Privacy Policy

Data Privacy Notice

HLFS is committed to a policy of protecting the rights and privacy of individuals, including Service Users, Staff, Volunteers and Trustees in accordance with Prevailing UK Data Laws.

HLFS processes your personal information to meet our legal, statutory and contractual obligations and to provide you with our products and services. We will never collect any unnecessary personal data from you and do not process your information in any way, other than already specified in this notice. HLFS needs to process personal information about its Service Users, Staff, Volunteers and Trustees for various purposes such as, but not limited to: 

  1. Providing a range of support to Service Users
  2. The recruitment and payment of Staff
  3. The recruitment of Volunteers
  4. The recruitment of Trustees
  5. Complying with legal obligations to funding bodies and the organisations we work with to provide our services

Scope 

Agencies and individuals working with HLFS, who have access or require access to personal information, will be expected to comply with HLFS’s Data Privacy Policy. 

This Notice will be updated as necessary to reflect best practice in data management, security and control and to ensure compliance with any changes or amendments to the prevailing UK Data Laws and other relevant legislation. 

Responsibilities under Data Laws 

HLFS is a “Data Controller”; this means we determine the purposes and means of processing data. We are responsible for ensuring any personal data we hold is processed in compliance with the prevailing UK Data Laws.

“Personal data” refers to any information relating to an identifiable person who can be directly or indirectly identified using particular personal identifiers. 

The Data Laws apply to personal data held in automated systems and in manual filing systems. 

HLFS Data Protection Principles 

1.  Process Data lawfully, fairly and in a transparent manner in relation to individuals.

We have created this Privacy Notice that sets out our legal basis for:

  • collecting and processing personal data
  • how we use the data
  • how the data is securely stored and destroyed

We have ensured that our Privacy Notice is clearly written and easy for Service Users, Volunteers and Staff and Trustees to understand.

2. Data will be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes.

We will ensure that all data collected will only be used for the purposes stated in our Privacy Notice.

3. Data will be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.

We will only collect data we need to enable us to provide suitable support to our Service Users. 

4. Data will be accurate and kept up to date.

We will ensure that any inaccurate data or any changes to circumstances are noted and amended. We will regularly check with our Services Users to make sure we have accurate information.

5. Data will not be kept for longer than is necessary for the purposes for which the personal data is processed.

We archive our closed files by year of deletion. We annually delete files that are no longer required; this includes secure destruction of manual and electronic files.  Our Records Management policy states our retention periods.

Data that we may capture and process:

Personal Data may include (but not restricted to):

  • Name
  • Date of Birth
  • Relevant Address(es)
  • Personal/work Email
  • Home/work/mobile Telephone Numbers
  • National Insurance Number
  • Special Category Data for Service Users (i.e. health/medical information, details about religion, sexuality, gender etc)
  • Legitimate Interest Information – personal information about you and your situation which is required in order to provide the services.
  • Additional information will be retained for staff members and Trustees:
    • Information pertaining to other jobs, roles
    • Sickness and health records required to demonstrate adherence to employment laws
    • Data relating to role and performance in that role

Data Laws list “special categories of personal data” which include:

HLFS may require to capture and capture and hold special categories (or sensitive personal data) in order to provide the services and ensure an appropriate duty of care is delivered.  Where such data is collected, HLFS will take care to ensure that this data is used only for the stated purpose and will be stored, retained and secured according to the appropriate policies and data laws. Such data may include:

  • personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership
  • genetic and biometric data
  • data concerning health, sex life or sexual orientation

How We Will Collect Data:

We may collect personal information in the following ways:- 

  • Direct from you when you agree to receive information from us by mailing or email 
  • Visit our website 
  • Donate to or fundraise for HLFS
  • Receive a service from HLFS
  • Engage with us via Social Media
  • Submit a job application
  • Submit a volunteer application or Enquiry
  • Referral forms regarding service users or trainees 
  • When you have given permission to other organisations to share your information.
  • When we deliver services as part of a contract 
  • Via independent event organisers or fundraising sites
  • Cookies: are very small files that are stored on your computer or smart device when you visit our website. We use cookies to collect information about how visitors use our website and to make it better/easier to use.

6. Data will be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage.

We will ensure that all personal data is accessible only to those who have a valid reason for using it.  We have appropriate security measures in place which include:

  • keeping hard copy personal data in locked cabinets with controlled key access
  • archived data is stored in locked cabinets with controlled key access
  • using lock bags to transport any personal data out of the office, all lock bags are returned to the office at the end of the day
  • taking no identifiable information to home visits
  • ensuring data held electronically is password protected
  • ensuring secure email is used for personal and confidential data
  • gathering Data Law compliance information from our IT support and suppliers
  • ensuring PCs, tablets and phones are password protected when unattended.
  • ensuring that PC, tablet or phone screens are not visible to others
  • requiring Staff, Volunteers and Trustees to delete notes and copies of files
  • ensuring conversations are not held in public relating to HLFS’s work
  • seeking appropriate permissions to take and use photographs of individuals for use in publications or on our website
  • ensuring all personal data is disposed of securely. 
  • ensuring that all new projects and services consider privacy and data protection from the start, we will utilise Privacy Impact Assessments (PIAs) where relevant

Lawful Basis For Processing Data

The GDPR requires HLFS to have a valid lawful basis for processing personal data.

