Statements & policies

Volunteer Privacy Notice

This privacy notice covers the use of your personal data if you are a volunteer at Family Action and our related services.

Family Action is the Data Controller of the data, and processes the data using the legal basis of Legitimate Interest – Where it is necessary for our legitimate interests (or those of a third party). In broad terms our legitimate interest is fulfilling the charitable purpose of the Family Action.

Family Action is required to process information about its volunteers for purposes such as:

• management and administration,
• Family Action legal obligations
• plan and administrate activities
• taking steps to ensure and monitor compliance
• with our legal obligations and internal standards and procedures
• assessing suitability of volunteers for potential roles
• keeping records of volunteer activities and performance

We take the privacy and security of your information extremely seriously and will only use it in a lawful, fair and transparent manner in order to manage our relationship with you and to ensure the effective running of the organisation.

Information may be collected and used at many stages of your volunteering/employment with Family Action:

• during the recruitment and selection process
• to carry out pre-volunteering checks
• when you join Family Action
• during the time you volunteer at Family Action
• at the time when your volunteering role ends
• after you have stopped volunteering at Family Action.

We use personal information:

• in order to fulfil our responsibilities to you under your volunteer agreement
• to comply with legal requirements, such as the health and safety at work legislation
• in order to pursue our legitimate business interests
• to perform our rights and obligations in connection with your volunteering role
• to contact your emergency contact, where necessary and appropriate

If information is not provided by you we may, in some cases, not be able to comply with our obligations. In such circumstances, we will advise you of the implications of your decision.

Where do we obtain your information?

Most of the information we hold about you will be provided by you in the form of application forms, disclosure forms etc. Additional information may be provided by your supervisor, by employees and by external sources such as service users, clients and your referees during the course of your volunteering with us.

What information do we process?

The information held about you may include:

• your name and contact details
  emergency contact details
  records relating to your volunteer role, such as training records, supervision notes, personal development plans and other performance measures
• details of your qualifications
• where appropriate, records of complaints procedures
• records of your volunteering hours
• information needed for equal opportunities
• monitoring
• employment history
• your volunteer agreement
• references
• details of your bank account (for payment of expenses)
• correspondence (e.g. Letters confirming changes to your volunteer role
• DBS details and ID numbers and passport details where required for DBS checks
• visa details confirming your eligibility to volunteer

You will, of course, be referred to in many Family Action documents and records that are produced by you and your colleagues in the course of carrying out your role and the business of Family Action. Please refer to the Family Action Data Protection Policy and Information Security Policy.

Where necessary, we may keep information relating to your health, which could include records relating to your physical or mental health. This information will be used in order to comply with Family Action’s health and safety and obligations in connection with your volunteering role, so that we can consider how your health may affect your ability to perform your role, and to ensure we are able to support you within your role. We may also use the information to address any complaints by or about you.

We will only process special categories of data relating to your ethnic origin, religion, race and sexual orientation to enable us to monitor equality and diversity.

As an organisation we may process data in pursuit of our legitimate business interests. These include:

• the detection and prevention of fraud or other criminal activity
• protecting the security and integrity of Family Action networks and systems
• detecting and preventing the loss of personal data
  improving employee productivity and performance

Under these legitimate interests we monitor computer and network use in line with the Family Action Information Security Policy. You should therefore be aware that when you are using Family Action telephone and computer systems for your own personal use, such use is not considered to be private.

We will never process your data on this basis where Family Action’s interests are overridden by yours.

Is my data safe?

Family Action takes appropriate precautions to protect the security and integrity of the personal data we hold. Technical and organisational measures have been put in place to protect the information systems on which your data is stored and we require our suppliers and service providers to protect your personal information by contractual means.

Will your information be shared with any other parties?

We will only disclose information about you to third parties if we are legally obliged to do so.

If in future we intend to process your personal data for a purpose other than that which it was collected, we will provide you with information on that purpose and any other relevant information.

Transfer of data to other countries

In limited and necessary circumstances, your personal information may be transferred outside of the European Economic Area (EEA). Where such transfers occur, we will assure that adequate protection exists as required by law.

How long will we keep your data?

Your personal information will be kept on file only for as long as it is required under GDPR, or we are obliged to retain the information by law.

Your Rights

If you have provided consent for the process of your data you have the right (in certain circumstances) to withdraw that consent at any time. To do so, you should contact your supervisor in the first instance or the Data Protection Officer whose details are recorded below. Withdrawing consent will not affect the lawfulness of the processing before your consent was withdrawn.

Under the General Data Protection Regulation (GDPR) you have a number of rights with relation to your personal data.

Access

You have the right to request access to the personal information held about you. To request access, you should send a Subject Access Request (stating what information you would like access to) in writing to the Data Protection Officer whose details are below.

Rectification

It is important that the information we hold about you is accurate and up to date. If you believe that your information is inaccurate you should notify your supervisor in the first instance.

Erasure

In certain circumstances, you have the right to request that we erase information about you from our files and systems. This will only be possible if there is no other legal basis under which we are obliged to keep the information.

Restrict Processing

You may have the right to request that Family Action restrict the processing of your data if you believe the data to be inaccurate, no longer required or processed unlawfully.

Complaints

You have the right to complain to the data protection authorities if you believe that your data is being processed improperly or illegally.

Changes to This Policy

Family Action reserves the right to make changes to this policy from time to time. Where changes are made, the details will be posted on the Family Action intranet. If you do not have access to this, your supervisor will pass on the information.

If you have any questions in relation to any of the above, please contact the Data Protection Officer by email at [email protected] or contact the legal team.

Fundraising and Marketing Privacy Notice

Services Privacy Notice

Data Protection and Confidentiality

For the purposes of the data processing described in this statement and compliance with the Data Protection Act (2018), the Family Action operate as Controllers of the data.

Commitment

Family Action is committed to making sure that any information we hold about you and your child(ren) will be collected, stored and used in accordance with The Data Protection Act 2018 – GDPR is still a legal requirement despite Brexit.

