Ara Privacy Statement
What does this privacy notice cover?
This privacy notice sets out what information we collect from you and why, how we process it and how we store it securely. We’ll keep this notice updated so that you can be confident when sharing your information with us that it will only be used for what we say here.
We aim to protect all the information we hold, in line with legal requirements and to maintain high standards of confidentiality, integrity and availability at all times.
We may obtain information by phone, text, email, online, and other methods like application forms and references. When collecting data, we will ensure that individuals:
- Understand why the information is needed and what it will be used for.
- Give consent, wherever possible in writing, for their data to be used.
- Data Controller
- When we process your personal data, Ara is described as the ‘data controller’ under data protection law.
Our contact details are:
Ara, 11-12 King’s Court, King Street, Bristol, BS1 4EF
Please do not hesitate to contact us if you have any questions about this statement, information we hold about you or our overall approach to data protection and confidentiality.
Our Privacy Notice
How we collect information from you:
Ara collects information from you via a variety of sources, including when you:
- make an enquiry about Ara
- apply to work for us or volunteer for us
- call us, write to us, e-mail or meet with us
- respond to a survey
- sign up for our newsletter
- visit our offices
- use our social media sites or websites (see our Cookie Policy)
We may also take general photographs at our events, to use for general marketing and publicity. However, photographs of individuals will only be used for those purposes with your consent.
We may receive information about you from third parties
Who we collect personal information about
People who use our services – this includes current, former and potential users who access our support and other services and could also include their family and people associated with them.
Staff – this includes current, former and potential staff, as well as Board of Trustees and apprentices and volunteers.
Anyone who makes a complaint or enquiry and visitors to our website and offices.
Data we collect
People we work with include people who we provide support for, people who attend our projects, volunteers and staff.
When you apply to use one of our services, we may ask for:
- your full name (and proof of your identity / photo ID).
- your date of birth.
- your National Insurance number (your unique identifier).
- your contact details (phone, e-mail or correspondence address).
- details of anyone authorised to act on your behalf (if applicable).
- basic details (name, gender and date of birth) of all household residents.
- your health and social care needs
- your disability and/or medical history
If you provide us with personal information relating to members of your family or your carers we will assume that you do so with their knowledge and their consent to the collection and processing of the information.
It is important that you notify us of any changes to your personal information.
How we use personal information and the lawful basis for processing
Contractual Necessity
Most of the information we require from you is used to enter into or manage an agreement between you and Ara
Please read your support plan carefully for specific details as ‘performance of a contract’ is usually the lawful basis for processing your information as set out in data protection law.
The processing we conduct can be summarised as:
- Ensuring we are able to provide the support and services that you need
- Complying with relevant legislation and regulation.
- Legitimate Interests
- The other lawful basis for processing your data, as defined in data protection law, that we regularly rely on is ‘legitimate interest’ (processing is necessary for the purposes of legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests, rights or freedoms of the data subject).
Our legitimate interests may include the need to:
- eliminate discrimination or advance equality of opportunity;
- prevent and detect crime;
- conduct research and statistical analysis to help improve our the services offered to our users;
- evaluate our performance against other benchmarks.
When your personal data or information is used for statistical or research purposes it is anonymised or pseudonymised so that you cannot be identified. Ara conducts surveys regularly and periodically relating to our services to gauge satisfaction and make improvements based on feedback.
Where you believe that our legitimate interests are overridden by your interests, rights or freedoms as the data subject you have the right to object.
Consent
We also seek your consent to hold some information about your lifestyle.
We will always give you a ‘prefer not to answer’ option when we ask for information about your lifestyle. Please note however that this information helps us to improve services.
Other Lawful Bases
In exceptional circumstances there may be another lawful basis for processing your data for example ‘compliance with a legal obligation’ or to ‘protect the vital interests of a data subject or another person’.
Special categories of data
Under Data Protection law certain categories of personal information are classified as sensitive or special categories of data.
These categories are data relating to:
- racial or ethnic origin;
- sexual orientation;
- gender identity;
- political opinions;
- religious or philosophical beliefs;
- trade union membership;
- data concerning health;
We minimise the use of special categories of personal data but, given the services we provide there are times when we may have a legitimate interest in processing special categories of data and therefore, we may ask for your consent to collect and process this data.
We will always give you a ‘prefer not to answer’ option when we ask for any of the special categories of data above. Providing us with special categories of data helps us deliver our services.
Collecting special categories of data also helps us ensure that we meet the Public-Sector Equality Duty. This requires Ara, as a service provider, to give due regard to the need to eliminate discrimination, advance equality of opportunity and foster good relations. This mean that we may ask you for information about their ethnicity, religion or belief and so on but our responsibilities under the Public-Sector Equality Duty do not over-ride your right to privacy.
When we collect specific sensitive data, we will notify you of how we will use it, and we will tell you who it may be shared with. We do not process genetic or bio-metric data for uniquely identifying a natural person.
Job applicants and our current and former staff
Personal information about unsuccessful candidates will be held for 6 months after the recruitment exercise has been completed; it will then be destroyed or deleted. We retain depersonalised statistical information about applicants to help inform our recruitment activities, but no individuals are identifiable from that data.
