Privacy Policy

Introduction

Lisieux Trust exists to support people with disabilities. Our ethos is to recognise and value the individual rights of people with disabilities, encouraging them to achieve their full potential and take a valued role in society.

For us to be able to function as an organisation, we need to use personal data about people that are connected to our work. We hold and process personal data about a range of people, including people who:

• Receive support from us or might want to receive support from us

• Have a family member or friend who receives support from us

• Work or volunteer for us or might want to work or volunteer for us

• Deliver services to us

• Give us funding or other types of support

• Want to know about the work that we do.

If you are one of these people, this document explains how we use your data.

What data do we collect and why?

If you receive support from us or have told us that you might want to receive support from us in your home or in the community, we use your data to plan and deliver your support effectively. This can include using information about you to assess any possible risks to you and to employees of Lisieux Trust.

We might process data about you that includes:

• Personal data such as your name, date of birth, contact details, financial information, interests

• Sensitive personal data such as your racial or ethnic origin, political opinions, religious or other beliefs, disability, health, support needs, sex life or sexual orientation.

We are required by law to tell you the basis on which we process your data. We process your data because:

• We deliver care and support that is funded by the local authority or health authority which forms part of their statutory duties (public interest) and/or;

• We are required to do so in order to fulfil a contract that we have with you or your legal representative acting on your behalf.

We process your sensitive personal data because:

• It is necessary due to social security and social protection law

• It is necessary for us to provide and manage social care services

• We are required to provide data to our regulator, the Care Quality Commission (CQC), as part of our public interest obligations.

We may also from time to time ask for your consent to process your data in other ways. If we need to ask for your permission, we will explain what we would like to do with the data and offer you a clear choice. We will also explain how you can withdraw your consent.

We collect your data from:

• You or your legal representative and/or;

• Third party organisations.

We do this face to face, via phone, via email, via our website, via post and via text.

We may share your data with third party organisations where we have a legitimate or legal reason to do so. These include:

• Other parts of the health and care system such as local hospitals, the GP, the pharmacy, social workers, clinical commissioning groups, and other health and care professionals;

• The Local Authority;

• Organisations we have a legal obligation to share information with i.e. for safeguarding, the CQC;

• The police or other law enforcement agencies if we have to by law or court order.

  • We will not share your information with any other organisations or individuals unless you have given your consent or unless a mental capacity assessment has taken place that shows you don’t have the capacity to consent and sharing the information is deemed to be in your best interests.
  • If you receive support from us or have told us that you might want to receive support from us through the Disability Information Resource Centre, we use your data to deal with your query. This can include using information about you to assess any possible risks to you and to employees of Lisieux Trust.
  • We might process data about you that includes:
  • • Personal data such as your name, date of birth, contact details, financial information, interests
  • • Sensitive personal data such as your racial or ethnic origin, political opinions, religious or other beliefs, disability, health, support needs, sex life or sexual orientation.
  • We are required by law to tell you the basis on which we process your data. We process your data where you have given us consent to do so and/or we have a legitimate interest in doing so and will only process it in the ways that you would reasonably expect us to in order to help resolve your query.

We collect your data from:

• You or your legal representative;

• Third parties, with your consent or the consent of your legal representative.

We do this face to face, via phone, via email, via our website, via post and via text.

We may share your data with third party organisations where we have a legal reason to do so or where you have provided your consent for us to do so.

If you have a family member or friend who receives support from us, we may use your data to support the person concerned.

We might process data about you that includes:

• Personal data such as your name, date of birth, contact details, financial information, interests

• Sensitive personal data such as racial or ethnic origin, political opinions, religious or other beliefs, disability, health, support needs, sex life or sexual orientation, only where it is relevant for the support we give to the person concerned and you have consented to give us this information.

We process your data because we have a legitimate business interest in:

• Supporting the person concerned to maintain a relationship with you

• Holding next of kin and lasting power of attorney information about the individuals who use our service

• Keeping emergency contact details for our residents and tenants.

We may also process your data with your consent. If we need to ask for your permission, we will offer you a clear choice and ask that you confirm to us that you consent. We will also explain clearly to you what we need the data for and how you can withdraw your consent.

  • We collect your data from:
  • • You or your legal representative(s);
  • • Third parties.
  • We do this face to face, via phone, via email, via our website, via post, via forms and via text.
  • We may share your data with third party organisations where we have a legal reason to do so. These include:
  • • Other parts of the health and care system such as local hospitals, the GP, the pharmacy, social workers, clinical commissioning groups, and other health and care professionals;
  • • The Local Authority;
  • • The police or other law enforcement agencies if we have to by law or court order.

If you are one of our employees, directors or volunteers or you might want to be an employee, director or volunteer, we use your data to assess your application and/or to ensure your role with us is a success. We might process data about you that includes:

• Personal data such as your name, date of birth, contact details, financial information, work history

• Sensitive personal data such as your racial or ethnic origin, religious or other beliefs, disability, health, sexual orientation, convictions or cautions.

We require this data so that we can assess your application, contact you, pay you and/or make sure you receive the training and support you need to perform your role. By law, we need to have a lawful basis for processing your personal data.

We process your data because:

• We have a contract with you or expect to enter into a contract with you

• We have a legal obligation under UK employment laws

• We are required to do so in our performance of a public task.

We process your sensitive personal data because:

• It is necessary due to social security and social protection law - we are required to perform Disclosure and Barring Service (DBS) checks on our staff

• It is necessary for us to process requests for sick pay or maternity pay

• We are required to provide data to our regulator, the Care Quality Commission (CQC), as part of our public interest obligations.

We may also process your data with your consent. If we need to ask for your permission, we will offer you a clear choice and ask that you confirm to us that you consent. We will also explain clearly to you what we need the data for and how you can withdraw your consent.