This means that we adhere to the data protection principles of only holding information about you that is relevant to our work with you, that we make sure the information that we hold is accurate, up to date, secure, and only kept for as long as we need it.

To keep things simple, we have arranged a single point of contact for all data protection issues. Should you have any questions relating to this notice or our processing of personal data, please email [email protected] or contact us at the address at the bottom of this form.

Where do we collect your information?

We may collect information about you at a number of stages in your use of our services.

Registration/Referral Form

When you apply for the FOOD Club (Food On Our Doorstep) or if someone refer(s)/register(s) you for our services, we will ask people contacting our service for the first time to give their permission for us to collect and access their information and speak with professionals on their behalf this may include but is not exhaustive the following listed below:

• Department for Work and pensions
• HMRC
• Jobcentre Plus
• Other Advice services
• Council Tax and council benefits
• Universal Credit
• Utility Companies –gas, electric, water
• TV Licensing
• Courts and Tribunals Services
• Solicitors
• Landlords – Registered Social Landlords, occasionally private landlords
• Other voluntary/ charitable organisations
• Statutory sector- Health/ Adult & children’s safeguarding and other local authority departments
• Charitable trusts and grant providers
• OISC or AQS auditors reviewing files as part of any Quality Audits

During your engagement with us

Throughout your engagement with us, our service team will record information about the service provided to you, including your personal circumstances (both monetary and physical). This will help us to fully understand your needs and provide a more complete service to you.

What personal information do you record?

The type of information (including personal information) that we collect and use and what we do with it will depend upon your relationship with us.

We collect only the personal data that we require to provide you with services, fulfil contracts or keep in touch.

• Ensure staff are aware of food allergies.
• Check that members of the public are signed up members of the scheme.
• Produce anonymised reports of the number of people accessing the scheme.
• Produce anonymised reports of the income of the people accessing the scheme.

At no point will you or your family’s data be shared with any third parties without your prior consent.

If you stop accessing the scheme, your details will be deleted from all systems and your original paper membership forms will be deleted in line with Family Action Retention policy (normally 12 months after your departure date to the scheme).

Information about you:

Name & Address
Contact Information (email / telephone)
Date of Birth/Age
Marital Status
Employment Status
Household Income
Name of employee (verification purposes)
Benefits (Tax credits) etc.
*Disability Information
*Health Information (including Allergies)
*Ethnic Origin
*Language Spoken

Information about your family/child(ren):

Name & Address
Gender
Date of Birth/Age
*Disability Information
*Ethnic Origin
*Language Spoken
*Health Information (including Allergies)
*Disability Information
Services provided

* Special Categories of Data

Due to the nature of the service we provide, some of the data we collect is sensitive. Information relating to Health, Ethnicity and any particular dietary or health requirements you or your child(ren) may have. These are considered to be Special Categories of Data and we are required to take extra care when handling this information.

How Do We Use Your Information?

We will only use your information in a fair and transparent manner and where we have a legal basis for doing so.

To Provide the Services You Have Agreed To

In order to provide the services that you have requested, we will need to communicate with you the timings of FOOD Club opening times and to discuss aspects of your requirements.

This communication may be via Mail, Email, Telephone or SMS.

We may also need to record the details of the services delivered and any further needs that have been identified.

Legal Basis: Legitimate Interests

Special Category Condition: Explicit Consent

For safeguarding and where legally obliged to do so

All staff at Food On Our Doorstep have a duty of care to safeguard and promote the welfare of children, young and vulnerable people.  We have a duty to report any child protection or welfare concerns.

In certain, limited conditions we may use or disclose your personal information in order to comply with a legal obligation, in connection with a request from a public or government authority, in connection with court proceedings or to prevent loss of life or injury.

Where possible and practical to do so, we will tell you in advance of such disclosure.

Legal Basis: Legal Obligation

Special Category Condition: Performance of Obligations under Social Care Law

Sharing & Disclosure

Your information will only be accessed by people who need to do so as part of their role. This could include:

• Within the FOOD Club (Family Action):
• Staff working at the FOOD club that you use
• Senior managers, as required
• Outside of the Service:OISC or AQS auditors reviewing files as part of any Quality Audits
• Any other organisation that we will need to contact on your behalf.

Rights

The GDPR legislation provides you with a number of rights in relation to your personal data.

Right to Withdraw Consent

Where you have consented to our processing of your data, you have the right to withdraw that consent at any time. To do so, please contact [email protected] or write to us using the details below.

Right to Access

You have a right to obtain copies of the information that we hold about you.

To request access to any data, please email [email protected]  or write to us at the address below explaining which data you require.

In the interest of security, you will need to prove your identity before any information can be shared with you.

Under certain circumstances we may not be able to disclose all of the information you request, for example if it contains information about other people or there are legal reasons for us to withhold the data.

Right to Rectification

We would like to ensure that the data we hold about you is accurate and up-to-date. If you believe the data we hold is inaccurate, please tell one of our service staff who will make any necessary amendments. However, you may also ask us formally to correct your data by emailing [email protected]  or writing to us at the below address.

Right to Erasure or the Restriction of Processing

In certain circumstances you can ask us to remove your data from our systems by emailing [email protected] or writing to us at the below address. If there is a legal reason for us to continue holding the data we will let you know, otherwise we will make efforts to comply with your request. You may ask us to restrict our processing of your data if:

• We are using the data for marketing
• You believe that our processing of the data is unlawful
• You object to us using your data (pending investigation)

In these circumstances, we may continue to store your information, but will otherwise only process it with your consent or where we have a legal reason to do so.

Right to Complain

If you are concerned about the way we have processed your personal information, you have the right to complain to the Information Commissioners Officer (ICO).

To do so please refer to the ICO website http://ico.org.uk

Changes

Food On Our Doorstep (Family Action) reserves the right to make changes to our privacy policy from time to time. Where we do so, we will publish the new policy on our website www.family-action.org.uk  and where appropriate/possible notify you by email.

