We at Bath Welcomes Refugees collect your data to help us provide you with the best service. We’re dedicated to keeping your personal information safe and being upfront about how we use it, no matter how you connect with us.
Service User and Fundraising Privacy Notice
This Privacy Notice explains when and why we collect personal information about you, how we use it and the conditions under which we may disclose it to others. Your personal data is defined as any information that can directly or indirectly identify you. This notice also explains how we keep your data safe and secure and includes information you need to know about your rights and how to exercise them.
If you have any questions regarding our Privacy Notice and our use of your personal data or would like to exercise any of your rights, please get in touch via the following information:
We have prepared an easy-read version of this notice. If you wish to view this notice, please get in touch on the details below.
Email us: [email protected]
Write to us: Bath Welcomes Refugees, The Island House, Midsomer Norton, BA3 2DZ
If you are unhappy with the way we process your data, you can also make a complaint to the Information Commissioner’s Office (ICO) which regulates the use of information in the UK. They can be contacted by:
Telephone 0303 123 1113
Write to the ICO:
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Or by going online to www.ico.org.uk/concerns
If you are based outside of the UK, the complaint should be directed to the relevant Data Protection Supervisory Authority in that Country.
Who we are
We are Bath Welcomes Refugees (BWR) and for the purposes of UK Data Protection Law we are registered as a Data Controller under registration number ZA253093, and our registered address is The Island House, Midsomer Norton, BA3 2DZ
Our purpose is to help refugees, asylum seekers or those displaced from their home country by reason of war, persecution, oppression, discrimination, natural disasters or other like causes, and their dependents, in particular but not exclusively seeking refuge within Bath and North East Somerset and the surrounding area. We are a team run largely by volunteers and trustees.
Personal data collected, how and why we collect it, and on what lawful basis
If you are a service user, that is someone we support, please see Appendix 1
If you support us as a donor or via our fundraising activities, please see Appendix 2
Your Rights
Under data protection laws in the UK and EU, you have certain rights over the personal information that we hold about you. If you would like to exercise your rights, please get in contact with any of the details listed above. Here is a summary of the rights we think apply:
a. Right to be Informed
You have the right to be informed as to how we use your data and under what lawful basis we carry out any processing. This Privacy Notice sets this information out, however if you would like further information, please get in touch.
b. Right of Erasure – also known as the right to be forgotten
You may ask us to delete some or all of your information we hold about you. Sometimes where we have a legal obligation we cannot erase your personal data.
c. Right to Object
You have the right to object to processing where we are using your personal information such as where it is based on legitimate interests or for direct marketing.
d. Inaccurate personal information corrected
Inaccurate or incomplete information we hold about you can be corrected. The accuracy of your information is important to us and we are working on ways to make this easier for you to review and correct the information that we hold about you. If any of your information is out of date or if you are unsure of this, please get in touch through any of the contact details listed in this notice.
e. Right of restriction
You have a right to restrict the processing of some or all of your personal information if there is a disagreement about its accuracy, or we are not lawfully allowed to use it.
f. Right to Access your information
You have a right to request access to a copy of your personal information that we hold about you, along with the information on what personal information we use, why we use it, who we share it with, how long we keep it for and whenever it has been used for automated decision making. You can make a request for access free of charge and proof of identity is required.
g. Automated decision making
Automated decision-making takes place when an electronic system uses personal information to make a decision without human intervention. You have the right to question the outcome of automated decisions that may create legal effects or create a similar significant impact on you. We currently do not undertake automated decision making.
h. Portability
You can ask us to provide you or a third party with some of the personal information that we hold about you.
i. Right to withdraw consent
Where you have provided consent to our use of your data, you also have the right to withdraw that consent at any time. This means that we will stop processing your data.
1. Transferring your information outside of the United Kingdom
Where personal data is stored outside of the UK and the EEA, safeguards to protect personal data may include but are not limited to the UK Addendum used in conjunction with the EU Standard Contractual Clauses (SCCs), or UK International Data Transfer Agreement (IDTAs). Such safeguards will be subject to Transfer Risk Assessments (TRAs).
2. Making a complaint
If you think your data rights have been breached or you are not happy with how we handle your data, you are able to raise a complaint with us by contacting [email protected]. You can also contact the ICO at Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF or by telephone on 0303 123 1113 (local rate) or 01625 545 745.
3. Changes to our Privacy Notice
This privacy notice is kept under regular review. If we make any significant changes to the way in which we process your information, we’ll make the required changes to this Privacy Notice and will notify you so that you can raise any concerns or objections with us.
When making less impactful changes, we’ll update this notice and post a summary of the changes on our website.
This privacy notice was last updated in October 2023.
APPENDIX 1 – Service Users
How and when do we collect information about you?
