This privacy notice explains how the London Borough of Bromley (the council) will collect, use and protect your personal data in order to deliver the operation shielding, volunteering and assistance programme (commencement 17 March 2020). The use and protection of your personal data under this scheme is governed by the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA).

Personal data

Your personal data is any information that relates to you as a living individual from which you can be identified. This includes your name, address, email, mobile or landline telephone number through to IP addresses, a biometric identifier or a photograph.

For this scheme, we will only collect basic personal information about you that will not include any special categories (sensitive personal data). It will however include:

  • Your name
  • A contact telephone number
  • A contact email address
  • Your date of birth
  • Your address
  • Details of DBS training (if applicable to you)
  • Details of whether you hold a driving licence  
  • A photograph (only if you consent to this for publicity purposes)

Why we need the information

Under the GDPR and DPA the council will be the personal data controller- this means it decides how your data is lawfully used and for what purposes. We require the data to administer this programme, once you request to be a part of it.

The legal basis for processing your data by the council as a public authority will be met under Article 6 (e) of the GDPR: The processing is necessary for us to perform a task in the public interest and as part of our official functions, both of which have a clear basis in law.  Part of the collection and processing your data will also be met under Article 6 (a) of the GDPR: The data subject has given consent to the processing of his or her personal data for one or more specific purposes.

In line with the provisions of Article 6 (a) the council shall ask for your specific consent to both share your personal data with its partners and to take a photograph of you, via you positively opting into this arrangement. Should you not choose to give us your consent, this part of the process will be non-applicable to you.

What we use the data for

Once we have collected your personal data, the council will share this with Community Links Bromley (CLB) and their partners Bromley Well, to enable them to match you with a client that needs assistance through the Volunteer Hub and to ensure the effective ongoing management of volunteers and clients.

We will also use your personal data to keep you updated on any news about the scheme via email bulletins and newsletters.

Change of purpose

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. We may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

How we protect your personal data

We comply with our obligations under the GDPR and DPA by minimising personal data; keeping personal data up to date; storing and destroying it securely and in a timely way; not collecting or retaining excessive amounts of data; protecting personal data from loss, misuse, unauthorised access and disclosure, and by ensuring that appropriate technical and organisational measures are in place to protect personal data. Where necessary, we implement appropriate network access controls, user permissions and encryption to protect data.

We will not as part of this scheme, transfer any of your personal data outside of the UK. Your data will not be subject to any automated profiling or decision making.

More information can be found on our data protection policy

How long we keep your data

Bromley Council aims to retain your personal details for 2 years after the cessation of the COVID-19 Wave 1 council volunteering programme (31August 2020), and after the Covid-19 pandemic is declared to have ended in the UK. Due to the uncertainty surrounding the duration of the Covid-19 pandemic, this end date for data retention will be subject to regular review in line with government advice.

Your data will be retained for the following reasons:

For the investigation of any complaints received about a service, should any arise.

If the scheme should need to be reactivated at any point following a pause in its operation, such as there being a further spike in Covid-19 cases within the borough or nationwide, where we may need to mobilise volunteers again at short notice to assist.

 At any point, however, you may ask for your personal data to be removed from the programme (please see your rights section).

After the data retention period has passed your personal data will be destroyed, with all electronic copies deleted off both live and backup systems, and any paper copies shredded.

Anonymised data may be held beyond the lifetime of the scheme for statistical and research purposes only.

Storage and retention

We store our information about volunteers within the UK only. We will only use and store personal information for as long as it is required for the purposes it was collected for.

Failure to provide information

If you do not provide certain information when requested, we may be unable to deliver on some elements of the volunteering arrangement or, in some circumstances, to comply with our legal obligations (i.e. health and safety of our volunteers, workers or residents). In such instances we will inform you about the implications of the decision and whether we are able to continue with the volunteering arrangement.

Your rights

Unless subject to an exemption under the GDPR and the DPA, you have the following rights with respect to your personal data:

a. to request access to information about and a copy of your personal data via a subject access request;

b. to request that we rectify any personal data if it is found to be inaccurate or out of date;

c. to request that your personal data be erased in certain circumstances;

d. to withdraw any consent to processing which you have given;

e. to request restriction of processing in certain circumstances;

f. to personal data portability i.e. to request a transfer of your personal data;

g. to object to processing in certain circumstances;

If you wish to make a request, you can:

Should you choose to submit your request via any other method other than the ones above please note that we may ask for positive identification.

Reviews and complaints

If you are unhappy at any point with the way that we processed your personal data and/or responded to a data request you have the right to complain to the council and/or the supervisory body the Information Commissioners Office (ICO). We suggest you raise your concerns via the following method: 

Stage 1 - Please contact the person who sent the response to your request.  It may be that we can resolve the issue there and then. 

Stage 2 - If you remain dissatisfied, you can request a review through the person who sent the response to your request.  Your appeal will be directed to a member of the council's legal team for consideration. 

Stage 3 - If you are unhappy with the outcome of the review, you can contact the ICO which investigates complaints about public bodies' handling of personal data and information requests.

In any case we will aim to respond within 30 days. 

Bromley Council keeps its privacy information under regular review, and any updates are communicated to the relevant parties.

Contact details

Bromley Council Data Protection Officer

Address: Civic Centre, Stockwell Close, BR1 3UH


Information Commissioners Office*

Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF


Telephone: 0303 123 1113


*The ICO have advised that their offices are now closed due to COVID-19 as a precautionary measure. It is best to contact them via their helpline or forms on their website.

Changes to this privacy notice

We reserve the right to update this privacy notice at any time, and we will provide you with access to a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.