Contact

Should you wish to contact us, our registered address is:34 Wharf RoadLondon, N1 7GR
Or contact our data protection team on [email protected]

National School Breakfast Programme Privacy Notice

Family Action is a registered charity registered with the Charity Commission (Charity number 264713) and will be the data controller for all data processing activities covered in this notice.

Our Commitment

Family Action is committed to protecting your personal data and respecting your right to privacy and security. We want you to be clear about when we collect your data and not do anything you would not reasonably expect us to do with your personal data. This policy is to help you understand what personal data we collect, how we use it and how we store it and applies to our websites, products, services and the ways in which we interact with you. A separate Family Action Services Privacy Notice addresses how we handle personal data within our services.

Family Action adheres to the requirements of the Data Protection Act (2018) and the General Data Protection Regulation 2016/679 (GDPR).

Should you have any questions relating to this notice or our processing of personal data, please email [email protected] or contact us at the address below.

Where does Family Action collect my personal information from?

Most of the information we hold and process will have been provided by you:

When you provide your personal information directly to us

If you sign up to one of our training events, request some information, purchase a product, or communicate directly with our teams for another reason, whether online, on paper, in person, or over the phone, you will be sharing your personal information with us.

When you provide your personal information through a third-party organisation

For example, if a third party provides us with your details as part of your relationship with them, or when we are commissioned to deliver training and your name and details are sent as part of an attendance list.

Publicly available personal information

If your contact details are recorded online in a public website, or included in other open sources of public information, such as Freedom of Information Act requests

What type of information do you collect?

The type of information (including personal information) that we collect and use and what we do with it will depend upon your relationship with us.

We collect only the personal data that we require to provide you with services, fulfil contracts or keep in touch.

The data that we need to collect will vary, but may include:

• your name
• your contact details, including email, telephone number and postal address
• your date of birth
• your bank or credit/debit card details and details needed to improve your event experience such as dietary requirements or accessibility needs
• invoicing information
• for corporate contacts -details of the company you work for / your employer

How do you use my information?

Family Action will only use your information in a fair and transparent manner and where we have a legal basis for doing so.

With your Consent

Where you have consented for us to do so, we will use your data to:

• contact you about a service you or the organization you work for offers, or send you information about Family Action and our services that you have expressed an interest in or we think may be of interest to you.
This may be by mail, email, telephone or SMS, but we will offer you the chance to opt in or out of receiving these messages
• direct marketing (if you requested to be added to a list)
• sending you relevant information e.g. about legislative changes, research etc.
• preparing conference packs
• arrange training, workshop and conferences
• prepare attendance certificates and analyse evaluations

In order to perform our obligations in a contract that we hold with you

We may use and process your personal data where it is necessary for the performance of a contract or agreement that we have with you (For example where you have signed up to participate in a programme, a workshop or training course) to:

• run our programme, training, workshops and conferences
• process payments
• provide you with the services, products or information you asked for (including consultancy work)
• keep a record of your relationship with us;
• make sure we know how you prefer to be contacted

For our own Legitimate Interests or those of our clients and customers

Family Action have legitimate interests in:

• providing or offering services to those who have expressed an interest in receiving them
• evaluating and obtaining feedback in relation to our services
• operating our business efficiently
• marketing our services to potential customers
• ensuring the safety and security of our staff and customers
• informing our commissioners about the performance of our services

In pursuit of these interests we may:

• send you information regarding our services
• ask you to give feedback on your or your organisation’s use of our services
• provide information about similar products and services that may be of interest
• provide summarized information about our services to the organization that commissioned us
• to keep you informed about programmes, courses workshops and conferences that are relevant to you
• recruit staff, associate trainers and volunteers
• communicate about our products and services with other businesses and organisations.

When Legally Obliged to Do So

Under certain, limited conditions we may be obliged by law to disclose data to the relevant authorities for example

• keeping financial records
• public interest /safeguarding concerns about a vulnerable child or vulnerable adult

Sharing Data with Third-Parties

We will never share your information with a third party who intends to use it for their own marketing purposes and there are very limited instances where we will share your personal data with a third party.

This could include:

• if a third party provides a service to us, such as running an event or programme on our behalf or providing an element of a contract for us, such as email distribution
• for the administration of events. For example, an event venue may require the provision of the names of attendees in advance, for security purposes
• where there is a legal or regulatory requirement to disclose your personal information such as from HMRC or the courts, we have a genuine and real concern regarding a person’s well-being, or where disclosure is necessary for taxation and criminal investigation purposes
• in order to prevent fraud and crime, we may perform due diligence checks to ensure we are not being abused, such as by fraudsters or criminals posing as genuine donors for example money laundering proceeds of crime and tax avoidance. We do these checks to help protect Family Action from abuse.
• when we share data, we will only do so where there is an appropriate contract in place to ensure confidentiality and protect your rights.

How do we keep your data secure?

Family Action has a number of steps in place to keep your personal information as safe as possible.

• we train all of our staff in data protection and data security to increase awareness of its importance
• we keep our data protection and data security policies and practices under constant review and review the personal data that we hold, where we hold it and what we do with it.
• Family Action requires the third parties it works with to comply with data protection laws and puts controls in place to ensure that your information is handled safely and appropriately.

Where is my personal data stored?

Wherever possible, we ensure that your personal data is kept in the UK. We minimise use of servers outside of the EEA and in some limited instances if we need to transfer your personal information to a third party for processing in countries that aren’t listed as ‘adequate’ by the European Commission we’ll only do so where we have appropriate contracts or other appropriate safeguards in place.

By communicating electronically with us, you acknowledge and agree that your data may be processed in this way.

How long will you keep personal information about me?

We will only keep information about you for the length of time it is necessary to do so to engage with you in the way that you have requested and in accordance with our legal requirements and tax and accounting rules. When your personal data is no longer needed, we will ensure that it is disposed of in a secure manner. If you would like us to delete any information we hold about you, please contact us using the details in the “Contact us” section below.

Your Rights

The GDPR legislation provides you with a number of rights in relation to your personal data.

