Privacy Policy Privacy Notice Sexual Trauma and Recovery Service – Dorset Rape Crisis (STARS Dorset) is committed to protecting the privacy of everyone who uses our services; as clients, as employees, as freelance workers, trustees and volunteers; and that of anyone who supports our work through fundraising. This statement explains what personal data we collect and process, how we collect it, whom we share it with, and why we do so. It also explains the steps we take to keep data secure. If you have difficulty understanding this information or any questions about this privacy statement or our privacy and data processing in general, please contact our Head Office either by: Writing: Sexual Trauma and Recovery Centre – Dorset Rape Crisis PO BOX 7697, POOLE, BH15 9GN Email: [email protected] Telephone: 01202 308840 What is Personal Data? By personal data we mean information that might allow you to be identified, such as your name, address, date of birth and I.P. Address. Some of the data we collect may be sensitive in nature e.g. it can relate to health and wellbeing. Our Privacy Principles We will look after any personal information that you share with us. This is central to our values as an organisation. We want everyone who comes to us for support, those who volunteer with us, those who fundraise for us, our employees and our trustees to feel confident about how any personal information they share with us will be looked after or used. This policy explains how we do this and tells you about your privacy rights and how the law protects you. You can be confident that: We only use personal information in the ways we need to and that is expected of us. We ensure that our data processor (BDS) adheres to all relevant legislation and that our customer relationship system is managed in accordance with GDPR. We will keep you up to date with our work, including how we are campaigning to improve services, raising awareness, promoting understanding as well as our fundraising activities. But, we only use your personal information to do this if you have previously told us that is OK. We will make it easy for you to tell us how you want us to communicate with you, including how to opt out from future communications – and we promise your request will be respected straight away. We will never release your information to organisations outside STARS Dorset for their marketing purposes. We will be especially careful and sensitive when engaging with vulnerable people or those we have reason to believe might be vulnerable. We take all reasonable care to safeguard your personal information through security policies and secure business processes. We will always provide easy ways for you to contact us. Our Data Protection Officer is happy to answer any queries you have, at any time. Privacy Policy How we collect personal information about you: We may collect personal information from you when you interact with STARS or a third party refers you to our service. There are many occasions when this could happen, for example: if you register with us for support, attend our training, events or seminars, make a donation to us, enquire about our services, fundraise for us, apply for a job or volunteering opportunity or if a third party refers you to our service. This may also happen when you visit our website, contact us by phone, email, through the post, or in person. What information do we collect? What do we use this for? If you fundraise for us: The personal information we collect about you for the purposes of our fundraising activities might include your name, address, email, phone number, date of birth, I.P. address, and financial information such as the amount you have donated or raised for us. If you attend our training or presentations / seminars This might include your name, address, email, phone number, work place. We will store this information until the event has taken place after which we will securely destroy this information; if you have opted to be contacted about future training or presentation sessions, we will retain your name and contact details until you opt out. If you volunteer with us We will collect your name, address, email, phone number and next of kin details. If you work directly with clients we will hold details of your Disclosure and Barring Service and if you are a placement counsellor your insurance details and qualifications. Working for us If you apply for a job with us we will hold application details for 6 months after your application then destroy them securely. We collect personal data about job applicants and employees for administrative purposes and in order to comply with employment and safeguarding legislation, such as referrals to the Disclosure and Barring Service. If you take a job with us you will receive details on what we hold and how we manage it while you are an employee and after you leave. If you are a client If you use our face to face services we collect information such as your name, age, address, gender and ethnic origin, GP details, details of any children you have or live with, any other services you are working with, any vulnerabilities you may have such as a physical disability , alcohol dependency or a mental health issue, as well as information you provide regarding your assault and any correspondence that takes place between us and yourselves. We may also collect some information about family members / carers. We also receive data about our clients and their families and carers from other healthcare providers. When we collect data from clients and their families, we do so in order to provide the best possible service and to make sure we are the correct service for them. We collate this information and anonymise to present to funders in line with our contractual obligations to allow us to continue to provide our services. We also collect and store non-personal information for the purposes of audit, quality control, and incident reporting. We only share records with other healthcare providers/ police where client consent is given. Unless we receive a court order requesting information, or it is in the matter of a safeguarding concern and/or deemed to be in the public interest i.e. acts of terrorism/serious crime. Only professionals with a need to know are able to access this information. In accordance with