Once a person has taken up employment with Ara we will compile a file relating to their employment. The information contained in this will be kept secure and will only be used for purposes directly relevant to that person’s employment. Once their employment with Ara has ended, we will retain the file in accordance with the requirements of our Data & Document Retention Policy and then delete it.
Complaints and enquiries
If you make a complaint or enquiry we may collect and store personal information in relation to it. We will keep your information secure and use it only for the purpose it was collected. When the complaint is resolved or the enquiry is completed, we will retain the information in accordance with our Data & Document Retention Policy and then destroy it.
CCTV
CCTV is in operation at our building at King’s Court. We are the ‘data controller’ of this information.There is clear signage both inside and outside of the building notifying people that CCTV is in operation.
Information we collect via our website
When you visit our website, we collect standard internet log information, such as your IP address, host name, browser type and operating system.
This information may be used to help diagnose problems with our server and to administer our website, so we can improve your experience of viewing the site. We may also use this information for other purposes deemed reasonable and necessary.
See our cookie policy for more on the information we collect from you when you visit our site.
Links to other websites
Our website may contain links to other websites of interest. If you follow a link from the Ara website to an external site, we recommend that you check the privacy notice of that site before giving any personal details.
Sharing your information
Your personal information will be kept secure and confidential. Usually we will not disclose personal data without consent but we may share information with third parties and other agencies we work with, including local authorities, social services, the Police and other agencies when Ara believes it is in yours or the public’s interest to do so, or as required by law.
Please be aware:
Ara may need to share personal information with government departments and agencies, with our regulator and auditors, or with other organisations and agencies where we are legally bound to do so.
How long we keep information:
Information will be kept for as long as our work with you is active and for a period not exceeding six years afterwards.
Email communications opt-out:
If we hold your email in our database, occasionally we will send you emails about the following:
- events and information,
- news and surveys
- other information that we think will be of interest to you
You can unsubscribe at any time by emailing us at info@recovery4all.co.uk
Security of information
Ara operates a range of information and communications systems and technologies for efficient operation of the charity. Personal information is stored and managed within those systems which are maintained to achieve a high level of Confidentiality, Integrity and Availability (CIA) including following best practice cyber security standards.
We hold information in IT systems which may be copied for testing, backup, archiving and disaster recovery purposes. All data is held within the European Economic Area.
For further information on how we maintain the security of your information please see our Data Protection & Privacy Policy.
Changes to our privacy notice
This privacy notice will be updated to reflect changes either to the way in which we operate or changes to the data protection legislation. To make sure that you keep up to date, we suggest that you revisit this notice from time to time.
What we will not do
- We will not send you unsolicited marketing material. We will not sell your personal data on to third parties.
- We will not pass on your personal data to unrelated third parties unless we are allowed or required to do so by law or we have your explicit permission to do that.
- We will not transfer or store your personal data outside of Europe (the European Economic Area) outside of the control of UK / European regulations.
Your data, your rights
Ara is committed to respecting your rights when we deal with your personal data.
You have the following rights:
- Right to be Informed
- Right of Access
- Right to Rectification
- Right to Erasure
- Right to Restrict Processing
- Right to Data Portability
- Right to Object
- Rights in relation to automated decision making and profiling
Further information on your rights is available here.
Can I access my information?
You have a right to ask to see a copy of the information we hold about you. If you want a copy of your personal information, send a description of the information you want to see and proof of your identity by post or email.
Email us at: Info@recovery4all.co.uk
Write to us at: FAO Data Protection Officer, Ara, King’s Court, King Street, Bristol. BS1 4EF
We will respond within one calendar month, from the day after receiving your request.
Cookies Statement
Your privacy is important to Ara. This Cookie statement provides information about the cookies information that we collect, and the ways in which that personal information is used.
How we use Cookies
The cookie settings on this website are set to “allow cookies” to give you the best browsing experience possible. If you continue to use this website without changing your cookie settings or you click “Accept” below then you are consenting to this.
Like many websites, we may collect and record information in order for us to understand more about how our website is used and to provide you with a personalised experience when you visit our website. We use ‘cookie technology’ to do this. We may use cookies to gather certain information about you, including details of your operating system, browser version, domain name and IP address, and the details of the website you linked from to the website. The Trust uses Google Analytics to record this information and implements Demographics and Interest reporting, which enables us to better understand website usage and improve the experience for our visitors.
Cookies identify your browser, and basic information that you have shared with Google to our servers when you visit our website. They do not identify you as an individual. If you do not want to accept cookies you can easily disable this function by changing the settings on your Internet browser. However, if you block cookies you will not have the opportunity to benefit from all the features on our website. You are able to completely opt out of Google Analytics for Display Advertising and customise Google Display Network adverts through your browser’s Advert Settings.
Updating this statement
Ara may update this Cookie statement by posting a new version on the website. You should check this page occasionally to ensure you are familiar with any changes.
Other websites
This website contains links to other websites. Ara is not responsible for the privacy policies or practices of any third party.