Right to Withdraw Consent

Where you have consented to our processing of your data, you have the right to withdraw that consent at any time. To do so, please contact [email protected] or write to us using the details below.

Right to Access

You have a right to obtain copies of the information that we hold about you.

To request access to any data, please email [email protected] or write to us at the address below explaining which data you require. In the interest of security, you will need to prove your identity before any information can be shared with you.

Under certain circumstances we may not be able to disclose all of the information you request, for example if it contains information about other people or there are legal reasons for us to withhold the data.

Right to Rectification

We would like to ensure that the data we hold about you is accurate and up-to-date. 
If you believe the data we hold is inaccurate, please tell us in the first instance. However, you may also ask us formally to correct your data by emailing [email protected] or writing to us at the below.

Right to Erasure or the Restriction of Processing

In certain circumstances you can ask us to remove your data from our systems by emailing [email protected] or writing to us at the below address. If there is a legal reason for us to continue holding the data we will let you know, otherwise we will make efforts to comply with your request.

You may ask us to restrict our processing of your data if:

• we are using the data for marketing
• you believe that our processing of the data is unlawful
• you object to us using your data (pending investigation)

In these circumstances, we may continue to store your information, but will otherwise only process it with your consent or where we have a legal reason to do so.

Right to Complain

If you are concerned about the way we have processed your personal information, you have the right to complain to the Information Commissioners Officer (ICO). To do so please refer to the ICO website.

Contact with Corporate Subscribers under PECR

‘Corporate Subscribers’ are people who Family Action might contact in a professional context, using their work contact details, including phone, email and post.

These contact details may be obtained from public domain sources (company websites etc.), from our own business records or from other companies and business contacts.

Family Action may contact Corporate Subscribers under the legal basis of Legitimate Interests and as permitted under the PECR (2003) legislation.

We may contact corporate subscribers by email or telephone provided that the subscriber has not previously opted out and is not registered with the Telephone Preference Service (TPS) or its corporate equivalent (CTPS).

Direct Mail is not covered by PECR. We may contact subscribers by mail if they have not previously opted out of receiving such communications.

You have a right to object to the processing of your data for direct marketing.

We will provide opt-out notices on our communications to you, or you can advise our team at [email protected].

Family Action understands that PECR (2003) legislation will be replaced by the EU e-Privacy Regulation (ePR) in due course and reserves the right to review this privacy notice accordingly.

Links

Family Action does not have any control over how any third-party websites handle and use your data. Therefore, if you follow any links to third party sites from Family Action websites, you must check the Privacy Policy for that organisation in order to understand how your data could be used. This policy does not cover third party websites.

Changes to our Privacy Policy

To make sure that this policy and our practices stay legally compliant and up-to-date, we may make changes from time to time. If we make any substantial changes, we will make this clear on our website, or by contacting you directly, if appropriate.

Contact Details

If you would like to speak to someone at Family Action about how you collect, use and store my personal data.

If you have any questions, comments, requests or suggestions, please contact the data protection officer at [email protected], by post at Family Action 34 Wharf Road  London, N1 7GR or on 020 7241 7608. If you would like to change your contact preferences, please get in touch with us at: [email protected] or telephone 020 39287228

PARCS Privacy Notice

Portsmouth Area Rape Counselling Service (PARCS, part of Family Action) is a registered charity (Charity Commission number 264713) and will be the data controller for all data processing activities covered in this notice.

Our Commitment

PARCS/Family Action is committed to protecting your personal data and respecting your right to privacy and security. We want you to be clear about when we collect your data and not do anything you would not reasonably expect us to do with your personal data. This notice is to help you understand what personal data we collect, how we use it and how we store it.

PARCS/Family Action adheres to the requirements of the Data Protection Act (2018), UK GDPR and the General Data Protection Regulation 2016/679 (GDPR).

Should you have any questions relating to this notice or our processing of personal data, please email [email protected] or contact us at 34 Wharf Road, London N1 7GR.

Under the Data Protection Act (2018), Family Action are registered with the Information Commissioner to process personal information and we act as data controllers. We will only process information for the purpose for which it was provided and in accordance with the regulations in the Act and our joint control agreement.

It is the nature of the work we do that we may need to collect sensitive information regarding health, social circumstances or ethnicity referred to as ‘special category data’ in data protection law. Wherever such data is processed we will seek your explicit consent to process this. You have the right to withdraw your consent to this processing at any time, however, if consent is withdrawn this may affect the planning of services to support and improve outcomes for you and your family.

When do we collect your information?

We may collect information about you at a number of stages in your use of our service for example at referral, initial assessment and review.

What personal information do we record?

Throughout your engagement with us, our team will record information about you along with the information you choose to share.

The information we collect from you will include:

Information about you

Name & Address

Contact Information (email / telephone)

Date of Birth

Gender

Health Information/Medical History*

Medical History – physical and Mental*

*Prescribed Medication*

Ethnic Origin*

Sexuality*

Relationship status*

Religion (or belief system)*

Other Service Involved/Services provided

Reason for contact with PARCS*

Session Notes

Issues/Concerns

Occupation

Education

Information about your child(ren):

Name & Address

Contact Information (email / telephone)

Date of Birth

Gender

Health Information/Medical History*

Medical History – physical and Mental*

*Prescribed Medication*

Ethnic Origin*

Sexuality*

Relationship status*

Religion (or belief system)*

Other Service Involved/Services provided

Reason for contact with PARCS*

Session Notes

Issues/Concerns

Occupation

Education

* Special Categories of Data – due to the service we provide, some of the data we collect is sensitive. Information relating to Health, Ethnicity and any specific requirements you may have are considered ‘Special Categories of Data’, we are required to take extra care when handling this information.

Information about you from others

We also collect personal information about you when it is sent to us from the following:

• Adult and Children’s’ Services – Local Authority
• Mental Health Services
• GP
• Police, Probation and Sexual Assault Referral Centres
• Other support services

Who do we share your information with and why?

