PRIVACY POLICY
RASASC Guildford Ltd (RASASC) provides information and support services for anyone from across Surrey, over the age of 13 who has been sexually abused or raped (and their family and friends), or who have been affected by sexual violence at any time in their lives.
We are committed to protecting any personal information you provide to us. Any personal information you provide will be processed in the ways described in this privacy policy.
How we use your information
This privacy policy explains how we collect information, what we do with it and what rights you have over it. It applies to information we collect about:
- people who use our services e.g. survivors and family members affected by crime
- people who we notify under the Data Protection Act 1998, such as the emergency services in the event of a safeguarding concern.
- supporters of RASASC e.g. funders; donors, volunteers
RASASC receives survivors’ details from referring organisations who have obtained the survivors consent to do so. These organisations include the police, the Sexual Assault Referral Centre (SARC), GPs, Housing Associations and other services. Survivors can also self-refer.
When RASASC makes initial contact with the survivor we will gain your consent before collecting and processing further personal information. We only use the details we receive to provide our support services to survivors of rape or sexual abuse. For example, we will use the contact details you provide to contact you and will use other information you provide to assess your need for support.
Information we collect about you
We collect some or all of the following information, as applicable to the relevant purpose:
- your name
- your contact details (including postal address, telephone number, email address)
- your date of birth
- your gender
- information relating to your health
- information necessary to assess your suitability for our services
- information relating to other agencies providing support/services
- age, nationality, ethnicity information, marital status, for monitoring purposes
- if you volunteer for us or apply for a job with us, information necessary for us to process applications and assess suitability (which may include things such as employment status, previous experience depending on the context, as well as any unspent criminal convictions or pending court cases you may have)
Personal Data and Sensitive Personal Data
Certain types of personal information are in a special category under data protection laws, as they are considered to be more sensitive.
The definition of sensitive personal data is data consisting of racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health or data concerning a person’s sex life or sexual orientation.
We only collect this type of information if there is a clear reason for us to do so.
How your information is used
RASASC uses the information you provide to us for one or more of the following purposes:
- to provide you with the services or information you asked for
- to understand how we can improve our services and information
- to send you correspondence and communicate with you
- to keep a record of your relationship with us
- to further our charitable objectives
- to generate reports on our work, services and events
- to process applications for funding
- to safeguard our staff, volunteers and survivors who use our services
- to claim gift aid on donations
- to process your application for a job or volunteering role
- to administer our website and monitor website use
- to support community-based fundraising and events
- to audit and administer our accounts
- to send supporters newsletters and marketing information about our projects and fundraising activities where we have your consent
Who your information is shared with
- RASASC may disclose personal information if required to do so by law, and where possible, we will inform you of our obligation before doing so. For example, to Government bodies for tax purposes or law enforcement agencies for the prevention and detection of crime, subject to such bodies providing us with a relevant request in writing.
- For all services we deliver, RASASC may have to break confidentiality if we believe your life or someone else’s life is in danger. In such situations we may need to inform the police or local authority but will always try and talk to you first before we pass this information on.
- Statistical information on our services are provided to funders and other reputable third parties and for other lawful purposes. These statistics will not include any personally identifying information.
How long we keep your information for
We will only keep your information for as long as reasonable and necessary for the relevant activity, which may be to fulfil our statutory obligation and for existing good practice. Details of our data retention policy is at Annex A.
Legal basis for using your information
There are several lawful bases for processing personal data:
- Consent – we must obtain consent at the earliest opportunity and ensure that it is clear, explicit and specific.
- Contract – we have a basis to use your personal information where we are entering into a contract with you or performing our obligations under that contract.
- Legal Obligation – we have a basis to use your personal information where we need to do so to comply with one of our legal or regulatory obligations.
- Vital Interests – we have a basis to use your personal information where it is necessary for us to protect life or health.
- Public task – we have a basis if we need to process personal data in the exercise of official authority or perform a specific task in the public interest.
