What is a privacy notice?
Edinburgh Women’s Aid (“EWA”) wants to ensure you understand our processing of your personal data. We are also required by data protection regulation to explain certain matters to you. This notice sets out that information.
This privacy notice tells you what to expect when EWA collects personal information. It applies to information we collect about:
• People who use our services; including
People who contact us via social media
People who call our helpline
People who email us
Individuals applying for an EVOC grant and/or housing benefit as part of their service from us;
If you are looking at this notice on our website, you can click on the link to see what to expect for each source of information.
Our lawful basis for processing data:
The lawful basis upon which we collect and process personal data is legitimate interests. We need to provide evidence of the work we have done to our funders and our data processing enables us to do this effectively. People who use our services will reasonably expect that we need their name and contact details in order to contact them and to continue the service, that we would retain support and safety plans to monitor the progress of their service, and that we will retain any information which is reasonably necessary for us to provide our services e.g. personal data which is provided in order to assist us in making a benefit application on behalf of an individual. Data processing is necessary to achieve this.
We also recognise individuals’ rights and freedoms and the added responsibility which processing data on the basis of legitimate interests affords us. Therefore we will not refuse our services to a service user who does not wish to provide us with personal information or who does not wish their support sessions to be recorded, or to have a risk assessment completed or use a support or safety plan. If a service user requests at any time that their personal data is deleted from our system we will comply with their request. However, our ability to provide services may be negatively impacted if we don’t have a service user’s personal data (e.g. their contact details).
People who use our services.
We have to hold the details of the people who have requested the service in order to provide it. However, we only use these details to provide the service the person has requested and for other closely related purposes.
Closely related purposes may include contacting people who have used our service to complete a survey about their experience of our service, or to invite them to events or to meet with our funders or regulators.
Limited personal information may be required by funders to evidence that public funds are being used appropriately.
For all people who use our services we will collect and hold:
• Personal information (such as name and address, telephone number, email address, national insurance number)
• Characteristics (such as ethnicity, language, nationality)
• Support information (such as support plan, safety plan, risk assessment, notes from meetings, group sessions attended)
Why we collect and use this information:
We use the data:
• to monitor and report on progress
• to provide appropriate support and care
• to check the quality of our services
• to report to funders on the work we carry out
• to comply with the law regarding data sharing
We will hold personal data about people using our services for six years from their last point of contact.
Some of the data that people using our services provide us with might include sensitive personal data. This includes information about medical conditions or criminal activity. We will not process any sensitive information about you without your express consent.
People who contact us via social media
We have a Facebook page and a Twitter account. Please be aware that these pages are public and if you contact us via the public elements of these social media, the content of your enquiry will be public. We will delete any individual messages sent to us on social media at the earliest opportunity and respond via direct or private messaging. If you send us a private or direct message via social media the message will be stored for three months. Messages sent by these methods are subject to the privacy notices of the relevant companies running these services.
People who call our helpline
When you call EWA’s helpline we will collect personal information about you and will make notes of the content of your call and will record these on our secure case management system. This is to enable us to provide our service and allow call takers to work with you on future calls.
Our helpline also offers a translation service for customers when English is not their first language and we do not have a member of staff available to provide support in the service user’s first language. This is provided by a third party company. The company that provides this service does not retain any information from the calls or record them.
People who email us
Email communication from service users and any replies that we make are copied into the service users own file within our secure case management system and deleted from the email system within three months. We only communicate by email with service users who have given permission for this and who have informed us that their email address is safe.
Any legitimate information sharing by email which contains any personal information about service users between EWA and any third party is done through our secure, encrypted CJSM email system.
Any email sent to EWA, including any attachments, may be monitored and used by us for reasons of security and for monitoring compliance with office policy. Email monitoring or blocking software may also be used. Please be aware that you have a responsibility to ensure that any email you send to us is within the bounds of the law.
Individuals applying for an EVOC grant or Housing Benefit as part of their service from EWA
Any personal information that is provided in the applications for the above financial awards are used only for the purpose of reviewing the application and the ongoing administration and management of any finances that are awarded.
Once the application is submitted, it will be subject to the data privacy arrangements of the agencies concerned.
People who make a complaint to EWA
When we receive a complaint from a person we make up a file containing the details of the complaint. This normally contains the identity of the complainant and any other individuals involved in the complaint. This file is kept securely in a password protected file on our server.
We will only use the personal information we collect to process the complaint and to check on the level of service we provide. We compile and share statistics showing information such as the number of complaints we receive, but not in a form which identifies anyone.
We usually have to disclose the complainant’s identity to whoever the complaint is about. This is inevitable where, for example, the accuracy of a person’s record is in dispute. If a complainant doesn’t want information identifying him or her to be disclosed, we will try to respect that. However, it may not be possible to handle a complaint on an anonymous basis.
We will keep personal information contained in complaint files in line with our retention policy. This means that information relating to a complaint will be retained for five years from closure to enable us to assess any patterns of complaint over a period of time. It will be retained in a secure environment and access to it will be restricted according to the ‘need to know’ principle.