Within the service your records will be accessible by staff/volunteers for the purposes of:

• Administration – our team may use your records to make contact with you, for example to schedule your sessions.
• Supervision – workers may discuss their work with their peers, manager and clinical supervisor. This is to ensure that the counsellor has adequate support and follows good practice
• Quality Assurance and audit – PARCS/Family Action may look at records to ensure that the service is working in line with legislation and the standards required by our regulators and commissioners.
• Investigation of complaints or allegations

We will not share any information about you outside of PARCS at Family Action unless it is necessary to:

• prevent serious physical harm to a person
• prevent loss of human life
• protect public health (e.g. notification of a disease)
• safeguard vulnerable adults or children (including unborn children)
• respond to an emergency
• protect national security (e.g. concerns of terrorist activity)
• fulfil an obligation which requires us by law to share information e.g.
• for a Child Practice Learning Review (previously known as Serious Case Review)
• in response to a request from the Crown Prosecution service for information to support a prosecution
• in response to a request from the Police for information to support a criminal investigation or to enable public protection

In these circumstances we would share only the information necessary and would usually inform you of the need to share information, unless doing so would put you or others at greater risk of serious harm.

Retention

Information we hold about you will be held for 7 years after your final contact with PARCS, with some exceptions, please see below:

Adults Requests for Support, Service Users Records, Safeguarding Referrals

7 Years from date of application to use the service

After 7 years – Destroy Data

Records of concern in relation to potential historic child abuse allegations

Retain on file until client is 75yrs

After 75 years – Destroy Data

Children’s Requests for Support, Service Users Records

7 Years from date of application to use the service

After 7 years – Destroy Data

Child Protection

Retain on file until client is of normal retirement age

After 68 years – Destroy Data

Exceptions

There are some situations where records need a longer retention period. For example, if:

• the records provide information about a child’s personal history, which they might want to access at a later date – (this can be related to some of the PARCS services)
• the records have been maintained for the purposes of research
• the information in the records is relevant to legal action that has been started but not finished
• the records have been archived for historical purposes (for example if the records are relevant to legal proceedings involving the organisation)

Sharing & Disclosure

Your information will only be accessed by staff who need to do as part of their role.

Within Family Action:

• Staff working at  PARCS
• Senior managers, (as required)

Outside of the service

• Sensitive personal data will it will not be shared with anyone outside of Family Action without good reason.
• Legal Basis on which your Data will be processed:
• Legal Basis: Legitimate Interests – Article 6 (f) – Processing is necessary for the purposes of legitimate interest pursued by the controller or by a third party.
• Special Category data: – will be processed under Article 9 (g) – Processing is carried out for Reasons of substantial public interest (with a basis in law)
• Substantial public interest condition set out in DPA 2018 – Condition 18. Safeguarding of children and individuals at risk

How we store your personal information

Written notes may either be securely filed in a locked filing cabinet (or equivalent) and/or stored in an electronic storage form.

Laptops/Computers:  Information about you in electronic files and data systems that are password protected.

Mobile phone: We store your contact telephone number in order to make contact with you throughout the time that you are accessing the services provided by PARCS, if you have given us permission to contact you in this way. We use Family Action mobile phones that are passcode protected.

Email: our email address will be stored and used for contacting you in relation to your referral and work with PARCS, if you have given permission for us to contact you in this way.

Website: PARCS/Family Action website uses cookies. We cannot use this information to find out further personal information about you.

Contacting and Communication

We are obliged to protect any confidential information we hold about you and we take this very seriously, it is imperative that you let us know immediately if you change any of your contact details.

We may contact you using text messages to your mobile phone in the event that we need to notify you about appointments and other services, if we have your consent.  It is important that we have your up-to-date details, this is to ensure that we are contacting you and not another person.

Rights

The GDPR legislation provides you with a number of rights in relation to your personal data.

Right to Withdraw Consent

Where you have consented to our processing of your data, you have the right to withdraw that consent at any time.

Right to Access

You have a right to obtain copies of the information that we hold about you. In the interest of security, you will need to prove your identity before any information can be shared with you. We may not be able to disclose all of the information you request, for example if it contains information about other people or there are legal reasons for us to withhold the data.

Right to Rectification

We try to ensure the data we hold about you is accurate and up-to-date. If you believe our data is inaccurate, please tell one of our staff who will make any necessary amendments.

Right to Erasure or the Restriction of Processing

In certain circumstances, you can ask us to remove your data from our systems.

Right to Complain

If you are concerned about the way we have processed your personal information, you have the right to complain to the Information Commissioners Officer (ICO).  To do so please refer to the ICO website.

Please contact [email protected] if you have any queries regarding data.

City and Hackney Neighbourhoods MDT Privacy Notice

Background

The primary purpose of the Neighbourhood Team is to bring organisations and services together to provide the best care possible for you. We have 8 Neighbourhoods in City and Hackney who are improving the way care is provided in the community.

These 8 Neighbourhoods are:

• Clissold Park Neighbourhood
• Woodberry Wetlands Neighbourhood
• Hackney Marshes Neighbourhood
• Well Street Common Neighbourhood
• Hackney Downs Neighbourhood
• Springfield Park Neighbourhood
• London Fields Neighbourhood
• Shoreditch Park & The City Neighbourhood

More information on Neighbourhoods can be found here.

In order to do this, we need to collect, store and share information about you.

This privacy notice is designed to explain what happens to any personal data that you give any one of our partner organisations within the team, or any information concerning you that they have collected. This includes how your data is held and/or processed by us.

This notice includes

• Who we are, how we use your information and why
• The kinds of information we hold and process
• The legal grounds for processing your personal data, including when it is shared with others
• The length of time that your information is stored and retained by us
• Information about your rights under the 2018 Data Protection Act incorporating the General Data Protection Regulations (GDPR)
• Information about our Data Protection Officer and Caldicott Guardian how to contact them

Who are we?