your rights, you may at any time request a copy of any information held on you. You can also require us to update, correct or delete any information we hold about you and/or no longer use it. We use a data processor (BDS) to store this information securely and we ensure it is GDPR compliant at all times. Who has access to your information? We never sell or swap your details with third parties for marketing purposes. We may share data you provide with trusted third parties or subcontractors for specific tasks but our contracts with them keep your data safe. We may need to share some information by law with our regulators or law enforcement authorities or if it is a matter of safeguarding concern and/or deemed to be in the public interest. How do we use personal information? We may use your personal information to: Provide you with the important information, guidance and support you’ve asked us for, whether this be over our helplines, from face-to-face contact, through our information or other services for example our wellbeing classes or Livechat; Provide or administer activities relating to all our services: updating you with important administrative messages, to help us identify you when you contact us, and help us to properly maintain our records; Improve your experience with us. We may use your information to enhance the services that our staff and volunteers provide, to improve our information and communications, or to personalise the website to better suit your needs; Analyse the personal information we collect about you so that we can better understand our clients’ needs; our supporters, their preferences, needs and important trends. We may need to disclose your information if required to do so by law, but we will always ask for your consent. We will not pass on your details to anyone else without your express permission except in exceptional circumstances such as Safeguarding. Examples of this might include anyone reporting serious self-harm or posing a threat to others, or children contacting us and sharing serious issues. You can ask us at any time to change how we contact you, simply contact [email protected] If you provide us with any Sensitive Personal Data by telephone, email or by other means, we will treat that information with extra care and always in accordance with this Privacy Policy. Your personal information and details of the enquiries received are stored on both a secure database and on paper in a securely locked filing cabinet for no longer than is necessary for the purposes of its use. We carry out periodic deletion of data whose retention period has expired and/or when the need to continue holding such data is no longer necessary and in accordance with our Retention of Records policy. In law, we are allowed to use personal information, including sharing it outside of STARS BUT only if we have a proper reason to do so, for example: To fulfil a contract with you ie. to provide you with our specialist support service and to communicate with you about your appointments When it is in our legitimate interest to enable us to deliver the services you have requested When you consent to it: we will always ask for your consent to hold and use your personal data Who sees your personal information? The personal information we collect about you will be used by our staff and volunteers at STARS Dorset so that they can support you; and possibly to legal and regulatory authorities if required to by law. We use an external company as our data processor to manage our Customer Relationship system, which is called BDS. They are fully compliant with GDPR and we take steps to ensure they adhere to all relevant legislation. We will never sell or share your personal information with organisations so that they can contact you for any marketing activities. Nor do we sell any information about your web browsing activity. We will not share your information with any other third party without your consent except to help prevent fraud, we receive a court order requesting information, or it is in the matter of a serious safeguarding concern and/or deemed to be in the public interest i.e. acts of terrorism/serious crime. Your information security We take the security of your personal information extremely seriously. We’ve implemented appropriate physical, technical and organisational measures to protect the personal information we have under our control, both on and off-line, from improper access, use, alteration, destruction and loss. We only keep it as long as is reasonable and necessary, which may be to fulfil statutory obligations (for example, the collection of Gift Aid). Here are some of the ways we protect your personal information: If you provide personal information to us online that information is encrypted for protection on transmission to us. Encryption is the process through which sensitive information is scrambled before it is transmitted so that it remains private even if it is intercepted. However, unless your internet browser supports this you will not be able to take advantage of this level of security. Offline, your personal information is kept securely in our databases and offices. Our website may contain links to other sites. While we try to link only to sites that share our high standards and respect for privacy, we are not responsible for the content or the privacy practices employed by other sites. Please be aware that websites that have links on our site may collect personally identifiable information about you. This privacy statement does not cover the information practices of those websites. How to update or access your personal information We want to make sure that your personal information is accurate and up-to-date. You may ask us to correct or remove information you think is inaccurate. You have the right to request a copy of the personal information that we hold about you. This will normally be free, unless we consider the request to be unfounded or excessive, in which case we may charge a fee to cover our administration costs. You may ask us at any time to update your details, correct or remove information you think is inaccurate by contacting us. You also have a right to know what personal information STARS Dorset holds about you. To update any details or request a copy of your personal information we