1. Policy Statement 

1.1. This policy is a statement of principles outlining Mary’s Meals’ commitment to good practices in relation to data protection. 

1.2. Protecting the personal data of everyone associated with Mary’s Meals – which includes supporters, visitors to our websites, volunteers, employees, applicants for jobs or volunteer roles, suppliers, service providers and the children who receive a daily meal at their school – is important to Mary’s Meals. 

1.3. Our mission relies on these people having confidence in the way we operate – including how we manage their personal data – and we recognise that the lawful treatment of this personal data will maintain confidence in Mary’s Meals and enable the continued success of our activities. 

1.4. In the words of the Founder of Mary’s Meals, Magnus MacFarlane-Barrow: “data protection is a necessary and important part of our work. It should not stop us performing our duties or pursuing our goals, and good data protection practices align strongly with our values. We must each ensure that our actions and behaviours clearly demonstrate that we are committed to protecting the personal data of all individuals that are engaged in the Mary’s Meals global movement.” 

2. Scope / Applicability 

2.1. This policy is applicable to MMI, National Affiliates and Programme Affiliates. It applies to all employees, trustees, volunteers, agents, partnering agencies, consultants, contractors and to any other people or bodies associated with Mary’s Meals, within all regions, areas and functions, wherever located. 

2.2. As a result, Mary’s Meals expects external parties such as suppliers and contractors to have or put in place similar policies and procedures in line with local legal requirements. 

3. Who is Responsible for this Policy? 

3.1. The MMI Board and each Affiliate Board (subject to the terms of their Scheme of Delegation) have overall responsibility for ensuring this policy complies with our legal and ethical obligations and is implemented fully across the network.  

3.2. Each Mary’s Meals entity should put in place suitable arrangements for implementing this policy, monitoring its use and effectiveness, dealing with any queries about it, and always ensuring that they are adhering to any and all data protection laws within their own jurisdictions. 

4. Definitions 

4.1. Personal Data is any information that relates to an individual who can be identified from that information. 

4.2. Processing is any use that is made of personal data, including collecting, storing, amending, disclosing or destroying it. 

5. Our Commitment to Data Protection 

Mary’s Meals is committed to:

• Upholding and complying with all laws relevant to data protection in the jurisdictions in which we operate.
• Recognising the importance of data protection and ensuring that our day-to-day working arrangements and other activities meet these standards.
• Ensuring that everyone involved with Mary’s Meals understands the importance of good data protection practices, and the requirement to adhere to the key principles of data protection. 

6. Key Principles for Data Protection 

6.1. In upholding our commitments in relation to data protection, we will adhere at all times to the following key data protection principles, namely that personal data will only be: 

a) processed lawfully, fairly and in a transparent manner in relation to individuals; 

b) collected for specified, explicit and legitimate purposes and not for any other purpose; 

c) adequate, relevant and limited to what is necessary; 

d) accurate and, where necessary, kept up to date; 

e) kept in a form which permits identification of individuals for no longer than is necessary for the purposes for which the personal data is processed; and 

f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures. 

7. Local Policies and Procedures 

7.1. All Mary’s Meals entities must ensure that this policy has been read, understood, and complied with, and should commit to creating and implementing local policies and processes to support the principles outlined in this policy. 

7.2. All Mary’s Meals entities must have a process for reporting and investigating data protection breaches internally, and for reporting them to their own Board and the relevant authorities where necessary. 

7.3. All Mary’s Meals entities should determine the training requirements for their staff and volunteers on the Global Data Protection Policy and any local policies flowing from this, to ensure a high level of understanding of the need to protect personal data. 

7.4. Breaches of this policy, or any local policies and procedures, should be taken seriously, investigated fully and reported on as required by local governance & regulatory frameworks by the relevant Mary’s Meals entity.