The Neighbourhood team consists of:

• Representatives of any of the 41 GP Practices in the City of London and London Borough of Hackney
• Community health services for City of London and Hackney delivered by Homerton University Hospital (Adult Community Nursing and Adult Community Therapies)
• Adult Social Care services in the City of London and the London Borough of Hackney
• Mental health services for City of London and Hackney delivered by East London Foundation Trust
• Social prescribers across the City of London and Hackney delivered by Family Action.
• City Connections (delivered by AgeUK) in City of London

Under the 2018 Data Protection Act, each member of the Neighbourhood Team is known as the Data Controller for the data that it holds on you. As such, we are responsible for keeping your data up to date and accurate, as well as storing it and sharing it securely.

If you have a question or a problem, please contact the relevant Neighbourhood team in the first instance (details below). The Act stipulates also that public sector organisations should provide access to an independent Data Protection Officer and these contact details are provided in the summary below.

About the information we hold on you

Each organisation keeps data on you relating to who you are, where you live, your contact details. They may also hold details of any employment, your family, possibly your employers, your habits, your health problems and diagnoses, the reasons you seek help, your appointments, if you have a carer, and a record of where and when you had contact with that organisation, who by, referrals to specialists and other health and social care providers, tests carried out there and in other places, investigations and treatments and outcomes of treatments, your treatment history, the observations and opinions of other health and social care workers, as well as comments and aide memoires reasonably made by healthcare professionals in this practice who are appropriately involved in your care. All of this data helps us in providing you with the best possible care.

All health and social care-data is seen as ‘special category’ or ‘sensitive data’ under the 2018 Data Protection Act which means that it is shared and processed with particular care. This applies to your data whether it is in electronic formats or on paper.

Why we hold and process your data

The Neighbourhood Team holds and processes your data in order to provide you with direct care. The members of the team meet regularly to discuss how they might together provide you with a care package that best meets a number of needs at once. These meetings are known as Multi-Disciplinary Meetings.

Who we share Information with

Each partner organisation, separately, cannot meet all of your needs and there will be times also when your data will need to be made available to other organisations outside of the core team.

Details of these organisations and the purpose for sharing your information will be made clear to you on each occasion. The Neighbourhood Team will only share the minimum information necessary to fulfil the specific purpose .

Once you have seen any outside care provider, they will normally send us details of actions they have taken and the care they have provided.

The Neighbourhood Team has an overriding responsibility to do what is in your best interests under the 2018 Data Protection Act ‘in performance of a public task’ (see legal bases in the summary below).  Each employee of  the Neighbourhood Team (e.g. clinicians, social workers, administrators and reception staff) will only access the information they need to allow them to perform their function and fulfil their roles. The summary also contains details of your rights in relation to your data under the Act and how to exercise them.

Your data is NOT shared for any marketing purpose.

Communication with you

The Neighbourhood team will use your contact details in order to inform you of progress in your care and to work with you in managing any specific issue.

Because we can communicate and get data to you more quickly and more securely, we prefer to use email and text messaging services. Please ensure that we have your current email address and mobile telephone so that we can do this.

Safeguarding

The Neighbourhood Team is dedicated to safeguarding all the people it comes in contact with, including children and vulnerable adults. This means that information will be shared by the members of the team in their best interests.

The duty to share data for the benefit and protection of individuals is even more important than the duty to protect confidentiality and actions taken as a result of safeguarding concerns will override data protection.

Research and Planning

The Neighbourhood Team does not take part in research.

Anonymised or pseudonymised data held by the Neighbourhood Team may also be used to evaluate the services that provide care to you or to plan future ones across the local area as well as the City of London and London Borough of Hackney.

How is your information transferred and stored?

Members of the Neighbourhood Team each stores information upon you within their own secure systems. Information may be shared between the members via the East London Patient Record, by secure email or paper referral form.

How long is the information retained?

The Neighbourhood Team does not retain your data in any specific system, however, information about you is retained by each Neighbourhood Team member within its own systems and is subject to its own data retention regulations and policies. Please contact the individual organisation concerned for details.

Summary

Data Controller

Each individual organisation remains a data controller

Data Protection Officer

Miles Dagnall: [email protected].

Purpose of Processing your personal information

To provide individuals and families in the Neighbourhood Team area with integrated direct care.

Lawful Basis for Processing your personal information

The processing of personal data in the delivery of direct care and for providers’ administrative purposes in this surgery and in support of direct care elsewhere is supported under the following Article 6 and 9 conditions of the GDPR:

Article 6(1)(e) ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’.

Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services…”

Under the Common Law Duty of Confidence information can be shared for direct care purposes with implied consent where there is  a reasonable expectation that the care is in the best interests of the individual concerned.

Where it is beyond reasonable expectations then a member of the team will seek your consent for a referral so that information can be shared with other organisations.

Recipient or categories of recipients of your personal data

The data will be shared with health and care professionals who are part of the Neighbourhood Team. This includes:

• GPs
• Community health services (Homerton University Hospital)
• Adult social services (City of London and London Borough of Hackney)
• Mental health trust (East London Foundation Trust)
• Social Prescribing and Community Navigation (Family Action and City Connections)

In addition, information may be shared with other organisations involved in your care. This will be made known to you. This could include:

• Hospital specialist services
• Mental health specialist services
• Palliative care services
• NHS pharmacists
• Independent Contractors such as dentists, opticians, pharmacists
• Voluntary Sector Providers and social prescribers
• Ambulance Trusts
• Local Authority services such as housing
• Education Services
• Fire and Rescue Services
• Police & Judicial Services

Your right to object

You have the right to object to some or all the information being processed, which is detailed under Article 21 of the GDPR.

Please contact the Neighbourhood MDT Administrator in the first instance or the Data Protection Officer. Details of both are provided below.

You should be aware that this is a right to raise an objection, that is not the same as having an absolute right to have your wishes granted in every circumstance.

Your right to access and correction

You have the right to access your data by means of a Subject Access Request (SAR) and to have any inaccuracies corrected.

There is no right to have accurate medical or social care records deleted except when ordered by a court of Law.

