GDPR Content

Order: 1 · Updated: 2026-05-11

One Step Counselling and Therapies C.I.C. ("we", "us", "our") is the data controller for personal data collected through the Steps Together volunteer programme. Contact email: hello@onestepcounselling.org We are committed to protecting your personal information and handling it responsibly in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Order: 2 · Updated: 2026-05-11

We collect and process the following categories of personal data from volunteers: - Identity data: full name, date of birth - Contact data: email address, phone number, home address - Emergency contact details: name and phone number of a nominated emergency contact - Volunteer role data: skills, availability, volunteer type, induction status, training records - DBS data: DBS certificate number, issue date, expiry date, and status - Sensitive documents: copies of identity documents submitted for DBS processing - Financial data: expense claims and bank details where reimbursement is required - Communications: messages and correspondence sent through the platform - Usage data: login activity and actions taken within the volunteer portal

Order: 3 · Updated: 2026-05-11

We process your personal data for the following purposes: - Managing your volunteer application and onboarding - Coordinating and scheduling volunteer activities and training sessions - Processing DBS checks required for your role - Communicating with you about your volunteer role, updates, and support - Processing expense claims and reimbursements - Maintaining accurate records of volunteering hours and activities - Ensuring safeguarding obligations are met - Monitoring and improving the quality of the volunteer programme - Complying with legal and regulatory obligations We will not use your data for automated decision-making or profiling.

Order: 4 · Updated: 2026-05-11

We rely on the following lawful bases under UK GDPR Article 6: - Contractual necessity (Article 6(1)(b)): Processing your data is necessary to manage your volunteer agreement and coordinate your role. - Legal obligation (Article 6(1)(c)): We are required to process certain data (e.g. DBS records) to comply with safeguarding legislation. - Legitimate interests (Article 6(1)(f)): We process data where it is in our legitimate interests to run an effective volunteer programme, provided your rights are not overridden. - Consent (Article 6(1)(a)): Where we rely on consent (e.g. GDPR acknowledgement on registration), you have the right to withdraw this at any time.

Order: 5 · Updated: 2026-05-11

We do not sell your personal data. We may share it only in the following limited circumstances: - DBS processing bodies: Identity documents and relevant personal data are shared with the Disclosure and Barring Service and any umbrella body used to process your DBS application. - Technology providers: Our volunteer platform is hosted securely. Access is limited to authorised personnel only. - Legal obligations: We may disclose your data to law enforcement, regulatory bodies, or courts where required by law. - Safeguarding emergencies: Where there is a serious risk to you or another person, data may be shared with emergency services or statutory agencies without prior consent.

Order: 6 · Updated: 2026-05-11

We retain your personal data only for as long as necessary: - Active volunteer records: retained for the duration of your volunteering and for 6 years thereafter (Limitation Act 1980). - DBS records: certificate numbers and dates retained for up to 6 months after leaving, in accordance with DBS Code of Practice. - Financial records (expense claims): retained for 7 years in compliance with HMRC requirements. - Safeguarding records: may be retained indefinitely where required by statutory guidance. - Communications and messages: retained for 3 years after your last activity. When data is no longer required, it will be securely deleted or anonymised.

Order: 7 · Updated: 2026-05-11

We take the security of your personal data seriously and have implemented appropriate technical and organisational measures including: - Secure, encrypted storage of all personal data on our platform - Role-based access controls ensuring only authorised staff can access volunteer records - Secure file upload for sensitive identity documents - Regular platform monitoring and updates - Staff and volunteer awareness of data protection responsibilities In the event of a data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours and inform affected individuals without undue delay.

Order: 8 · Updated: 2026-05-11

Under UK GDPR, you have the following rights in relation to your personal data: - Right of access: Request a copy of the personal data we hold about you (Subject Access Request). - Right to rectification: Ask us to correct inaccurate or incomplete data. - Right to erasure: Request deletion of your data where there is no legitimate reason for us to continue processing it. - Right to restriction: Ask us to restrict processing of your data in certain circumstances. - Right to data portability: Request a machine-readable copy of data you have provided to us. - Right to object: Object to processing based on legitimate interests. - Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time. To exercise any of these rights, please contact us at hello@onestepcounselling.org. We will respond within one calendar month.

Order: 9 · Updated: 2026-05-11

The Steps Together volunteer portal uses essential cookies and session tokens to maintain your login session and ensure the platform functions correctly. These are strictly necessary and do not require consent. We do not use advertising, tracking, or analytics cookies that monitor your behaviour across other websites.

Order: 10 · Updated: 2026-05-11

If you have any questions or concerns about how we handle your personal data, please contact us: Email: hello@onestepcounselling.org Subject line: Data Protection Enquiry If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO): Website: www.ico.org.uk Helpline: 0303 123 1113 Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF This policy was last reviewed on 11 May 2026.