Data Protection and Privacy Policy 

Organisation

 

Parent and Carer Alliance C.I.C. are an independent, not for profit, Community Interest Company who provide a range of support to parent carers.

​

We work to ensure families

​

• Are given a real opportunity to have a voice in the decision-making processes which affect their lives;

• Have more knowledge about their rights and those of their children;

• Feel more confident in achieving the best outcomes for their families and

• Have opportunities to meet other families who face the same challenges and who truly understand.

     

If you have any questions about this Privacy Notice or your personal information, please contact us:

​

• by email to: info@parentandcareralliance.org.uk

• by post to: C/O Parent and Carer Alliance C.I.C. Cedar House, Cedar Drive, Dursley, Gloucestershire, GL11 4EB.

 

 

Aims of this policy

 

Parent and Carer Alliance C.I.C needs to keep certain information on its employees, volunteers, Associates, families and carers, and organisations and their representatives such as - Gloucestershire County Council; NHS; educational organisations; charities; support groups; legal professionals and media representatives to carry out its day-to-day operations, to meet its objectives and to comply with legal obligations.

​

Parent and Carer Alliance C.I.C. is committed to ensuring any personal data will be dealt with in line with the General Data Protection Regulation (GDPR). To comply with the law, personal information will be collected and used fairly, stored safely and not disclosed to any other person unlawfully.

​

The aim of this policy is to ensure that everyone handling personal data is fully aware of the requirements and acts in accordance with data protection procedures. This document also highlights key data protection procedures within Parent and Carer Alliance.

 

 

What is processing personal data?

​

The definition of ‘Processing’ is obtaining, using, holding, amending, disclosing, destroying, and deleting personal data. This includes some paper based personal data as well as that kept on computer.

 

 

Lawful basis to process personal data

​

The lawful bases which apply to Parent and Carer Alliance C.I.C. processing personal data are:

​​

• Consent: the individual has given clear consent for Parent and Carer Alliance C.I.C to process their personal data for a specific purpose; and

• Legitimate interests: the processing is necessary for Parent and Carer Alliance C.I.C legitimate interests or the legitimate interests of a third party. In particular, grant funders, such as the National lottery, have a legitimate interest in receiving and processing the personal data of those who have directly benefited from the funding granted, to measure the impact of such funding.

 

 

Purposes of processing your personal data

​​

Parent and Carer Alliance C.I.C. wish to collect and use the following types of personal information for the following reasons:

​

• To provide you with support and guidance

• To target future events/training and services by understanding your personal situation and experiences

• To enable you to access and use the website or other social media links to make electronic bookings for training, information events, social activities, and outings

• To help us to demonstrate need both locally and nationally to help the Parent and Carer Alliance C.I.C. work with other organisations to improve services provided

• To access funding sources to develop what we can offer to our members

• To request feedback from you about what you think about any service or support provided to you by the Parent and Carer Alliance, e.g., feedback to the National Lottery of the impact of advice and support that you have received as a direct result of their providing funding, which may involve them contacting you

• To send you marketing communications including but not limited to newsletters, offers and training events,

• To contact you personally

• To confirm your consent to process information that you have shared directly with Parent and Carer Alliance C.I.C. without giving prior consent – through direct email, private message, telephone call or in face-to-face conversation

• In the event Parent and Carer Alliance C.I.C. needs to discuss a booking that you have made to access a training event, meeting, trip, social event or otherwise

• To further process your personal information – to collate your anonymised information with that of other families to produce a report for third party organisations and their representatives such as – Funding providers; Gloucestershire County Council; NHS; educational organisations; charities, support groups, legal professionals and media representatives

• To, where appropriate, enable the National Lottery to discuss your experiences of services and support provided through their funding

• To track information about the use of our website including information obtained via cookies to develop the website.

​

Data is also collected for the following reasons:

• Where processing data is necessary for the performance of a contract, such as grant funding, or to take steps to enter a contract;

• Where processing certain data is necessary for compliance with legal obligations;

• Where processing data is necessary to protect the vital interests of a data subject or another person, and

• Where processing data is necessary for the performance measurements of tasks carried out in the public interest or in the exercise of official authority vested in our organisation as Data Controller.