How long do we hold your personal data for?

Each member of the Neighbourhood Team retains your personal data in line with both national guidance, UK law and sector regulations.

Your right to complain

If you have a question or wish to complain about the use of your data, you should contact: [email protected].

Or contact the Data Protection Officer, Miles Dagnall at: [email protected].

The use of personal data is overseen by the Information Commissioners Office, often known as the ICO.

If you wish to complain or raise a concern with the ICO, they can be contacted via their website: https://ico.org.uk/global/contact-us/

Or you can also call their helpline:

Tel: 0303 123 1113 (local rate)

01625 545 745 (national rate)

Or you can write to them at: The ICO, Wycliffe House, Water Ln, Wilmslow SK9 5AF

Download the Gloucestershire Domestic Abuse (healing & empowerment) Privacy Notice here.

Incredible Years Pre-School Parent Programme Privacy Notice – Children and Parents’ Service Manchester (CAPS)

About Us

For the purposes of the data processing described in this statement and compliance with the Data Protection Act (2018), the Service operate as Controllers of the data.

Commitment

Children and Parent Service is a multi-agency working partnership between Family Action/NHS Manchester Foundation Trust/ Big Life and Manchester City Council and are committed to making sure that any information we hold about you will be collected, stored and used in accordance with The Data Protection Act 2018 and General Data Protection Regulation2016/679 (GDPR).
This means that we adhere to the data protection principles of only holding information about you that is relevant to our work with you, that we make sure the information that we hold is accurate, up to date, secure, and only kept for as long as we need it.

To keep things simple, we have arranged a single point of contact for all data protection issues. Should you have any questions relating to this notice or our processing of personal data, please email [email protected] or contact us at the address below.

Where do we collect your information?

We may collect information about you at a number of stages in your use of our services.

Registration/ Referral

When you register your child or yourself for our services, we will ask you to complete a referral form with details about yourself, your child and other family members.

During your and your child’s engagement with us

Throughout you and your child’s engagement with us, our service team will record information about the service provided to you, including reporting, and reviews.

What Personal Information Do You Record?

The type of information (including personal information) that we collect and use and what we do with it will depend upon your relationship with us. We collect only the personal data that we require to provide you with services, fulfil contracts or keep in touch.

Information about you:

• Name & Address
• Contact Information (email / telephone)
• Date of Birth
• *Ethnicity
• *Health Information – Medical Conditions (medication requirements)
• *Disability Information (Special access)

Information about your child(ren):

• Name & Address
• Contact numbers
• Date of Birth
• *Ethnicity
• *Disability Information
• *Health Information – Medical Conditions (medication requirements)

*Special Categories of Data

Due to the nature of the services we provide, some of the data we collect is sensitive. Information relating to Health, any particular requirements you or your child may have. These are considered to be Special Categories of Data and we are required to take extra care when handling this information.

How do we use your information?

We will only use your information in a fair and transparent manner and where we have a legal basis for doing so.

To provide the services you have agreed to

In order to provide the services that you/your child have registered/ referred for, we will need to communicate with you to arrange meetings and visits to discuss aspects of your requirements. This communication may be via Mail, Email, Telephone or SMS.

Legal basis: legitimate interests

Article 6.1 (f) – Legitimate interests
Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Special category data – will be processed under Article 9 (d)

Article 9 – (g) Reasons of substantial public interest (with a basis in law) Substantial public interest condition set out in DPA 2018 – Condition 18. Safeguarding of children and individuals at risk.

To provide reports to our funders and commissioners

The Incredible Years Parenting Programme is funded by Manchester City Council via NHS – Manchester Foundation Trust. They will require us to provide anonymous reports based on the data collected.

For safeguarding and where legally obliged to do so

In certain, limited situations we may be required to use or disclose your personal information in order to comply with a legal obligation, in connection with a request from a public or government authority, in connection with court proceedings or to prevent loss of life or injury. Where possible and if practical to do so, we will tell you in advance of such disclosure.

Sharing & disclosure

Your information will only be accessed by people who need to do so as part of their role.

• This could include:
  Staff from Family Action, Manchester Foundation Trust Big Life and Manchester City Council
• Staff working at the service that you use; i.e., Health teams / Health visitors / Early Help.

Rights

The GDPR legislation provides you with several rights in relation to your personal data.

Right to withdraw consent

Where you have consented to our processing of your data, you have the right to withdraw that consent at any time.

To do so, please contact: [email protected] or write to us using the details below.

Right to access

You have a right to obtain copies of the information that we hold about you. To request access to any data, please email [email protected] or write to us at the address below explaining which data you require. In the interest of security, you will need to prove your identity before any information can be shared with you. Under certain circumstances we may not be able to disclose all of the information you request, for example if it contains information about other people or there are legal reasons for us to withhold the data.

Right to rectification

We would like to ensure that the data we hold about you is accurate and up-to-date. If you believe the data we hold is inaccurate, please tell one of our service staff who will make any necessary amendments. However, you may also ask us formally to correct your data by emailing [email protected] or writing to us at the below
address.

Right to erasure or the restriction of processing

In certain circumstances you can ask us to remove your data from our systems by emailing [email protected] or writing to us at the below address. If there is a legal reason for us to continue holding the data we will let you know, otherwise we will make efforts to comply with your request. You may ask us to restrict our processing of your data if:

• We are using the data for marketing
• You believe that our processing of the data is unlawful
• You object to us using your data (pending investigation)

In these circumstances, we may continue to store your information, but will otherwise only process it with your consent or where we have a legal reason to do so.

Right to complain

If you are concerned about the way we have processed your personal information, you have the right to complain to the Information Commissioners Officer (ICO). To do so please refer to the ICO website http://ico.org.uk.

Changes

Family Action reserves the right to make changes to our privacy policy from time to time. Where we do so, we will where appropriate notify you by email.

Contact

Should you wish to contact us, our registered address is:

Newton Heath Sure Start Childrens Centre
1 Great Newton Street
Newton Heath
Manchester
M40 1GX

Download the CAPS Manchester Parenting courses Privacy Notice here.

