At Aspire we want to ensure that you are kept fully aware of how any data that you share with us will be looked after and used.
In accordance with the General Data Protection Regulation (GDPR), we have implemented this privacy notice to keep you fully informed about the types of data we process about you. We also include within this notice the reasons for processing your data, the lawful basis that permits us to process it, how long we keep your data for and your rights regarding your data.
Please note that this policy was last updated in April 2018.
Who We Are
We are Aspire, an employment charity and social enterprise (registered charity number 1117726, limited company number 4270053). We take protecting your personal data very seriously and will ensure that any data you decide to share with us will be processed in a fair, open and transparent manner.
A) DATA PROTECTION PRINCIPLES
Under GDPR, all personal data obtained and held by us must be processed according to a set of core principles. In accordance with these principles, we will ensure that:
a) processing is fair, lawful and transparent
b) data is collected for specific, explicit, and legitimate purposes
c) data collected is adequate, relevant and limited to what is necessary for the purposes of processing
d) data is kept accurate and up to date. Data which is found to be inaccurate will be rectified or erased without delay
e) data is not kept for longer than is necessary for its given purpose
f) data is processed in a manner that ensures appropriate security of personal data including protection against unauthorised or unlawful processing, accidental loss, destruction or damage by using appropriate technical or organisation measures
g) we comply with the relevant GDPR procedures for international transferring of personal data
B) WHAT TYPES OF DATA DO WE HOLD?
The types of personal information data that you share with us include details such as your name, address, email address, phone numbers and emergency contact details (if you have entered an Aspire event). You will have given us this information when signing up for an Aspire event, making a donation or when enquiring for more information about our professional or support services.
How do we use this information?
We will use this information to process gift aid claims on your donations if you have filled in a gift aid form; to provide the services that you have requested; to keep you updated about relevant aspects of Aspire’s work (unless you have told us you do not want to be contacted) and to keep a record of the support that you have given to Aspire.
Sensitive personal information
In order to be able to provide the best possible level of support to our clients, we need to collect sensitive personal data that relates to information about barriers clients may have had to finding employment such as mental health issues, homelessness or substance misuse issues. In addition, to provide a professional service to our Community Transport clients, we also need to collect sensitive personal information that relates to transport related health barriers.
We fully understand that the information our clients and customers share with us is sensitive and as such will treat this data with extra care and confidentiality.
How do we use this information?
We will only use this information to provide you with the support you need to move into and towards employment or to deliver our Community Transport service. If we are working jointly with other agencies to deliver this support, we may need to share your data with them in order to fulfil our obligations to you. If this is the case, we will ensure that this is clearly communicated to you, and you will have the right to ask for your data not to be shared. The only exception to this would be when we have concerns about your safety and the safety of others, in which case we would need to share necessary sensitive personal data without your permission in accordance with Aspire’s safeguarding policy.
At Aspire, we greatly appreciate the opportunity to be able to share our clients and customers’ experiences and journeys both during your time with us and after you have left Aspire.
When you first meet with an Aspire support worker or Community Transport driver you will be asked if you are happy to share your story and/or photograph for future communications. This could be used in our annual social impact report, our newsletters, on our website or on social media. We will only use your story and/or photograph if you have given us your consent to do so, and you can change your mind at any time.
C) LAWFUL BASIS FOR PROCESSING
The law on data protection allows us to process your data for certain reasons only and it’s important that we are clear about the legal basis for using your information.
We are able to process your data in order to comply with a legal requirement, to fulfil a contract with you or because you have given us your consent to do so.
The new GDPR regulations state that we need to also consider the conditions under which we process special category data. We will only process special categories of data at Aspire when you have given us your explicit consent to do so, to carry out our legal obligations or for reasons of substantial public interest.
D) WHO WE SHARE YOUR DATA WITH
The personal information that we collect about you will only be used by Aspire staff to process your donation, reclaim Gift Aid on your donation or to liaise with you about particular events or activities you may have signed up for.
We will never sell or share your personal information with organisations so that they can contact you for any marketing activities. Equally, we would never sell any information to other organisations about your web browsing activity.
Sensitive personal information
At Aspire, in order to be able to support our clients and customers we sometimes need to work in partnership with other agencies. There may be times when we need to share sensitive personal information about our clients or customers in order to fulfil our obligations to them. If this is the case, we will ensure that this is clearly communicated, and clients or customers will have the right to ask for their data not to be shared. The only exception to this would be when we have concerns about clients’ safety and the safety of others, in which case we would need to share necessary sensitive personal data without express permission in accordance with Aspire’s safeguarding policy.
E) PROTECTING YOUR DATA
We are aware of the requirement to ensure your data is protected against accidental loss or disclosure, destruction and abuse. We have implemented processes to guard against such and are committed to ensuring that your personal data is always kept safe.
F) RETENTION PERIODS
We only keep your data for as long as we need it for, depending on the relevant activity. Some data retention periods are set by the law. You can ask for a copy of Aspire Oxford’s Data Retention Schedule at any time by calling 01865 204450.
G) YOUR RIGHTS
It’s very important to us that you understand what your rights are in respect to how we process your data. You have the following rights in relation to the personal data we hold on you:
a) the right to be informed about the data we hold on you and what we do with it;
b) the right of access to the data we hold on you, along with what personal information we use, why we use it, if we share it and how long we hold it for. This is called a “Subject Access Request”. To make a request please put this in writing to Aspire Oxford, St Thomas School, Osney Lane, Oxford OX1 1NP. There is no charge for this service.
c) the right for any inaccuracies in the data we hold on you, however they come to light, to be corrected. This is also known as ‘rectification’;
d) the right to have data deleted in certain circumstances. This is also known as ‘erasure’;
e) the right to restrict the processing of the data;
f) the right to transfer the data we hold on you to another party. This is also known as ‘portability’;
g) the right to object to the inclusion of any information;
h) the right to regulate any automated decision-making and profiling of personal data.
Where you have provided consent to our use of your data, you also have the right to withdraw that consent at any time. This means that we will stop processing your data.
I) MAKING A COMPLAINT
If you think your data rights have been breached, you are able to raise a complaint with the Information Commissioner (ICO). You can contact the ICO at Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF or by telephone on 0303 123 1113 (local rate) or 01625 545 745.
To find out more about this policy and to discuss how we use your personal information at Aspire please call us on 01865 204450 or email firstname.lastname@example.org at any time.