Data Protection Policy

Policy Statement
TransformGen CIC is committed to protecting personal data and handling information responsibly, securely, and in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other relevant legislation.

We recognise the importance of privacy and data protection and are committed to ensuring that personal information is processed lawfully, fairly, and transparently.

Purpose of this Policy
This policy sets out how TransformGen CIC collects, stores, processes, protects, and manages personal data in the course of its activities.

The objectives of this policy are to:

  • Ensure compliance with data protection legislation
  • Protect the rights and privacy of individuals
  • Promote good information handling practices
  • Reduce the risk of data breaches and misuse

Scope
This policy applies to:

  • Staff
  • Volunteers
  • Trustees
  • Contractors and freelancers
  • Anyone processing data on behalf of TransformGen CIC

It applies to all personal data processed by the organisation, whether held electronically or in paper form.

Definitions
Personal Data
Any information relating to an identifiable living person.

Special Category Data
Sensitive personal data including information relating to:

  • Health
  • Ethnicity
  • Religious beliefs
  • Political opinions
  • Sexual orientation
  • Biometric or genetic data

Data Controller
TransformGen CIC acts as the data controller for the personal data it processes.

Data Protection Principles
TransformGen CIC will ensure that personal data is:

  • Processed lawfully, fairly, and transparently
  • Collected for specified, explicit, and legitimate purposes
  • Adequate, relevant, and limited to what is necessary
  • Accurate and kept up to date
  • Retained only for as long as necessary
  • Processed securely and confidentially

Lawful Basis for Processing
We process personal data under one or more lawful bases, including:

  • Consent
  • Contractual necessity
  • Legal obligation
  • Legitimate interests
  • Vital interests

Collection of Personal Data
We may collect personal data through:

  • Website forms
  • Emails and communications
  • Event registrations
  • Service applications
  • Volunteer or employment applications
  • Surveys and feedback
  • Cookies and analytics tools

Use of Personal Data
Personal data may be used to:

  • Deliver services and activities
  • Communicate with individuals
  • Manage participation and engagement
  • Process applications or enquiries
  • Improve services and website functionality
  • Meet legal and regulatory obligations
  • Maintain safeguarding and welfare responsibilities

Special Category Data
Where special category data is processed, we will ensure that:

  • There is a lawful basis and additional condition for processing
  • Data is handled with enhanced confidentiality and security
  • Access is restricted to authorised individuals only

Data Sharing
We do not sell personal data.
Data may be shared with trusted third parties where necessary, including:

  • IT providers
  • Website hosting services
  • Professional advisers
  • Regulatory authorities
  • Funding or partner organisations where appropriate and lawful

All third parties are expected to comply with data protection requirements.

Data Security
TransformGen CIC takes appropriate technical and organisational measures to protect personal data, including:

  • Password protection
  • Secure systems and software
  • Restricted access to data
  • Staff awareness and training
  • Secure disposal of records

Data Retention
Personal data will only be retained for as long as necessary for operational, legal, safeguarding, or regulatory purposes.

Records no longer required will be securely deleted or destroyed.

Data Breaches
Any actual or suspected data breach must be reported immediately to Chikodi Oraka -Data Protection Lead.
Where required, breaches will be reported to the Information Commissioner’s Office (ICO) within the relevant legal timescales.

Individual Rights
Under UK GDPR, individuals have the right to:

  • Access their personal data
  • Correct inaccurate information
  • Request deletion of data
  • Restrict or object to processing
  • Withdraw consent
  • Request data portability
  • Lodge a complaint with the ICO

Requests should be made in writing to:
chikodi@transformgen.com

Training and Awareness
Relevant staff and volunteers will receive appropriate data protection awareness and training.

Responsibility
All staff, volunteers, and trustees are responsible for complying with this policy and protecting personal information appropriately.

Policy Review
This policy will be reviewed annually or sooner if legislation or organisational activities change.

Approved by: Chikodi Oraka
Position: Director
Date: 17th May 2026
Review Date: 17th May 2027

Scroll to Top