Shelter Suite - User Agreement

Data Protection and GDPR Compliance Policy for Shelter Suite Users

Introduction

This policy is provided by Shelter Suite to guide all staff members of shelters and rescues who access personal data through the Shelter Suite CRM. It outlines key responsibilities and best practices to ensure that personal data is handled in compliance with the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018. All users of Shelter Suite must follow these guidelines to protect the personal data of adopters, fosterers, and others involved in rehoming animals.

1. Key Responsibilities of Shelter Staff (Users of Shelter Suite CRM)

As a user of Shelter Suite, you are responsible for:

• Protecting Personal Data: Ensuring that personal information (e.g., names, contact details, and animal-related data) is handled securely and only accessed when necessary for your role.
• Maintaining Confidentiality: Personal data must be treated as confidential. Do not share access credentials (usernames, passwords) or personal information with unauthorised individuals.
• Managing Data Subject Rights: Assisting your organisation in responding to requests from individuals (Data Subjects) for access, correction, or deletion of their data, as required by GDPR.

2. Data Handling Guidelines

2.1. Access to Personal Data

• Only access data that is necessary for your role.
• Ensure that your access credentials are kept secure and never shared with others.
• If you suspect that your credentials have been compromised, report it immediately to your administrator.

2.2. Accuracy of Personal Data

• Ensure that any personal data you enter or update in Shelter Suite is accurate and up-to-date.
• If you identify inaccuracies in the data, update or report them promptly.

2.3. Data Deletion and Retention

Personal data should not be kept longer than necessary. As per GDPR guidelines:

• Retention Period: Data should generally be retained for no longer than necessary for the purpose it was collected. For example, if an adoption process is completed, the personal data of the adopter should be reviewed for deletion or anonymisation unless needed for follow-up purposes.
• Deletion Requests: If a Data Subject (e.g., an adopter or fosterer) requests the deletion of their personal data, you must ensure this request is handled promptly. Ideally, the data should be deleted within 30 days of the request.
• Ongoing Reviews: Periodically review the personal data within Shelter Suite to ensure that no unnecessary data is retained. Consider performing a data review every 12 months to identify any data that should be deleted or anonymised.

2.4. Handling Sensitive Data

Shelter Suite CRM may store personal details, but if sensitive data (such as health or behavioral details of animals) is included:

• Handle this information with extra care.
• Ensure the data is only accessed by those who need it for the rehoming process.

3. Data Security

3.1. Security of Personal Data

• Always ensure that your work environment is secure. If using a shared computer, log out after accessing Shelter Suite.
• Do not download or store personal data from Shelter Suite on unsecure devices or personal systems.
• Follow your organisation’s policy on remote working and data access.

3.2. Reporting Data Breaches

If you become aware of a data breach (e.g., unauthorised access to personal data, accidental sharing of information), immediately report it to your administrator or Data Protection Officer (DPO). Your organisation must notify the ICO within 72 hours of a confirmed breach.

4. Data Subject Rights

As per GDPR, individuals have the following rights:

• Right to Access: Data Subjects can request access to their personal data held in Shelter Suite.
• Right to Rectification: Data Subjects can request corrections to their personal data.
• Right to Erasure: Data Subjects can request the deletion of their personal data, also known as the “right to be forgotten.”

You must ensure that any such requests are passed to the relevant personnel in your organisation to be handled promptly.

5. Training and Awareness

All staff who access Shelter Suite should undergo regular training to stay updated on data protection laws and best practices. Training should cover:

• Handling personal data securely.
• Recognising and responding to Data Subject requests.
• Reporting data breaches.

6. Contact for GDPR-related Queries

If you have any questions about how to handle personal data or if you are unsure about your responsibilities, contact your organisation’s Data Protection Officer (DPO) or designated administrator for guidance.

7. Consequences of Non-compliance

Failure to comply with this policy can result in disciplinary action from your organisation and could lead to significant penalties under GDPR if personal data is mishandled.

Acknowledgement

By accessing the Shelter Suite CRM, you acknowledge that you have read, understood, and agree to comply with this Data Protection and GDPR Compliance Policy.