- Legitimate Interests – we have a basis to use your personal information if it is reasonably necessary for us (or others) to do so and in our/their legitimate interests (provided that what the information is used for is fair and does not unduly impact your rights)
- Special Category data – when we use sensitive personal information
- Criminal offence data – To process personal data about criminal convictions or offences, we must have both a lawful basis under Article 6 and either legal authority or official authority for the processing under Article 10.
Your rights
You have certain rights in respect of the personal information we hold about you:
- to be informed about how and why your personal data is processed
- to access your data
- to rectify your data
- to erasure of your data
- to restrict processing of your data
- to data portability
- to object to processing your data
- not to be subject to fully-automated decision-making including profiling
Any information rights requests are processed by the Data Protection Officer. Request should be made in writing and your request (including providing information on whether the rights apply in the particular circumstances) will be responded to within the applicable statutory time period. If we are not sure of your identity, we may require you to provide further information in order for us to confirm who you are.
Cookies
Cookies are pieces of information that a website transfers to your hard drive to store and sometimes track information about you. Most web browsers automatically accept cookies, but if you prefer, you can change your browser to prevent that. Turning cookies off may result in a loss of functionality when using our website.
Cookies help us to improve our website and deliver a better service.
Complaints
Anyone who feels that RASASC has broken the law can make a complaint. Complaints regarding the processing of personal data should be made to the Data Protection Officer.
Annex A – Data Retention
ACCIDENT BOOKS, RECORDS, REPORTS
3 years from the date of the last entry (or if an accident involves a child/young adult, then until that person reached the age of 21). Special rules apply concerning incidents involving hazardous substances – 40 years from the date of the last entry.
ACCOUNTING RECORDS
6 years.
INCOME TAX AND NI RETURNS, INCOME TAX RECORDS AND CORRESPONDENCE WITH HMRC
3 years from the end of the tax year to which they relate
HMRC RECORDS: P60S, P45S AND ANY FORMAL REPORTS TO HMRC
6+1 years after the end of the tax year to which they relate
RECORDS RELATING TO CHILDREN AND YOUNG ADULTS
Until they reach 21 years of age
RECORDS RELATING TO ADULT CLIENTS (ALL SERVICES)
6 years after the end of service
EMPLOYEES AND VOLUNTEERS
APPLICATION FORMS AND INTERVIEW NOTES – FOR UNSUCCESSFUL CANDIDATES
1 year after the candidate has been notified that they are unsuccessful.
ASSESSMENTS UNDER HEALTH AND SAFETY REGULATIONS AND RECORDS OF CONSULTATIONS WITH SAFETY REPRESENTATIVES AND COMMITTEES
Permanently
IMMIGRATION CHECKS
2 years from termination of employment
INLAND REVENUE/HMRC APPROVALS: PERMANENT EXEMPTIONS GRANTED TO RASASC
Permanently
MATERNITY/ADOPTION/PARENTAL/SHARED PARENTAL LEAVE
3 years after the end of the tax year in which the maternity/adoption/Parental/Shared Parental pay period ends
PENSION AUTO ENROLMENT RECORDS
6 years, with the exception of opt out notices, which must be kept for 4 years.
PERSONNEL FILES AND TRAINING RECORDS
6 years after employment ceases.
REDUNDANCY DETAILS, CALCULATIONS OF PAYMENTS, REFUNDS, NOTIFICATION
3 years from the end of the tax year to which they relate
SALARY RECORDS INCLUDING OVERTIME, EXPENSES AND BONUSES
3 years from the end of the tax year to which they relate
SENIOR EXECUTIVE RECORDS (THOSE ON A SENIOR MANAGEMENT TEAM OR THEIR EQUIVALENT)
Permanently for historical purpose
STATUTORY SICK PAY RECORDS, CALCULATIONS, CERTIFICATE, SELF-CERTIFICATES
6 years after employment ceases.
TRUSTEES’ MINUTES
Permanently
