Privacy notice

This privacy notice tells you what to expect when WASLER collects personal information. It applies to information we collect about:

• People who use our services; including
• People who contact us via social media
• People who call our helpline
• People who email us
• Individuals applying for a grant and/or housing benefit as part of their service from us;
• People who make a complaint to us; and
• People who support our service.

Our lawful basis for processing data:

The lawful basis upon which we collect and process personal data is legitimate interests. We need to provide evidence of the work we have done to our funders and our data processing enables us to do this effectively. People who use our services will reasonably expect that we need their name and contact details in order to contact them and to continue the service, that we would retain support and safety plans to monitor the progress of their service, and that we will retain any information which is reasonably necessary for us to provide our services e.g. personal data which is provided in order to assist us in making a benefit application on behalf of an individual. Data processing is necessary to achieve this.

We also recognise individuals’ rights and freedoms and the added responsibility which processing data on the basis of legitimate interests affords us. Therefore we will not refuse our services to a service user who does not wish to provide us with personal information or who does not wish their support sessions to be recorded, or to have a risk assessment completed or use a support or safety plan. If a service user requests at any time that their personal data is deleted from our system we will comply with their request. However, our ability to provide services may be negatively impacted if we don’t have a service user’s personal data (e.g. their contact details).

People who use our services.

We have to hold the details of the people who have requested the service in order to provide it. However, we only use these details to provide the service the person has requested and for other closely related purposes.

Closely related purposes may include contacting people who have used our service to complete a survey about their experience of our service, or to invite them to events or to meet with our funders or regulators.

Limited personal information may be required by funders to evidence that public funds are being used appropriately.

For all people who use our services we will collect and hold:

• Personal information (such as name and address, telephone number, email address, national insurance number)
• Characteristics (such as ethnicity, language, nationality)
• Support information (such as support plan, safety plan, risk assessment, notes from meetings, group sessions attended)

Why we collect and use this information:

We use the data:

• to monitor and report on progress
• to provide appropriate support and care
• to check the quality of our services
• to report to funders on the work we carry out
• to comply with the law regarding data sharing

We will hold personal data about people using our services for six years from their last point of contact.

Some of the data that people using our services provide us with might include sensitive personal data. This includes information about medical conditions or criminal activity. We will not process any sensitive information about you without your express consent.

People who contact us via social media

We have a Facebook page and a Twitter account. Please be aware that these pages are public and if you contact us via the public elements of these social media, the content of your enquiry will be public. We will delete any individual messages sent to us on social media at the earliest opportunity and respond via direct or private messaging. If you send us a private or direct message via social media the message will be stored for three months. Messages sent by these methods are subject to the privacy notices of the relevant companies running these services.

People who contact us via online chat

When you use our online chat service via our website you can use this anonymously or leave your contact details any messages received will be logged on our case management system and will be deleted from the online chat service within 3 months of the message being received.

People who call our helpline

When you call WASLER's helpline we will collect personal information about you and will make notes of the content of your call and will record these on our secure case management system. This is to enable us to provide our service and allow call takers to work with you on future calls.

Our helpline also offers a translation service for service users when English is not their first language and we do not have a member of staff available to provide support in the service user’s first language. This is provided by a third party company. The company that provides this service does not retain any information from the calls or record them.

People who email us

Email communication from service users and any replies that we make are copied into the service users own file within our secure case management system and deleted from the email system within three months. We only communicate by email with service users who have given permission for this and who have informed us that their email address is safe.

Any legitimate information sharing by email which contains any personal information about service users between WASLER and any third party is done through our secure, encrypted CJSM email system.

Any email sent to WASLER, including any attachments, may be monitored and used by us for reasons of security and for monitoring compliance with office policy. Email monitoring or blocking software may also be used. Please be aware that you have a responsibility to ensure that any email you send to us is within the bounds of the law.

Individuals applying for Housing Benefit as part of their service from WASLER

Any personal information that is provided in the applications for the above financial awards is used only for the purpose of reviewing the application and the ongoing administration and management of any finances that are awarded.

Once the application is submitted, it will be subject to the data privacy arrangements of the agencies concerned.

People who make a complaint to WASLER

When we receive a complaint from a person we make up a file containing the details of the complaint. This normally contains the identity of the complainant and any other individuals involved in the complaint. This file is kept securely in a password protected file on our server.

We will only use the personal information we collect to process the complaint and to check on the level of service we provide. We compile and share statistics showing information such as the number of complaints we receive, but not in a form which identifies anyone.

We usually have to disclose the complainant’s identity to whoever the complaint is about. This is inevitable where, for example, the accuracy of a person’s record is in dispute. If a complainant doesn’t want information identifying him or her to be disclosed, we will try to respect that. However, it may not be possible to handle a complaint on an anonymous basis.

