More Privacy Questions

Collection of personal information

What information will be mandatory to collect from people wanting to volunteer in schools?

All information collected for a person is stored in the person record. this has the following fields.

Field	Description	Required	example

Field	Description	Required	example
name	Full formal name.	yes	Andrew Watkins
email	current validated email	yes	andrew@voluntarily.nz
nickname	short informal name.	no	Andrew
about	free text description of the person	no
location	region of nz where the person is likely to volunteer. Allows recommendation of activities by location	no	Northland
phone	contact phone number - allows organisers to get in touch with volunteers	no	+64 027 7031007
ImgUrl, ImgUrlsm	image that represents the person - a photo or avatar graphic.	no	Open
pronoun	how a person would prefer to be addressed in communications.	no	he/him/his, she/her/her, them/their/their
language	language person would prefer to see website content in. - currently unused.	no	EN
website, facebook, twitter	URL of a website representing the person, social media handles allowing a person to share more about themselves to the groups they are working with.	no
education	highest level of education. used to help organisers select appropriate volunteers and for demongraphic stats.	no	Bachelor Degree
sendEmailNotifications	flag to inhibit sending of emails if person has unsubcribed	yes	true
role	array of values giving permission for the person to access various functions on the platform	yes	‘Opportunity Provider’ indicates permission to create new opportunities.
status	whether the person is active or inactive on the site - allows a person to not receive invitations without them having to resign from the platform.	yes	active
dateAdded	date the person record was created. shows how long the person has been enrolled on the site. not public	yes
tags	array of keywords indicating persons interests and skills. Allows recommendation of activities by interest.	no	['python', ‘swimming’ ]

Proposed but not currently implemented

Will the mandatory information allow people to fully access and use the Voluntarily platform? (If no, what other information would be required?)

This depends on the person’s role

Volunteers

The mandatory information will allow volunteers to fully access the platform. They will be able to search for and browse volunteering opportunities and indicate their interest in those opportunities.

The person will be encouraged to complete their profile information. in particular the location and tags. If these are not present the person will not be presented with recommended activities.

[ A future feature may allow a person to initialise their skills tags from a third-party source such as LinkedIn ]

When a list of people interested in volunteering for an activity is presented to a teacher/organiser they may use the information in the profile to decide who to choose. An empty profile is less likely to be selected.

Activities may define a list of requirements for volunteers. These may include having completed particular training courses, holding a credential etc. In particular, a school or activity plan may define whether volunteers require a police vet.

As the volunteer participates in the platform they will accumulate a list of events and activities that they have attended or helped with. This list is available for other site members to view on the person’s profile.

Teachers (Opportunity Providers)

Teachers will usually be given the permissions necessary to create and manage opportunities by virtue of being members of a school organisation onboarded onto the platform. For some teachers without current membership of a school, they may still be onboarded by entering their teacher registration number. The TRN is validated against a data service and the resulting category and expiry information is stored in their record.

Activity Providers

People designing and providing activities are given permissions necessary to use the site by being validated members of an activity provider organisation. No extra information is required.

Will any personal information be collected from a source other than a volunteer (eg from an employer or from a school)?

In the case where a person signs in using social media sign in (gmail, Facebook, twitter etc) we hold a record from that source which includes username and avatar - only for the duration of the signed in session.

In the case where a person signs in using enterprise accounts we will associate the person with membership of the organisation e.g. John Doe is a member of Datacom. This membership is available on the person’s profile page.

We use a micro-credential and digital badge management service Badgr.com. When a person signs in we access and list any badges associated with the person on this service. Currently, it is unlikely that a person would have a badge there that was not created as part of the Voluntarily platform but this could change in the future.

Vetting information

Where will vetting information be stored (both for forms completed by volunteers and for vetting responses received)?

The information in request forms will be entered into the Police vetting web service and the forms discarded/destroyed. This information includes identity information: full name, address, date of birth etc. along with authority to make the vet request. This information is not stored in the personal profile.

We are likely in the future to use a request management workflow completely separate to the Voluntarily platform.

The response from the vetting process is a simple pass/fail. In the case of pass we will generate a badge to capture the assertion along with expiry date. Badges are placed in the Badgr system and then made available to the person’s profile. Badges are cryptographically signed digital documents containing one or more assertions.

Absence of a ‘SchoolSafe’ badge cannot be taken to indicate that the person has failed a police vet.

Who will have access to vetting forms and/or vetting responses?

one of a small number of PFCT staff members trained in the use of the Police system.

Who will be informed of vetting responses?

No one is specifically informed of a failure. A pass results in a badge which is visible on the platform.

Who will make decisions of suitability using vetting information?

Schools have to set their own policy to determine whether a ‘SchoolSafe' badge is a requirement for a specific type of activity. Schools have ultimate accountability for school safety.

Indicators showing whether an interested volunteer has completed training courses and vetting are shown to the teacher when they are deciding whether to invite the volunteer to attend an event.

Activity providers may indicate whether their activity involves the type of contact with children that might require a police vet or not.

PFCT may implement a policy requiring all volunteers to enter the vetting process, but may allow volunteers who have not completed that process to participate in activities where the school deems the risk low (e.g. assemblies) or where they have other mitigations in place (e.g red wrist bands).

Who will be informed of/able to access decisions arising from vetting?

No decision arises directly from vetting. However, people not having the required badges may not be selected for activities requiring those badges.

Vetting for people working with children is required every 3 years, what mechanisms are planned to ensure this occurs?

An expiry date is built into the SchoolSafe badge. Badges are validated each time they are provided to the user interface. When a badge becomes invalid it is removed and a new ‘Goal Card’ will be generated to ask the person to restart the process.

Information flows

What personal information of volunteers will be disclosed to schools?

All the information added by a person to their person record above is presented in their profile on the site with the exception of phone number and email.

When a teacher accepts a volunteer for an event the phone number and email are then accessible to the teacher. Similarly the teachers contact number is made available to the volunteer.

What personal information of volunteers will be disclosed to other parties, eg their employer?

If a volunteer is registered as a member of an organisation their account is listed in the membership section accessible by the organisation admin for that organisation. This allows the admin to view the persons profile which will include the history of volunteering activities.

Voluntarily may also provide summary reports and statistics to organisations about their members' levels of engagement.

a) How will this information be disclosed?

OrgAdmin will have to make use of the functionality provided by the platform. Some summary information on engagement may be condensed into reports made available to member organisations.

Test data

What data will be used for testing during the construction of the Voluntarily platform?

Data representing people, organisations, activities and other entities on the test platforms are predominantly fictional. However, for testing purposes, people will create personal accounts using real emails and often using their own name and picture.

Similarly, in the case of testing integration with some organisations, the real organisation name and contact details are used.

What data will be used for testing after the Voluntarily platform has been launched?

As above.