GDPR sets a high standard for consent. Consent means offering individuals real choice and control. Genuine consent must put individuals in charge and build trust and engagement.

1. Consent

HLFS will offer individuals choice and control over their personal information. All data subjects must actively and knowingly opt-in to consent.  They must be made aware of what they opting in for, what it will be used for and the length of time for which it will be kept.

HLFS will not share personal data with third parties other than professionals or organisations directly involved in our service provision.  Details of such professionals/organisations will be provided to data subjects.

Consent is gained from Service Users during a face-to-face meeting with a member of HLFS Staff. This Staff member explains the Privacy Notice and information on how HLFS may use and share this information to the Service User and witnesses the consent given by the Service User’s signature.

We include details of how Service Users can withdraw consent and how they can complain if they feel there is a problem with how we processed their data. We provide contact details for the Information Commissioner’s Office.

2. Vital Interests

Vital interests can be used as a lawful basis if we need to process personal data to protect someone from harm or where we believe a law could be broken. Where there is a child protection concern, we have a duty to pass this on to the relevant professionals. We will inform Service Users of this at the time, as long as there is no significant risk to the child by doing so.

Subject Access Rights (SARs) 

Individuals have a right to access any personal data relating to them that is held by HLFS. Any Service User, Staff member, Volunteer or Trustee wishing to access their personal data can contact HLFS to make a Subject Access Request. All Subject Access Requests, regardless of method of contact, must be logged in the SAR Logbook by the Manager or Depute Manager in order to ensure requests are dealt with within the 30 day time frame. The Data Laws also introduce a right for individuals to have their personal data erased. This is known as ‘the right to be forgotten’.

Visitors to Our Web-sites

When someone visits https://homelinkfamilysupport.org/  we use a third party service, (Google Analytics), to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site. This information is only processed in a way which does not identify anyone. 

People who contact us via social media: We manage our own social media interactions. We might obtain your personal data through your use of social media such as Facebook and Twitter, depending on your settings or the privacy policies of these social media and messaging services. To change your settings on these services, please refer to their privacy notices, which will tell you how to do this. 

We recommend that if you choose to email HLFS that you take appropriate measures to ensure that you use sufficient security protocols to ensure that your emails are protected.  HLFS will scan any emails sent to us, including file attachments, for viruses or malicious software.

Your Rights Under Data Laws

Under the current UK Data Laws, you have rights as an individual in relation to the information we hold about you.  You have the Right to: 

  • Make a Subject Access Request to request a copy of the personal information we hold.  We will not make a charge for this service but the request must be reasonable. HLFS will provide this information within 1 month.
  • Object to the processing of your personal information.  This must be reasonable and be consistent with our legal obligations and legitimate interests
  • Object to the use of automated decision-making and profiling – HLFS do not use processes which will automate decision making or profile your personal data
  • Restrict the processing of your personal information.  HLFS will use your personal daa within the context of it’s Legitimate Interests and as required by legal obligations
  • Ask for a copy of your personal data to transfer to another service provider (known as data portability)
  • Rectify or correct your personal information where the data contains errors.  Where the request is reasonable, HLFS will correct any data/information held within 1 month.
  • Have your personal information erased/removed from Home Link paper or computer systems (known as right to be forgotten). Where you have provided consent to be contacted or to receive a service, you will be entitled to withdraw that consent at any time. HLFS require to adhere to prevailing laws and regulations when considering whether such requests can be completed. 

Data Breaches

The current UK Data Laws makes it the duty of organisations to report data breaches to the Information Commissioner’s Office. This must be done within 72 hours of becoming aware of the breach, where feasible.

Personal data breaches can include:

  • access by an unauthorised third party
  • deliberate or accidental action (or inaction) by a controller or processor
  • sending personal data to an incorrect recipient
  • computing devices containing personal data being lost or stolen 
  • alteration of personal data without permission
  • loss of availability of personal data

If the breach is likely to result in a high risk of adversely affecting individuals’ rights and freedoms, we must also inform those individuals without undue delay.

The HLFS Manager, acting in the capacity of the Data Officer for HLFS will record, investigate and decide on appropriate measures where a data breach (or a near miss) has occurred.  This allows us to decide whether or not we need to notify the relevant supervisory authority and the affected individuals. 

Serious breaches of personal data can incur a substantial fine for the organisation and can result in Staff dismissal where a member of Staff is found responsible for the breach.

We will keep a record of any personal data breaches, regardless of whether we are required to notify the Information Commissioner’s Office.

Reporting a Breach of Data Privacy

If a data subject believes that a breach has occurred, they may make a report directly to the Information Commissioner’s Office.  Details on how to report a breach can be found at:  https://ico.org.uk/for-the-public/

Alternatively you can call the Information Commissioner’s Office on: 0303 123 1113.

This policy has been updated to reflect The Data Protection Act 2018 which implemented the General Data Protection Regulation (GDPR). This may be updated from time to time to reflect updates to the said Act.

If you want to request information about our privacy policy you can 

Email us at info@homelinkfamilysupport.org

Write to: Home Link Family Support, 1 Dalkeith Road Mews, Dalkeith Road, Edinburgh EH16 5GA 

Reviewed January 2023

Please click on the following link to access our Safeguarding Policy

https://homelinkfamilysupport.org/wp-content/uploads/2023/05/Child-Protection-Policy-Review-2023.pdf

To access services from Home Link Family Support or volunteer with us please get in touch.

Contact Us