Northamptonshire Carers: Privacy Notice

Introduction

We, Northamptonshire Carers, are both the ‘controllers’ and ‘processors’ of the information which we collect about you (‘personal data’). Being controllers of your personal data, we are responsible for how your data is processed. The word ‘process’ covers most things that can be done with personal data, including collection, storage, use and destruction of that data.

This notice explains why and how we process your data, and explains the rights you have around your data, including the right to access it, and to object to the way it is processed. Please see the section on ‘Your rights as a data subject’ for more information.

We are a registered charity and our contact details are:

Address:      123 Midland Road, Wellingborough, Northamptonshire, NN8 1LU
Email: [email protected]
Telephone number: 01933 677837

 

Our Data Protection Officer (DPO) is Gwyn Roberts Deputy CEO, who you can contact with the details above if you have any queries about this notice or anything related to data protection.

 

Personal data

‘Personal data’ is any information that relates to a living, identifiable person. This data can include your name, contact details, and other information we gather as part of our relationship with you.

It can also include ‘special categories’ of data, which is information about a person’s race or ethnic origin, religious beliefs, physical or mental health or sexual orientation. The collection and use of these types of data is subject to strict controls.

We are committed to protecting your personal data, whether it is ‘special categories’ or not, and we only process data if we need to for a specific purpose, as explained below.

We collect your personal data mostly through our contact with you, and the data is usually provided by you, but in some instances we may receive data about you from other people/organisations. We will explain when this might happen in this Notice.

 

Your data and how and why we process it

In general terms, we process your data in order to manage our relationship with you. The table below lists more specific purposes for processing your data, and the legal basis for each type of processing.

Data processing Legal basis for processing
Recording of personal details of Carers, clients and the people they care for. This includes special categories of data, which identifies a person’s race or ethnic origin, religious beliefs, physical or mental health or sexual orientation. As well as personal details, we keep accurate case notes and record attendances at our activities. This is under contract with you and allows us to support those registering their details with us (processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract).
Northamptonshire Carers are contracted to complete Carers Assessments on behalf of Northamptonshire County Council. Carers Assessments and Support Plans are shared securely between us in order to deliver this statutory service. The General Data Protection Regulations (2018) includes provision to processing data if it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. We have a legal duty to share this data, which includes personal information regarding Carers and the person(s) they care-for as per the Care Act (2014).   
Northamptonshire Carers subcontract the Alzheimer’s Society to deliver services (including Carers Assessments) to people with dementia and their Carers. In order to do some staff at the Alzheimer’s Society’s Northamptonshire branch have limited access to our Charitylog database.  A data sharing agreement is in place between Northamptonshire Carers and Alzheimer’s Society. We will gain your consent before referring to the Alzheimer’s Society. Should a Carers Assessment be completed, the above legal basis for processing will apply
Keeping you up to date with our services, updates that may be useful for Carers & their families and our fundraising activities (you are under no obligation to donate – please see our Fundraising Promise for more information). This is in the form of an emailed monthly Newsletter. With consent. We ask whether you consent to be sent such information and will only do so if you opt in to receive this.

 

At times, we may further process data which we have already collected. We will only do this if the new purpose for processing it further is compatible with the original purpose that the data was collected for. We will tell you about any further processing before carrying it out.

 

Personal data received from third parties

This is a list of your personal data that we may receive from other people or organisations.

Data Source
The majority of the information we hold will have come from you however we do also receive data from 3rd parties making referrals to us. Incoming referrals will likely include contact details (name, phone numbers, address etc) along with a summary of the situation including medical conditions and personal circumstances. Incoming referrals may be sent to us via a professional such as your GP surgery, Care Manager or Social Worker. We ask that professionals gain your consent before accepting a referral

 

Who we share your data with

For some processing purposes we share your data with third parties. This is a list of the information we may share with external recipients, and for what purpose:

Recipients of your data Purpose for sharing
Northamptonshire Carers are contracted to complete Carers Assessments on behalf of Northamptonshire County Council. Carers Assessments and Support Plans are shared securely between us in order to deliver this statutory service. The General Data Protection Regulations (2018) includes provision to share information in the exercise of official authority. We have a legal duty to share this data, which includes personal information regarding Carers and the person(s) they care-for as per the Care Act (2014). 
We also have contractual obligations to report to funders (i.e.  NHS, charitable grants, National Lottery) about our activities.   Unless there is a legal reason to do so (see references to Carers Assessments) or separate consent is given, only non-identifiable data is shared with funders and allows us to report on the outcomes of our funding as per our contracts with funders.
Although rare we occasionally have cause to report a risk to yourself or others to the Local Authority Where we have cause to do so, we are duty-bound to follow safeguarding policies (processing is necessary in order to protect the vital interests of the data subject or of another natural person) 
As part of our role of providing support, we may refer to 3rd parties who may be able to provide support on a particular issue. For example referring to a specialist agency for benefits advice or to another charity who work in particular field. Unless there is a legal basis not to (see safeguarding and Carers Assessments clauses above) we only refer to 3rd party organisations with consent.
Although not routinely collected, should you provide us with your bank details to process a payment (such as to process a charitable grant or Local Authority direct payment), these will be shared with or payroll provider (currently Dove Naish) Bank details are only recorded as needed and with your consent in order to pay you as agreed.

 

How we store your data

Your personal data is held in both hard copy and electronic formats.

Electronic data, including emails, is stored on our servers, which are located in the UK and our CharityLog database who’s servers are located in the UK.

 

How long we keep your data

Information about how long we process your data for can be found in our data retention policy.

Some retention periods are based on legal requirements while others take into account practical needs to keep the data.

Once the applicable retention period expires, unless we are legally required to keep the data longer, or there are important and justifiable reasons why we should keep it, we will securely delete the data.

 

Your rights as a data subject

As a data subject, you have the following rights in relation to your personal data processed by us:

  • To be informed about how your data is handled;
  • To gain access to your personal data;
  • To have errors or inaccuracies in your data changed;
  • To have your personal data erased, in limited circumstances;
  • To object to the processing of your personal data for marketing purposes or when the processing is based on the public interest or other legitimate interests;
  • To restrict the processing of your personal data, in limited circumstances;
  • To obtain a copy of some of your data in a commonly used electronic form, in limited circumstances;
  • Rights around how you are affected by any profiling or automated decisions.

 

Parental Consent

In cases where details of children under 18 are stored (i.e. Young Carers), we require the consent of a parent or guardian.

  

Withdrawing consent  

If we are relying on your consent to process your data, you may withdraw your consent at any time.

  

Complaints to the Information Commissioner

You have a right to complain to the Information Commissioner's Office (ICO) about the way in which we process your personal data. You can make a complaint on the ICO’s website https://ico.org.uk   

 

Exercising your rights, queries and complaints  

For more information on your rights, if you wish to exercise any right or for any queries you may have or if you wish to make a complaint, please contact our Data Protection Officer and Information Governance Lead, Gwyn Roberts who can be contacted at: 123 Midland Road, Wellingborough, NN8 1LU; [email protected]; 01933 677837

A PDF version can be found here.