Candidates Privacy Notice

This privacy notice covers the use of personal data if you apply for a position at Family Action or one of our services either as an employee or volunteer.
Family Action (Charity No. 264713) will be the controller of the data for the processing described in this notice.

Family Action needs to process the personal information of candidates as part of the recruitment process in order to assess the suitability of candidates for the position applied for and to ensure the safety of the children and adults with whom we work.

We take the privacy and security of your information extremely seriously and will only use it in a lawful, fair and transparent manner in order to manage our relationship with you and to ensure a fair and efficient recruitment process.

Where do we obtain your information?

Most of the information we hold about you will be provided by you in the form of application forms, CV, disclosure forms etc. that you provide as part of your application.

Additional information will be collected throughout the process:

• During interviews
• from your referees if you are offered a position
• from the Disclosure & Barring Service (DBS) as part of our security checks
• from our digital identity provider (Yoti) as part of our security checks

What information do we process and why?

The information held about you will depend on your individual recruitment process but is likely to include:

• your name and contact details
• details of your qualifications
• employment history
• correspondence with you throughout the recruitment process
• information needed for equal opportunities monitoring (gender, ethnicity etc)
• notes about your interviews with us

If we intend to offer a position we may also collect:

• references provided by previous employers
• DBS details and ID numbers and passport details where required for DBS checks
• Right to Work/Work permit/visa details
• New Starter’s Form details: National Insurance Number, home address, emergency contact, bank details, tax information
• information relating to your health and social circumstances if relevant to the position applied for and ensure any reasonable adjustments required are noted.

We will use the information for these purposes:

• in order to fulfil our obligations to you under your contract of employment or volunteer agreement (GDPR Article 6.1(b))
• to comply with legal requirements, such as the health and safety at work legislation
  (GDPR Article 6.1(c))
• in order to pursue our legitimate business interests, to operate the business efficiently and safely and to protect the company from reputational damage.
  Where we do this, we will ensure that your rights to privacy are not impacted.
  (GDPR Article 6.1(f))
• we may also process information in order to meet our obligations with respect to employment law and safeguarding legislation.
  (GDPR Article 6.1(c))

If information is not provided by you we may, in some cases, not be able to comply with our
obligations. In such circumstances, we will advise you of the implications of your decision.

We will only collect the information required to progress your application at each stage.

Is my data safe?

Family Action takes appropriate precautions to protect the security and integrity of the personal data we hold. Technical and organisational measures have been put in place to protect the information systems on which your data is stored and we require our suppliers and service providers to protect your personal information by contractual means.

Will you share my information with anyone else?

We may disclose information to third party organisations under specific circumstances as listed below. We will only disclose the minimum amount of data necessary to fulfil the purpose of the processing.

Third Party : WR Group Ltd, trading as Webrecruit
Reason: To collect and process applications, as well as to track the applications’ progress.

Third Party: Partner Organisations
Reason: If we are operating a service in partnership with other service providers or the position will involve secondment to another provider.

Third Party: The Disclosure & Barring Service (DBS)
Reason: If the position applied for involves working with children or vulnerable adults or other regulated activity we may be required to obtain information about any criminal convictions you may have.

Third Party: uCheck – our provider for digital DBS checks
Reason: If the position applied for involves working with children or vulnerable adults or other regulated activity we may be required to obtain information about any criminal convictions you may have.

Third Party: Referees
Reason: If we intend to offer a position we will take up references from the referees you have provided.

Third Party: Legal Authorities
Reason: If legally obliged to do so in response to a court order.

Third Party: Yoti Ltd – our provider for the digital Right to Work check and digital identity verification for DBS checks
Reason: If completing a digital Right to Work check and/or digital identity verification for the DBS check.

Transfer of data to other countries

In limited and necessary circumstances, your personal information may be transferred outside of the European Economic Area (EEA). Where such transfers occur, we will assure that adequate protection exists either through appropriate contractual arrangements or as required by law.

How long will we keep your data?

Your personal information will be kept on file during the recruitment process and for up to six months after the recruitment process is completed.

If your application is successful, the data collected will form part of your ongoing employment / volunteer records and will be retained until six years after you cease to work with us.

Your rights

Under the General Data Protection Regulation (GDPR) you have a number of rights with relation to your personal data.

Right To Information

You have the right to be informed about the ways in which your data will be collected and used. This notice has been prepared to provide such information.

Right To Withdraw Consent

In this policy we do not rely on the provision of consent for the processing of your data. However, If you have provided consent for the process of your data you have the right (in certain circumstances) to withdraw that consent at any time.

To do so, you should contact the manager in charge of your recruitment in the first instance or the Data Protection Officer whose details are recorded below.

You should be aware that your withdrawal of consent to processing may mean that we can not consider your application further.

Right To Access

You have the right to request access to the personal information held about you. To request access, you should send a Subject Access Request in writing (stating what information you would like access to) to the Data Protection Officer whose details are below.

Right to Rectification

It is important that the information we hold about you is accurate and up to date. If you believe that your information is inaccurate you should notify your line manager in the first instance.

Right To Erasure

In certain circumstances, you have the right to request that we erase information about you from our files and systems. This will only be possible if there is no other legal basis under which we are obliged to keep the information.

Right To Restrict Processing

You may have the right to request that Family Action restrict the processing of your data if you believe the data to be inaccurate, no longer required or processed unlawfully.

Right to Complain

You have the right to complain to the data protection authorities if you believe that your data is being processed improperly or illegally.

Changes to this policy

Family Action reserves the right to make changes to this policy from time to time. Where changes are made, the details will be posted on the Family Action intranet.
If you have any questions in relation to any of the above, please contact the Data Protection Officer by email at [email protected] or contact the legal team.

Contacting us

Family Action’s data protection team may be contacted at:

Family Action
34 Wharf Road
London, N1 7GR
Tel: 020 7254 6251

Or by email at [email protected]