hold, contact us by: Writing: Sexual Trauma and Recovery Service – Dorset Rape Crisis PO BOX 7697, POOLE, BH15 9GN Email: [email protected] Telephone: 01202 308840 For clients under the age of sixteen we seek parental consent to work with the child and details of how and what we keep is explained on our Children and Young People’s Privacy Notice. Marketing We will only send you information, news and updates about the charity if you have subscribed to our Supporters database. If you have consented to be a Supporter we will send you information about our latest news, updates, volunteering opportunities, and events which may be of interest to you. We will ask for your consent to receive this information when you sign up to be a Supporter. If you have consented to receiving our news and updates, you may opt out at a later date by contacting [email protected] Volunteers and Employees will be sent news and regular updates about the charity. Using Our Website We also gather general information about the use of our website, such as which pages users visit most often and which services, events or facilities are of most interest. We may also track which pages users visit when they click on links in STARS Dorset emails. We may use this information to personalise the way our websites are presented when users visit them, to make improvements to our websites and to ensure we provide the best service for users. Wherever possible we use aggregated or anonymous information which does not identify individual visitors to our websites. The type of personal information collected We collect certain personal information about visitors and users of the site like website queries via our volunteering form, contact form and web analytics data via Google Analytics. Google Analytics uses cookies to record certain information which is generally anonymous information and does not reveal the visitor's identity. If the visitor is logged into their Google account some of this information could be associated with their account. These are the following kinds of details: IP address or proxy server IP address’; the domain name requested; the name of their internet service provider is sometimes captured depending on the configuration of their ISP connection; the date and time of visit to the website; the length of session; the pages accessed; the number of times the visitor accesses the site within any month; the file URL looked at and information relating to it; the website which referred the visitor to DRCSC website the operating system which their computer uses. How personal information is collected Personal information is collected directly when a visitor provides it to STARS Dorset when completing the volunteering or contact online forms. Cookies ‘Cookie’ is a name for a small file, usually of letters and numbers, which is downloaded onto your device, like your computer, mobile phone or tablet when you visit a website. They let websites recognise your device, so that the sites can work, or work better, and also gather information about how you use the site. A cookie, by itself, can’t be used to identify you. For more general information on cookies, see http://www.allaboutcookies.org. The website uses cookies for logged in users only so will not apply to general visitors to the website. How do we use cookies? We use traffic log cookies to identify which pages are being used. This helps us analyse data about web page traffic and improve our website in order to tailor it to customer needs. We only use this information for statistical analysis purposes and then the data is removed from the system. Overall, cookies help us provide you with a better website, by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us. You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may however prevent you from taking full advantage of the website. To remove cookies, follow the instructions of your browser: Internet Explorer: http://windows.microsoft.com/en-GB/internet-explorer/internet-explorer-help Firefox: http://support.mozilla.org/en-US/home Chrome: http://support.google.com/chrome/?hl=en Safari: http://www.apple.com/support/safari/ Opera: http://www.opera.com/support/ For more information please see the Information Commissioner’s Office website: http://www.ico.gov.uk/news/current_topics/changes-to-cookies-on-our-website.aspx OTHER WEBSITES Our website includes links to other websites. This privacy notice only applies to this website so when you link to other websites you should read their own privacy notices. CHANGES TO OUR PRIVACY NOTICE All personal data is collected and stored securely in accordance with the principles of the GDPR. This policy and our privacy notices are kept under regular review and any updates will be posted on our website. This policy was last updated on May 2020. HOW TO CONTACT US Please contact us if you have any questions about our privacy policy or information we hold about you: Writing: Sexual Trauma and Recovery Centre – Dorset Rape Crisis PO BOX 7697, POOLE, BH15 9GN Email: [email protected] Telephone: 01202 308840 You also have the right to complain to the Information Commissioner’s Office. Find out on their website how to report a concern: www.ico.org.uk/concerns/handling Your data may also be available to our website provider to enable us and them to deliver their service to us, carry out analysis and research on demographics, interests and behaviour of our users and supporters to help us gain a better understanding of them to enable us to improve our services. This may include connecting data we receive from you on the website to data available from other sources. Your personally identifiable data will only be used where it is necessary for the analysis required, and where your interests for privacy are not deemed to outweigh their legitimate interests in developing new services for us. In the case of this activity the following will apply: Your data will be made available to our website provider The data that may be available to them include any of the data we collect as described in this privacy policy. Our website provider will not transfer your data to any other third party, or transfer your data outside of the EEA. They will store your data for a maximum of 7 years. This processing does not affect your rights as detailed in this privacy policy.