We collect your data from:

• You or your legal representative(s);

• Third parties, such as previous employers or agencies.

We do this face to face, via phone, via email, via our website, via post, via application forms and via text.

We may share your data with third party organisations where we have a legal or other reason to do so. These include:

• External organisations for the purposes of conducting pre-employment reference and employment background checks

• Former employers, to obtain references

• Professional advisors, such as Human Resources advisors or lawyers

• Her Majesty’s Revenue and Customs (HMRC);

• Our pension and healthcare schemes

• Organisations we have a legal obligation to share information with i.e. for safeguarding, the CQC;

• The police or other law enforcement agencies if we have to by law or court order.

If you work with us in your professional capacity, we may hold personal information about you, such as your contact details. We have a legitimate interest in processing your data in order to effectively work with you. We will only use your information in the way you would reasonably expect us to in the context of our work with you. If we would like to use it for any other reason, we will ask for your consent before doing so.

If you have donated funds to us, or supported us in other ways, we are very grateful. We may hold personal information about you such as your contact details and financial information. We will use your information to process the donation or support you have given. If we would like to use it for any other reason, we will ask for your consent before doing so.

If your details have been provided to us by an employee as their emergency contact, we may hold personal information about you, such as your contact details. We will only process your data with your consent.

If your details have been provided to us by an applicant for a job role, director position or volunteer position to provide a reference for that person, we may hold personal information about you, such as your contact details. We will only process your data with your consent.

  • If you don’t fit into any of the categories above:
  • Where we have received your details from a third party who thinks that you might be interested in the work that we do, we might contact you to ask whether you would like to hear our latest news, be invited to events or hear about opportunities to support us, either financially or in other ways. When we contact you, we will tell you the details of the third party that gave us your contact details, we will ask for your permission to contact you, confirm what you would like to be contacted about and how. You can refuse to grant this permission or restrict our contact with you.

How do we protect your data?

Lisieux Trust has put in place measures to protect the security of your personal information. It has internal policies, procedures and controls in place to try and prevent your personal information from being accidentally lost or destroyed, altered, disclosed or used or accessed in an unauthorised way. We limit access to your personal information to only those people who have a business need to know in order to perform their duties and responsibilities.

We will retain your data as long as is needed to fulfil the purpose for which it was collected and in order to comply with relevant legal requirements. Details of how long we keep specific types of data is explained in our Data Protection Policy. To request a copy of specific retention periods, please contact our head office on 0121 377 7071 or write to us at Lisieux Trust, 184 Sutton New Road, Erdington, Birmingham, B23 6QU or email us at info@lisieuxtrust.org.uk.

What are your rights as an individual?

We are legally required to tell you about the rights you have under data protection law relating to the way we process your data. These rights are:

• You are able to access the data we hold about you at any time. Please send us your request in writing by writing to us at Lisieux Trust, 184 Sutton New Road, Erdington, Birmingham, B23 6QU or emailing info@lisieuxtrust.org.uk.

• You have the right to ask us to correct any data we have which you believe to be inaccurate. You can also request that we restrict all processing of your data while we consider your rectification request;

• You have the right to request that we erase any of your personal data which is no longer necessary for the purpose we originally collected it for.

• Where our use of your data requires your consent, you can withdraw this consent at any time

• Where we rely on our legitimate interest to process your data, you can ask us to stop doing so at any time or object to the processing

• You can request to change or stop the way(s) that we process data about you. We will comply with this request unless it means we cannot proceed with the purpose for which you provided your data to us, for example if your make a Gift Aid donation or entered into a fund holder agreement with us.

• You can request that we transfer your data to another organisation so that you can reuse it for your own purposes

• If you are not happy with the way we have processed your data, you can complain to the Office of the Information Commissioner. The details for how to do this are available at www.ico.org.uk/concerns or you can call their helpline on 0303 123 1113 or you can write to them at: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

If you contact us regarding your personal data, we may need you to provide adequate information for us to be able to identify you, for example, a passport or driver’s licence. This is to make sure that data is not shared with the wrong person inappropriately. We will always respond to your request as soon as possible and at the latest within one month.

  • Transferring data outside the European Economic Area (EEA)
  • GDPR requires that when organisations transfer personal data outside the EEA that they take steps to ensure that the data is properly protected.
  • The European Commission has determined that certain countries provide an adequate data protection regime in line with GDPR standards. These countries currently include Andorra, Argentina, Canada, Guernsey, Isle of Man, Israel, New Zealand, Switzerland, Faroe Islands, Jersey and Uruguay, but this list may be updated. As such personal data may be transferred to people or organisations in these countries without the need to take additional steps.
  • Through the use of some IT systems, it may be that some personal data is transferred outside the EEA, for example to the US. We are confident that the data security measures that the systems have in place for the transfer of data meet relevant legislation and provide adequate protection in line with GDPR.
  • Automated decision making
  • Automated decision making occurs when an electronic system uses your personal information to make a decision without human intervention. We do not envisage that any decisions will be taken about individuals based solely on automated decision-making, including profiling.
  • Changes to this privacy notice
  • Lisieux Trust reserves the right to update or amend this privacy notice at any time. We will issue you with a new privacy notice when we make significant updates or amendments. We may also notify you about the processing of your personal information in other ways.

Contact details:

If you have any questions about this privacy notice or about the way we process your data, please contact us:

By email at: info@lisieuxtrust.org.uk

By phone at: 0121 377 7071

By post at: Lisieux Trust, 184 Sutton New Road, Erdington, Birmingham, B23 6QU.

Our Data Protection Officer is our Chief Executive, Jess Alsop-Greenacre. You can request to speak to her directly using these contact details.