We will keep personal information contained in complaint files in line with our retention policy. This means that information relating to a complaint will be retained for five years from closure to enable us to assess any patterns of complaint over a period of time. It will be retained in a secure environment and access to it will be restricted according to the ‘need to know’ principle.

Some of our services are regulated by the Care Inspectorate and we must share information with them on complaints that we receive and this will include the complainant’s identity and any individual the complaint is about. Information is shared with the Care Inspectorate via their secure online portal and processed and retained by them in line with their retention policies.

WASLER’s funders may require us to provide information about complaints we have received. In such cases we will provide information in an anonymised format unless we have sought express permission from the complainant to share their personal information.

Similarly, where enquiries are submitted to WASLER, we will only use the information supplied to us to deal with the enquiry and any subsequent issues, and to check on the level of service we provide.

People who support WASLER

Any personal information that is provided by individuals to support WASLER will be retained for the following periods:

• Individuals making one off donations - personal information will be retained for twoyears so that the donation can be acknowledged in the relevant annual report.
• Individuals making regular donations - personal information will be retained for two years following the last donation so that the donation can be acknowledged in the relevant annual report.
• Individuals offering support in the form of political or lobbying support - personal information will be retained for two years following the last active contact.
• Individuals offering support in the form of volunteering - personal information will be processed as per our privacy statement for applicants, employees and volunteers.

Individuals Connected to People who use our services

We process the personal data of individuals connected to people using our service in order to provide our service.

We process the personal data of individuals connected to people using our service aspart of our role on multi agency risk reduction partnerships. We only process this information in order to protect the lives of people using our service.

Your rights

You have certain rights in relation to the personal data which we process about you:

• You have the right to be provided with clear, transparent and easily understandable information about how we use your personal data and your rights; this is why we are providing you with this privacy notice.
• You can request to access your personal data.
• You have the right to restrict some processing of your personal information, which meanst hat you can ask us to limit what we do with it;
• Subject to certain limitations( normally where thereis a continuing needfor us to processthe data), you can object to the processing of your personal data, or you can request that it be erased.
• Where we hold data that is inaccurate, you can ask us to complete or rectify this.
• You also have the right to complain – please see below.

Complaints or queries

WASLER tries to meet the highest standards when collecting and using personal information. For this reason, we take any complaints we receive about this very seriously. We encourage people to bring it to our attention if they think that our collection or use of information is unfair, misleading or inappropriate. We would also welcome any suggestions for improving our procedures.

This privacy notice was drafted with brevity and clarity in mind. It does not provide exhaustive detail of all aspects of WASLER’s collection and use of personal information. However, we are happy to provide any additional information or explanation needed. Any requests for this should be sent to the address below.

If you want to make a complaint about the way we have processed your personal information, you can contact us at info@wasler.org.uk If you are unhappy with our response, you can complain to the ICO in their capacity as the statutory body which oversees data protection law

www.ICO.org.uk/concerns.

Access to personal information

WASLER tries to be as open as it can be in terms of giving people access to their personal information. Individuals can find out if we hold any personal information by making a ‘subject access request’ under the GDPR. If we do hold information about you we will:

• give you a description of it;
• tell you why we are holding it;
• tell you who it could be disclosed to; and
• let you have a copy of the information in an intelligible form.

To make a request to the WASLER for any personal information we may hold you please put the request in writing marked for the attention of the Data Controller and sent to the email or postal address provided below. Personal information can be requested verbally, but we may need to verify your identity before releasing your information. If you request your information verbally we may ask you to confirm your identity and a member of staff will record the process of confirmation.

If you agree, we will try to deal with your request informally, for example by providing you with the specific information you need over the telephone.

If we do hold information about you, you can ask us to correct any mistakes either verbally or by sending an email or letter to the Data Controller at the addresses set out below.

Disclosure of personal information

Sometimes it is helpful for us to share the information you give us or to obtain information about you from other services. However, we will not pass on any or collect information without your consent, other than in the following circumstances:

• Where we have a statutory duty to do so in order to protect you, prevent harm to someone else, for example a child, or prevent or detect a crime. If we have to share information in these situations, we will only share information that will improve your and/or your child[ren]’s safety. We will always try and tell you when information is being shared unless it is not safe for you or someone else or we can’t contact you. Further information is available in our Child and Adult Protection Policies about the factors we consider when deciding whether information should be disclosed.
• Service users’ names and dates of birth may also be shared with our funders’ monitoring officers as evidence of legitimate use of public funds.
• WASLER is regulated by the Care Inspectorate and monitoring officers from this agency may require access to case files during monitoring visits to review WASLER’s practice. No personal information will be processed or removed during monitoring visits b ythe Care Inspectorate, unless there is a statutory requirement for this. The Care Inspectorate may also require WASLER to provide details of reportable incidents. Any personal data shared with them will be limited to that which is necessary for the Care Inspectorate to investigate the incident and will be shared only through the Care Inspectorate’s secure portal.