording devices such as CCTV and you may be recorded as part of your role; this is to provide security and protect our volunteers, employees, members and visitors. We have appropriate signage at our properties where CCTV and other similar devices are being used.	Necessary for our legitimate interests to ensure that our properties and people are secure.
To review and process your expense claims.	Necessary to perform our obligations under our volunteering agreement. Necessary to comply with a legal obligation.

We may send our volunteers two types of communications:

Service Communications

• These include communications which you need to receive as part of your role as a National Trust volunteer – such as, but not limited to:
  • updates about your volunteer journey or experience
  • volunteer rotas
  • expenses
  • training communications
  • important National Trust operational updates.
• In general, we send Service Communications to volunteers on the basis that they are necessary in our legitimate interests to manage your volunteering activity and ensure that you receive the information required to be an effective volunteer. We may also send you communications where we are required to do so by law.

Marketing Communications

• These are communications about the National Trust generally. They don’t directly relate to your volunteering role with the National Trust. They could include communications about other National Trust properties, membership, fundraising, retail, holidays, events or other volunteering opportunities.
• We will only send you Marketing Communications by electronic means (e.g. email or text message) where we have your consent to do so. We may send you Marketing Communications by other means (e.g. post) where we have a legitimate interest in doing so, for example to provide you with offers and promotions. You can opt out of Marketing Communications (or ‘direct marketing’) at any time as described in more detail below at “What are your rights?”.

We take your safety and security very seriously and are committed to protecting your personal and financial information, which is always kept securely. We have a robust process for assessing, managing and protecting all new and existing systems to ensure they are secure and up to date.

Where we have given you (or where you have chosen) a password that enables you to access National Trust systems or services, you are responsible for keeping this password confidential. We ask you not to share your password with anyone.

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes for which we collected it. This includes for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements.

We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other authorised requirements.

For the purposes set out in the ‘Why do we collect this information?’ section above, we may share your personal information with the categories of recipients listed below. These may be acting as approved data processors, joint or independent controllers in their own right:

• Third-party service providers such as: occupational health agencies, whistleblowing and insurers.

• IT services including carefully selected data processors that provide support and hosting of our systems, for example, Blackbaud (myvolunteering/yourvolunteering), PIMS (volunteering case management tool), WTW (online surveys), Skillsoft (training).

• Other entities in the National Trust Group (National Trust Enterprises and Historic House Hotels).

• Corporate or partnership volunteering managers.

• Our Trustees, to the extent required to allow them to fulfil their functions and responsibilities as Trustees.

Additionally, we may disclose your personal information to an authorised third party:

• If we dispose of or acquire any assets, which may include properties, leases or visitor attractions, we may be required to share personal data with the person or organisation disposing of or acquiring those assets.

• In the event of a transfer or restructure of our assets or otherwise.

• If we are under a duty to disclose or share your personal data to comply with any legal obligation, or in order to enforce or apply our terms of use and other agreements.

• If we are under an obligation to protect the rights, property, or safety of our customers, our regulators (including the Charity Commission, the Information Commissioner’s Office (ICO) or the Fundraising Regulator), or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and prevention of money laundering and credit risk reduction.

The National Trust’s operations are based in the United Kingdom and the majority of your personal data we hold is stored within the UK. We may transfer your data outside the UK. We will only do so in compliance with the law and where we ensure a similar degree of protection is afforded to it. We will ensure that one of the following safeguards is implemented:

• Transferring to countries that have been deemed to provide an adequate level of protection for personal data by the Information Commissioner’s Office and/or the UK government.

• Binding corporate rules, where applicable.

• Specific contractual clauses approved by the Information Commissioner’s Office and/or the UK government.

• Authorised certification for transfers to any countries not covered by the safeguards listed above.

Whenever your information is stored or transferred, we will use strict procedures and security features to prevent unauthorised access or disclosure of your personal data.

In addition to this privacy policy, we may provide additional information at the point of data collection informing you of the lawful basis, the purpose and retention periods that apply where the National Trust is processing your personal data.

You have the following rights in relation to our processing of your personal data. You can exercise these rights at any time using the contact details below.

• You can withdraw your consent at any time, where processing of your personal data is based on consent.

• You can object to the processing of your personal data where it is processed based on legitimate interests, provided that there are no compelling reasons for that processing (for example your wish to continue as an active volunteer with us).

• You can object to the processing of your personal data for direct marketing purposes.

• You can request access to copies of your personal information that we process. This is commonly known as a Subject Access Request (SAR).

• You can ask for information we process about you to be corrected if it is inaccurate or incomplete, although we may need to verify the accuracy of the new data you provide to us.

• You can ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see above), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request for specific legal reasons which will be notified to you, if applicable, at the time of your request.

• You can ask for the processing of your personal data to be restricted in the following circumstances:

  • The accuracy of the data is contested, and you want us to confirm the accuracy of that data that we hold,

  • Where the processing is unlawful, but you do not want us to erase it,

  • Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims, or

  • You have objected to our use of your data, but we need to verify whether we have overriding legitimate grounds to use it.

• You can ask for “data portability” (the transfer of your personal data to you or a third party) in certain circumstances. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

Should you wish to exercise any of the rights listed above, please let us know by contacting us by email at dpo@nationaltrust.org.uk, or by writing to:

Data Protection Office,
National Trust, Heelis,
Kemble Drive,
Swindon,
SN2 2NA.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights).

This is a security measure to ensure that your personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

If you are not satisfied with our processing of your personal data, you have the right to lodge a complaint with the relevant supervisory authority, which is the Information Commissioner’s Office (ICO) in the United Kingdom, at any time. The ICO’s contact details are available here: www.ico.org.uk/concerns.

We’ll amend this privacy policy from time to time to ensure it remains up to date and accurately reflects how and why we use your personal data. The current version of our Privacy Policy will always be posted on myvolunteering.

This privacy policy was last updated on 1 October 2024.

Questions, comments and requests regarding this privacy policy are welcomed and should be addressed to the Data Protection Office. You can contact us via email at dpo@nationaltrust.org.uk, or by post at the following address:

Data Protection Office,
National Trust,
Heelis,
Kemble Drive,
Swindon,
SN2 2NA.