The personal information that we obtain about you is collected during the engagement process and the delivery of our services. It includes information from the organisation referring you as well as information that you provide yourself. Written information is submitted to BWR via secure email and secure online forms, or this data is collected directly from you. Information is safely stored in our online database system.
We have made available an easy read version of this privacy notice or an ‘information sheet’, which shall be provided to you in the beginning of our engagement, which can be accessed via our website.
What type of information is collected about you and who provides it?
Information provided by the referrer may be: including but not limited to name, data of birth, gender, ethnicity, religion, contact details, health conditions, contacts of education provider, behavioural information, life background.
Information provided by you during the service delivery phase (football, creche, language classes, etc.): including but not limited to name, gender, date of birth, benefits, housing, education, training.
Information collected during your participation: we may take footage of our events for marketing and communication purposes where you may appear.
The information collected may include special categories of data which include health information, race, ethnic origin and religion.
How is your information used?
We may use your personal information to
- Carry out a thorough assessment of your needs;
- Provide an appropriate service which best meets your needs;
- Provide progress reports to funders;
- Claim payments from the funders;
- Monitor and manage risk;
- Protect yourself and the general public;
- Safeguarding;
- Collate anonymised or pseudonymised statistical information for funders, the charity and delivery partners
Lawful basis for processing
We rely on the following lawful basis for processing your personal data:
- For collecting your data to provide you with our services, we rely on legitimate interest. We have undertaken a legitimate interest assessment.
- For sharing your data with other organisations, we rely on your consent, and use a consent form to this effect.
- For special category data, we rely on substantial public interest along with conditions from the DPA 2018
How long do we keep your data for?
We retain the personal data of all service users for a period of six years post-service. After this time, personal data will be reviewed and securely destroyed.
Information relating to individuals who are referred to us who do not, for whatever reason, progress into one of our services will have their personal data retained for a period of twelve months.
Data is destroyed or deleted in a secure manner as soon as the retention date has passed.
Confidentiality, data sharing and safeguarding
We may use your consent to share your personal data with our delivery partners in order to provide you with a quality service which best suits your needs. Each organisation acts as individual data controller of your personal information and you should read their privacy policies in addition to this one. Third parties may also act as data processor of your data and for that reason will process your data according to our data protection policy and this privacy notice.
To comply with our duty of care and safeguarding, we may need to pass some information raising safeguarding concerns to the appropriate authorities. In such circumstances, we apply vital interest and legitimate interest as our lawful basis. Data subjects’ rights and other UK GDPR provisions may be restricted when concerning personal data processed in these circumstances. Exceptions and exemptions are applied on a case by case basis.
APPENDIX 2– Donors, fundraising, website visitors.
How and when do we collect information about you?
The personal information that we obtain about you is collected via online forms, emails, donating processes.
What type of information is collected about you and who provides it?
We may also collect information that is provided directly by yourself, for example via the online contact form or email (name, email address, phone number) or when completing a donation via our website or a fundraising platform (email address, Gift aid information)
How is your information used?
We may use your personal information to deal with your enquiry or administer donations.
Lawful basis for processing
When processing data about donors, we mainly rely on a legitimate interest. We are legally required to hold some types of information to fulfil our statutory obligations (for example the collection of Gift Aid).
When processing information about a general enquirer, we are most likely to rely on our legitimate interest.
How long do we keep your data for?
We keep your data as long as necessary. This means that if you make an enquiry and we’ve assisted with the enquiry, we will only keep your data for a very short period after your enquiry has been made.
If you’ve made a donation, we may keep your data for 6 years. Data is destroyed or deleted in a secure manner as soon as the retention date has passed.
Confidentiality and Financial transactions – who do we share the data with?
If you make a donation online, your card information is not held by us, it is collected by our third party payment processors who specialise in the secure online capture and processing of credit/debit card transactions. We will share transaction data with our payment services providers only to the extent necessary for the purposes of processing your payments, refunding such payments and dealing with complaints and queries relating to such payments and refunds.
All debit and credit card details are passed securely to our payment processing partner, according to the Payment Card Industry Security Standards.
We also may disclose your information if required by law, requested by law enforcement authorities, such as HMRC when you claim Gift Aid.
We do not share or sell your data with other third parties for any marketing purposes.
Fundraising and Marketing Communications
Your contact details may be used to provide you with information about our services or our fundraising opportunities via Email, text or other electronic message. We will only send you fundraising and marketing communications by email, text or other electronic message if you have explicitly provided your consent or if you have been involved in a commercial transaction with us. You may opt-out of our fundraising and marketing communications at any time by clicking the unsubscribe link at the end of our marketing emails. Alternatively, you can contact us to opt out by using any of the contact details listed at the top of this notice.
Cookies
We do not use any cookies.