Some of our services are regulated by the Care Inspectorate and we must share information with them on complaints that we receive and this will include the complainant’s identity and any individual the complaint is about. Information is shared with the Care Inspectorate via their secure online portal and processed and retained by them in line with their retention policies.
EWA’s funders may require us to provide information about complaints we have received. In such cases we will provide information in an anonymised format unless we have sought express permission from the complainant to share their personal information.
Similarly, where enquiries are submitted to EWA, we will only use the information supplied to us to deal with the enquiry and any subsequent issues, and to check on the level of service we provide.
People who support EWA.
Any personal information that is provided by individuals to support EWA will be retained for the following periods:
• Individuals making one off donations – personal information will be retained for two years so that the donation can be acknowledged in the relevant annual report.
• Individuals making regular donations – personal information will be retained for two years following the last donation so that the donation can be acknowledged in the relevant annual report.
• Individuals offering support in the form of political or lobbying support – personal information will be retained for two years following the last active contact.
• Individuals offering support in the form of volunteering – personal information will be processed as per our privacy statement for applicants, employees and volunteers.
Individuals Connected to People who use our services
We process the personal data of individuals connected to people using our service in order to provide our service. We collect and retain this information from public sources, for example the Sheriff and Crown courts in Edinburgh and we process it as part of our contract to provide information and support to witnesses in criminal cases related to domestic abuse.
We also process the personal data of individuals connected to people using our service as part of our role on multi agency risk reduction partnerships. We only process this information in order to protect the lives of people using our service.
You have certain rights in relation to the personal data which we process about you:
• You have the right to be provided with clear, transparent and easily understandable information about how we use your personal data and your rights; this is why we are providing you with this privacy notice.
• You can request to access your personal data.
• You have the right to restrict some processing of your personal information, which means that you can ask us to limit what we do with it;
• Subject to certain limitations (normally where there is a continuing need for us to process the data), you can object to the processing of your personal data, or you can request that it be erased.
• Where we hold data that is inaccurate, you can ask us to complete or rectify this.
• You also have the right to complain – please see below.
Complaints or queries
EWA tries to meet the highest standards when collecting and using personal information. For this reason, we take any complaints we receive about this very seriously. We encourage people to bring it to our attention if they think that our collection or use of information is unfair, misleading or inappropriate. We would also welcome any suggestions for improving our procedures.
This privacy notice was drafted with brevity and clarity in mind. It does not provide exhaustive detail of all aspects of EWA’s collection and use of personal information. However, we are happy to provide any additional information or explanation needed. Any requests for this should be sent to the address below.
If you want to make a complaint about the way we have processed your personal information, you can contact us at email@example.com . If you are unhappy with our response, you can complain to the ICO in their capacity as the statutory body which oversees data protection law – www.ICO.org.uk/concerns.
Access to personal information
EWA tries to be as open as it can be in terms of giving people access to their personal information. Individuals can find out if we hold any personal information by making a ‘subject access request’ under the Data Protection Act 1998. If we do hold information about you we will:
• give you a description of it;
• tell you why we are holding it;
• tell you who it could be disclosed to; and
• let you have a copy of the information in an intelligible form.
To make a request to the EWA for any personal information we may hold you need to put the request in writing marked for the attention of the Data Controller and sent to the email or postal address provided below.
If you agree, we will try to deal with your request informally, for example by providing you with the specific information you need over the telephone.
If we do hold information about you, you can ask us to correct any mistakes by, once again, sending an email or letter to the Data Controller at the addresses set out below.
Disclosure of personal information
Sometimes it is helpful for us to share the information you give us or to obtain information about you from other services. However, we will not pass on any or collect information without your consent, other than in the following circumstances:
• Where we have a statutory duty to do so in order to protect you, prevent harm to someone else, for example a child, or prevent or detect a crime. If we have to share information in these situations, we will only share information that will improve your and/or your child[ren]’s safety. We will always try and tell you when information is being shared unless it is not safe for you or someone else or we can’t contact you. Further information is available in our Child and Adult Protection Policies about the factors we consider when deciding whether information should be disclosed.
• Service users’ names and dates of birth may also be shared with our funders’ monitoring officers as evidence of legitimate use of public funds.
• EWA is regulated by the Care Inspectorate and monitoring officers from this agency may require access to case files during monitoring visits to review EWA’s practice. No personal information will be processed or removed during monitoring visits by the Care Inspectorate, unless there is a statutory requirement for this. The Care Inspectorate may also require EWA to provide details of reportable incidents. Any personal data shared with them will be limited to that which is necessary for the Care Inspectorate to investigate the incident and will be shared only through the Care Inspectorate’s secure portal.
Links to other websites
This privacy notice does not cover the links within this site linking to other websites. We encourage you to read the privacy statements on the other websites you visit.
Changes to this privacy notice
We keep our privacy notice under regular review. This privacy notice was last updated on May 2018.
How to contact us
If you have any questions or concerns about any information in this privacy notice, you should contact our representative on data privacy issues, namely Linda Rodgers at EWA, 4 Cheyne Street, Edinburgh, EH4 1JD, firstname.lastname@example.org, 0131 315 8111.