Privacy Notice – Service Users

Last updated: July 2024

Introduction

Sexual Assault and Abuse Support Service Buckinghamshire and Milton Keynes (SAASSBMK) is committed to ensuring your personal information is protected. This privacy notice describes how SAASSBMK, the data controller, collects, uses, and protects information relating to our service users.

Our policy is to only collect personal data necessary for agreed purposes and we ask service users to only share personal data where it is strictly needed for these purposes.

If you have any questions about our Privacy Notice, then you are welcome to get in touch to discuss these further with us. You can either email admin@saassbmk.org.uk, or phone 01296 392468.

We will comply with data protection law. This says that the personal information we hold about you must be:

• Used lawfully, fairly and in a transparent way.
• Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
• Relevant to the purposes we have told you about and limited only to those purposes.
• Accurate and kept up to date.
• Kept only as long as necessary for the purposes we have told you about.
• Kept securely.

How we collect your information

• Initial referral or enquiry contact
• Information, Advice and Guidance Meeting
• Assessment form
• Equalities Monitoring Form
• Information gathered throughout sessions
• Information gathered through feedback processes

The type of information we hold

We may require the following information from you during your time with SAASSBMK;

• First name
• Surname
• Contact number
• Date of birth
• Home address
• Email address
• Emergency contact details
• GP Name and surgery address
• Any medical conditions both physical and mental health related – this may include information on any medications
• Information about your reason for contacting the service so that we can direct you to the correct service
• Information about your experiences of sexual assault and abuse, including details about the perpetrator(s) and how you have been affected by your experiences.
• Records of our interactions we have with you, for example phone calls or face-to-face meetings
• Any concerns we have about your or somebody else’s safety
• Records of contact we may have with other professionals or organisations about you or your case where you have agreed for us to contact those professionals or organisations
• Feedback you give us about our services

If you are a service user, we will discuss this with you in more detail when we meet for the first time.

Who collects this information?

This information may be collected by any SAASSBMK staff member or volunteer with whom you have contact, or if you contact us via our email or website.

How we use your information

We collect information from you for several reasons. Non-anonymised information is used:

• For practical reasons, such as storing the best way to contact you
• To ensure we are providing you with a consistent and high-quality service, for example by reviewing your case notes regularly
• To provide evidence that we are working responsibly and professionally, for example by recording any actions we have agreed together that we will take on your behalf
• To help ensure your and others’ safety where necessary

We also anonymise some of the information you provide us. This means that it can no longer be linked to you, and that you cannot be identified by it. This kind of anonymous information is used:

• For reports to the people or bodies to whom we are accountable, for example our funders and our trustees
• To help us to monitor, evaluate, and develop our services

We will only use your personal information when the law allows us to. Most commonly, we will use your personal information in the following circumstances:

• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• Where we need to perform a service we have entered into with you.
• Where we need to comply with a legal obligation.
• Where you have given us your consent to do so.

We use information held about you in the following ways:

• To ensure we do not send unwanted information
• To manage and administer our relationship and communications with you.
• To process any donations that you have made to us.
• To claim Gift Aid on donations.
• To support community based fundraising and campaigning.
• To provide you with the information that you request from us.
• To provide you with information about our activities and fundraising appeals where you are fundraising in aid of us and need this information.
• To inform you about changes to our service.
• To send our supporters marketing information about our projects, fundraising activities and appeals where we have your consent to do so.
• To supporters or members of the public who have informed us they do not wish to be contacted.
• For the purposes of the establishment, exercise or defence of legal claims.

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose or if we have a legal obligation or public interest requirement to do so.

Please note that we may process your personal information without your knowledge or consent, in compliance with the above provisions, where this is required or permitted by law.

Who we will share your information with

Where appropriate and necessary, we may share the information we hold on you with:

• Internally:
  • with other SAASSBMK trustees, staff and volunteers
  • with our clinical supervisors

All of these people are bound by strict codes of confidentiality.

• Externally:
  • with other agencies or professionals where we have your consent to do so, for example talking with other services who may also be supporting you
  • with other agencies where it is necessary to safeguard you or another person. This may be without your permission, but only after a robust internal process is followed.
  • when required to do so by a court of law, for example if our notes of meetings with you are deemed relevant to a criminal case
  • as anonymised data with our funders and other external agencies.

