Privacy notice – users of Alabaré charity services

 

Introduction: This statement explains how Alabaré handles and uses personal data we collect about people who apply, enter or join our homes and services or are in anyway connected to Alabaré (other than through Employment or Volunteering).

Alabaré is registered as a Data Controller with the Information Commissioner’s Office (ICO). We are committed to protecting your personal information and to being transparent about what information, we hold.  Alabaré understands its obligations to you to help you understand how and why we process your personal data.  This notice tells you about these uses.  The Data Protection Act 2018 and the EU General Data Protection Regulation 2016/679 (the GDPR”) govern our Data Protection Policy and Procedures.

 

Data protection principles

Under the GDPR, there are six data protection principles that the Charity must comply with. These provide that the personal information we hold about you must be:

1. Processed lawfully, fairly and in a transparent manner.
2. Collected only for legitimate purposes that have been clearly explained to you and not further processed in a way that is incompatible with those purposes.
3. Adequate, relevant and limited to what is necessary in relation to those purposes.
4. Accurate and, where necessary, kept up to date.
5. Kept in a form, which permits your identification, for no longer than is necessary, for those purposes.
6. Processed in a way that ensures appropriate security of the data.

The Charity is responsible for, and must be able to demonstrate compliance with, these principles. This is accountability.

 

Why we hold your personal data

We will only use your personal information when the law allows us to. These are known as the legal bases for processing. We will use your personal information in one or more of the following circumstances:

• where we need to do so to perform the ‘contract’ that we may or have entered into with you
• where we need to comply with a legal obligation
• where it is necessary for our legitimate interests (or those of a third party), and your interests or your fundamental rights and freedoms do not override our interests

We may also occasionally use your personal information where we need to protect your vital interests (or someone else’s vital interests).

 

What information do we collect: We collect a range of information about you, which includes, but is not limited to:

• Your name & full contact details
• Personal data provided by you, i.e. disability, medical history, lifestyle choices, offending history etc
• Financial information

Data may be stored in a range of different places.  These records may be both manual and electronic.

 

Sensitive personal data: The information we hold is that which you provide to us (e.g. by the completion of forms; correspondence (post/email/telephone or otherwise).  We may collect a small amount of sensitive personal data for statistical and monitoring purposes.  You will not be personally identified (unless we have express permission from you, in any reports which include this information.

 

How we use your personal data: Your data may be used by us for a number of purposes, including but not limited to:

• Administrative purposes
• Internal and external reporting and record keeping
• Publications, invitations and other communications
• Newsletters (by email)
• Responding to data access requests you may make

Communications to you may be sent by post, telephone or email.  If you have any concerns or queries about any of these purposes, or how we communicate with you, please contact us at the Home or Service the information is held in.  We will always respect a request by you to stop processing your personal data.

 

Sharing your data with others: Personal data, including sensitive data, may be shared between certain members of staff who legitimately need the information to carry out their duties.  We endeavour to ensure that sensitive personal data is only shared with colleagues with your consent; however circumstances may arise where this data is shared with colleagues without your consent.  This will only occur if it is necessary to protect your vital interests or the vital interest of another person, or for certain other reasons where it is not possible or appropriate to gain your consent, such as disclosures to the police for prevention or detection of crime, or to meet statutory obligations relating to equality monitoring.

 

Data may be shared with other reputable ‘data processors’, but Alabaré will not share data with a third party, except as allowed for in other privacy notices or required by law.  You will be expected to sign a consent form listing other parties that may share you information.

We do not sell your personal data to third parties under any circumstances, or permit third parties to sell on the data we have shared with them.  Alabaré does not share data outside of the UK, or the European Union, but if we do, we will let you know.

 

How we protect data: We take security of your data seriously.  We have internal policies and controls in place to ensure that your data is not lost, accidently destroyed, misused or disclosed, and is not accessed except by our employees in the proper performance of their duties.

 

How long we keep data: We will keep your personal data only as long as is necessary for the purpose(s) for which it was collected, and in accordance with our Data Protection Policy & Procedures.  Data will be securely destroyed when it is no longer required.

 

Your rights: Under certain circumstances, as a data subject, you have a number of rights:

• To be informed: This Privacy Notice provides the information you are entitled to receive.
• Access: Please contact us if you would like confirmation that your data is being processed and/or request a Subject Access Request form.
• Rectification: Please inform us of any data which you would like rectified.
• Erasure: You may exercise your right to have your personal data erased in a number of circumstances (e.g. if the data is no longer necessary in relation to the purpose for which it was created or you withdraw your consent. Where possible we will comply with all such requests, although some details are part of the Charity’s permanent records, which cannot reasonably be deleted.
• Restrict Processing: You can tell us that we can keep your data but must stop processing it, including preventing future mailings and communications.
• Data Portability: Your data is across manual records/electronic records and our bespoke client database. We will do our best to provide information in a portable format.
• To Object: If we can, we will stop processing your data if you object to processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority (including profiling). We will stop processing your data for direct marketing if you tell us to. We will stop processing your data if you object to processing for the purposes of research and statistics.

 

Alabaré does not use automated decision-making.

We reserve the right to judge what information we must continue to hold in the fulfilling of any contracts we hold.

 

If you would like to exercise any of these rights, please contact the Data Protection Lead: Karen Bell, HR and Corporate Services Manager Riverside House, 2 Watt Road, Salisbury SP2 7UD, Email: k.bell@alabare.co.uk, Tel: 01722 344487

If you believe the organisation has not complied with your data protection rights, you can complain to the Information Commissioner: https://ico.org.uk/concerns

 

Any changes we make to our Privacy Statement will be available to you on our website. Please check for updates from time to time, so you are always fully aware of what information is collected and how it is used.