​

In addition to the disclosures reasonably necessary for the purposes identified elsewhere above, the Parent and Carer Alliance C.I.C. may disclose your personal information to the extent that it is required to do so by law, in connection with any legal proceedings or prospective legal proceedings, national security and to establish, exercise or defend its legal rights.

 

 

Who will process personal data?

 

Groups of people within Parent and Carer Alliance C.I.C who will process personal data are Directors, Advocates, Family Support Workers and Steering Committee members. Representatives of grant funders – such as the National Lottery will, where appropriate, process personal data, and contact families, in connection with projects they have funded.​​​​

​

​

Responsibilities 

​

Overall responsibility for personal data in Parent and Carer Alliance C.I.C rests with the Directors.

​

Louise Arnold, Director, has responsibility for processing data and is responsible for:

​

• understanding and communicating obligations under the Act

• identifying potential problem areas or risks

• producing clear and effective procedures and

• if applicable, notifying and annually renewing notification to the Information Commissioner, plus notifying of any relevant interim changes

​

All employees and volunteers who process personal information must ensure they not only understand but also act in line with this policy and the data protection principles.

​

To neglect these responsibilities would be a direct infringement of this policy

​

• For employees – you will be dealt with through a formal warning; or summary dismissal where the circumstances are sufficiently serious

• For volunteers - your position as a volunteer may be jeopardised should you neglect to follow the policy and procedures of the organisation

 

 

Policy Implementation

​

Directors, employees, and volunteers will:

​

• Ensure any personal data is collected in a fair and lawful way;

• Explain why it is needed at the start;

• Ensure that only the minimum amount of information needed is collected and used;

• Ensure the information used is up to date and accurate;

• Review the length of time information is held;

• Ensure it is kept safely; and

• Ensure the rights people have in relation to their personal data can be exercised

 

Parent and Carer Alliance C.I.C. will ensure that:

​

• Everyone managing and handling personal information is trained to do so;

• Anyone wanting to make enquiries about handling personal information, whether a member of staff, volunteer, or service user, knows what to do;

• Any disclosure of personal data will be in line with our procedures and

• Queries about handling personal information will be dealt with swiftly and politely.

 

 

Obtaining and recording consent

 

All consent given whilst completing online forms is recorded against that form, stored on a secure server, and as needed, on a spreadsheet stored on password protected laptop computers.

​

Consent given by email is stored within that email on a secure server and on a spreadsheet stored on password protected laptop computers.

​

Private messages sent to Parent and Carer Alliance C.I.C. will, where appropriate, be replied to with a request to resend the information via an online form where the information given is recorded against that form, stored on a secure server, and as needed, on a spreadsheet stored on password protected laptop computers. In other cases, the person contacting the Parent and Carer Alliance C.I.C. will be asked to confirm consent to share the information they have given, by email.

​

Messages and emails sent to Parent and Carer Alliance C.I.C. which are not subsequently followed by consent to share being given within a month, will be deleted.

 

 

Security of personal data

 

​Parent and Carer Alliance C.I.C. will take reasonable technical and organisational precautions to prevent the loss, misuse, or alteration of your personal information. We will take reasonable technical and organisational precautions to store, process and transport all personal information you provide in a secure manner.

​

All devices where data can be stored or processed must be password protected. Where possible files containing sensitive data should be password protected and, if sharing the file, the password should be communicated separately.

​

All data that is to be shared should be kept to the minimum required to make an effective decision on the information supplied, and where possible, anonymised. Data to be emailed should be sent using @parentandcareralliance.org.uk email addresses

​

Paper copies of information should only be produced when essential, and wherever possible, information recorded on paper should be anonymised. Information in paper format should only be retained for as short a time as possible, and once no longer needed, should be shredded.

​

Any unauthorised disclosure of personal data to a third party may result in:

​

• For employees – you will be dealt with through a formal warning; or summary dismissal where the circumstances are sufficiently serious

• For volunteers - your position as a volunteer may be terminated.