We may share your personal information with third parties where it is necessary to administer the relationship with you, required by law, or where we have another legitimate interest in doing so.

We may share your information with selected third parties including:

• When we use other companies to provide services on our behalf, for example, processing donations, such as Just Giving, sending emails, such as Mailchimp, when using auditors or other professional advisors, or processing credit/debit card payments and cheques.
• Our service user case management system and call handling system
• IT and website service providers.

We may disclose your personal information to third parties to:

• Comply with any court order or other legal obligation or when data is requested by our regulators or by government agencies or law enforcement agencies;
• Enforce or apply our terms of use and any other agreements;
• Protect the rights, property, or safety of us, our service users, employees, donors, or others. This may include exchanging information with other companies and organisations for the purposes of fraud protection.
• All our third-party service providers are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

We have contracts with these organisations to ensure that your data is used appropriately and held securely by them on our behalf. They may store or transfer your data outside the EU.

SAASSBMK will never share any of your information with third parties for commercial or marketing purposes.

Storing your information

We are committed to ensuring that your information is secure. Information we hold on you is stored electronically in a secure database, and in paper records kept in secure filing cabinets. Only SAASSBMK staff and volunteers can access these, and members of the team will only access the information when it is relevant.

We will keep the information for seven years after you cease accessing our support.

Cookies

Our websites (www.saassbmk.org.uk; www.samproject.org.uk; www.sashbucks.org.uk) uses cookies and similar technologies to provide certain functionality to the site, to understand and measure its performance, and to deliver targeted advertising.

Cookies are small text files that are placed on your computer by websites that you visit. Our site and our partners use cookies to enhance your experience, analyse traffic and for ad personalisation and measurement.

You can restrict or block cookies using your browser settings.

Links to other websites

Where we provide links to websites of other organisations, this privacy notice does not cover how that organisation processes personal information. We encourage you to read the privacy notices on the other websites you visit.

Data Security and Retention

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

We keep personal data for various lengths of time, depending on the purpose it was collected for:

• Financial data (e.g. donors) is kept for 7 years.
• Data collected on adult service users may be kept for 7 years after completion of the services.
• Data collected on under-18 service users may be kept until the child is 25.

For full details, please request our Data Protection GDPR Policy.

How you can access your information

You have the right to request access to the information we hold about you. To make a request for your personal information, please contact us on admin@saassbmk.org.uk and request a copy of our Data Protection GDPR Policy for more details.

Your rights

SAASSBMK adheres to data protection legislation, which provide the following rights for individuals:

• The right to be informed (know that we hold your data)
• The right of access (know what data we hold about you – please see How you can access your information section)
• The right to rectification (correct/amend personal data)
• The right to be forgotten (erasure)
• The right to restrict processing
• The right to data portability
• The right to object (lodge a complaint)
• Rights in relation to automated decision making and profiling (SAASSBMK does not do this)

If you are not happy with how we are using your information or how we have responded to your request, you have the right to report this to the Information Commissioners Office at www.ico.org.uk. We will fulfil these rights unless we have a legal or safeguarding reason not to.

Your right to withdraw consent

In circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact us by either email admin@saassbmk.org.uk, or phone 01296 392468.

Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

Changes to this privacy notice

We reserve the right to update this privacy notice at any time and will make amended versions of this notice available on our website when we make changes to it. We may also notify you in other ways from time to time about the processing of your personal information.

SAASSBMK aims to meet the highest standards when collecting and using information about you and takes any complaints about this very seriously. We encourage you to contact us if you think our collection or usage of information is unfair or inappropriate, and always welcome ideas for how we can improve our practice.

You are also very welcome to contact us with any questions about this privacy notice, either by emailing admin@saassbmk.org.uk or phoning the office on 01296 392468.

If you need more information about UK’s laws and guidance on data protection or would like to report concerns or a breach go to: https://ico.org.uk/

If you are not happy with how we are using your information or how we have responded to your request, you have the right to report this to the Information Commissioners Office at

Information
Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113

www.ico.org.uk