 

If a breach of data protection were to occur, consideration will be given to reviewing practices. In addition, Parent and Carer Alliance C.I.C. will consider whether the breach should be reported to the Information Commissioner and/or to any partners with which we hold Information Sharing or Partnership Agreements

 

 

Retaining Personal data

 

Parent and Carer Alliance C.I.C. will endeavour to keep data only for as long as needed and data will be deleted when it is no longer needed. Some records will be retained permanently if legally required to do so. Some other records will be retained for an extended period to follow best practice: 

​

• Personnel files -6 years after employment/volunteering ceases, (slimmed down format after 2 years)

• Application forms and interview notes (unsuccessful candidates)- 1 year

• Letters of reference - 6 years from the end of employment

• Accident books, accident records/reports - 3 years

• Assessments under health & safety regulations- Permanently

• Income tax, NI returns, income tax records and correspondence with IR - At least 3 years after the end of the financial year to which they relate

• Project information on service users - Data relating to programmes will be retained for as long as is necessary to provide an audit trail for funders, as set out in contractual agreements. For funding provided by the National Lottery this is for up to 7 years afterwards. For European Funded projects this can be up to 13 years.

 

 

Withdrawing consent

​

You have the right to access, correct, have erased, and object to processing your personal data. When exercising any of the rights, we may need to verify your identity for your security. Once we have received your request, we will respond within one month.

​

You can withdraw your consent to share your information at any time without detriment

​

• By email to: info@parentandcareralliance.org.uk;

• By post to: C/O Parent and Carer Alliance C.I.C., Cedar House, Cedar Drive, Dursley, Gloucestershire, GL11 4EB; or

• By contacting Louise Arnold, Director, louise@parentandcareralliance.org.uk

 

 

Right of access (subject access request)

​

The right of access, commonly referred to as subject access, gives you the right to obtain a copy of your personal data, as well as other supplementary information.

​

You can make a Subject Access Request (SAR), verbally or in writing, including on social media. Or you may ask a third party (e.g., a relative, friend or solicitor) to make a SAR on your behalf. Before responding, Parent and Carer Alliance C.I.C. need to be satisfied that the third party making the request is entitled to act on your behalf. It is the third party’s responsibility to provide evidence of their authority.

​

Requests for information about children

Before responding to a SAR for information held about a child, Parent and Carer Alliance C.I.C. will consider whether the child is mature enough to understand their rights. If the request is from a child and they can understand their rights, Parent and Carer Alliance C.I.C. would usually respond directly to the child. A parent or guardian can exercise the child’s rights on their behalf if the child authorises this, or if it is evident that this is in the best interests of the child. If a child is competent, they may authorise someone else, other than a parent or guardian, to make a SAR on their behalf.

 

Responding to a request

Parent and Carer Alliance C.I.C. will comply with a SAR without undue delay and at the latest within one month of receiving the request. This time may be extended by a further two months if the request is complex or Parent and Carer Alliance C.I.C. have received a number of requests from the individual, e.g., other types of requests relating to individuals’ rights.

​

You may be asked to specify the information or processing activities their request relates to if it is not clear. The time limit for responding to the request is paused until clarification is received, although Parent and Carer Alliance C.I.C. should supply any of the supplementary information that we can do within one month.

​

Identification

Parent and Carer Alliance C.I.C. need to be satisfied that the identity of the requester (or the person the request is made on behalf of) is known and correct. Parent and Carer Alliance C.I.C. can ask for information to verify an individual’s identity. The timescale for responding to a SAR does not begin until the requested information is received.

 

Supplying the information to the requester

You are entitled to a copy of your personal data and to other supplementary information.

 

If you make a request electronically, Parent and Carer Alliance C.I.C. will provide the information in a commonly used electronic format, unless you request otherwise.

​

If asked, Parent and Carer Alliance C.I.C. can provide a verbal response to your SAR, provided that your identity has been confirmed by other means.

​

Parent and Carer Alliance C.I.C. will keep a record of the date the request was made, the date of the response, details of who provided the information and what information was provided.

 

 

Right to complain

 

You have the right to lodge a complaint with the Information Commissioner’s Office

 

https://ico.org.uk/global/contact-us/  or call their helpline on 0303 123 1113.

 

 

Review

​

This policy will be reviewed annually to ensure it remains up to date and compliant with the law​​