Charity Privacy Policy

Statement of policy

Cleveland Housing Advice Centre (CHAC) is fully committed to compliance with the requirements of the General Data Protection Regulation (GDPR), the Data Protection Act 2018 and any successor legislation (together known as ‘data protection legislation’). CHAC is committed to a policy of protecting the rights and freedoms of individuals with respect to the processing of their personal data and special category personal data.

CHAC will therefore follow procedures which aim to ensure that all employees and volunteers, and others who have access to any personal data held by or on behalf of CHAC, are fully aware of and responsible for the handling of personal data in line with the data protection legislation.

In order to operate efficiently, CHAC has to collect and use information about people with whom it works. This may include current, past, and prospective clients; current, past, and prospective employees; current, past, and prospective volunteers; and our suppliers.

Who we are

CHAC is a charitable incorporated organisation (CIO) registered with the Charity Commission (Charity No. 1152785) formed in the early 1990s. Our objectives are the relief of poverty of the inhabitants of the Tees Valley and its immediate
environs, in particular but without limitation by:

The provision of one to one advice with casework on:
- a. Statutory rights to people who are homeless, threatened with homelessness, live in poor conditions, have disabilities, face social exclusion or otherwise need support and assistance;
- b. All range of welfare benefits, and housing issues; and
- c. All types of debt and arrears.
The provision of outreach advisory services to people who are housebound.
The provision of on the job training for residents who are both socially and economically excluded from the labour market.

We are registered with the Information Commissioner’s Office (Registration No. ZA437362). If you have any questions, would like to see our full Data Protection and Confidentiality Policies, or wish to raise a complaint about how we handle your data please contact Leona Gellatly, Joint Centre Manager, who is the lead for Data Protection, by emailing admin@chac92.co.uk.

How we use your data

First and foremost your data will be used to help with your case. We also use unnamed data (with no personal details) to help report back to our funders on how the services we provide are assisting our clients and to help us secure funding in the future to continue to offer our services. Please note that confidentially is between Cleveland Housing Advice Centre and you, and not between you and a specific adviser. Your data will be stored for six years after the end of your case and then securely destroyed. We check and destroy data every three months so it is possible that some of your data may be held for slightly over six years.

What kind of information do we record

We record information about you to help with your case. Some information is personal, it could be used to identify you. This includes your name, date of birth, address, or phone number.

What is special category data and how we use it

In order to help you with your case we may need to record special category data about you. This is information which, if improperly handled, could cause a significant risk to a person’s rights or freedoms. It includes factors such as race, ethnic origin, politics, religion, trade union membership, genetics, biometrics (where used for ID purposes), health, sex life or sexual orientation. We will only ask you for this information if it vital to our ability to help you with your case or for us to secure future funding to enable us to continue to provide our services to you and other clients. We would usually only need to ask you for your ethnic origin and your health information. If we need another type of special category data we will explain what it is, why we need it and how we will use it at.

Where your data is stored

The record of your case will be stored securely in an electronic case management system accessed by Cleveland Housing Advice Centre and provided by Dizions Ltd. We also store information using Office 365 provided by Microsoft Corporation. Paper copies of your data may also be stored securely in our main office and accessed by staff and volunteers of Cleveland Housing Advice Centre.

Withholding of Consent

Cleveland Housing Advice Centre will not be able to advise you without generating an unnamed record of your enquiry needed for quality assurance purposes. No personal information will be recorded, only what your enquiry was about.

When will we share data and who it will be shared with

We will not share information without your permission, unless required to do so by law.

What are your main data rights

Under data protection laws you have various rights regarding your data. We provide a brief summary of some of the main rights below, but you can always exercise all your rights at anytime even those not explicitly mentioned below.

The right of access

You have the right to access the data that we hold on you which includes CCTV images record by our CCTV system. This is known as a Subject Access Request. We have to tell if we are processing your data and what data we hold on you and if we have any other supplementary information regarding you. If you wish to access your data then you can do so either verbally, electronically, or in writing.
We will need to confirm your identity and have you complete a request form before we can give you the information. We have one month from the day after your request is submitted to provide you this information.

What lawful basis is used for processing personal data and special category personal data

CHAC primarily uses consent as the lawful basis for processing client personal data. CHAC also processes personal data using legitimate interest as a lawful basis. CHAC will process special category personal data on the basis of either explicit consent or legitimate interest on the condition of the establishment, exercise or defence of legal claims.

Legitimate Interest Assessments have been conducted and used to inform the above policy and can be provided on request.

How we handle personal data and special category personal data

Provide data privacy notices to data subjects.
Collect and process appropriate information and only to the extent that it is needed to fulfil operational needs or to comply with legal requirements.
Ensure the quality and accuracy of information when collected or received and during its use.
Apply checks to determine the length of time information is retained.
Take appropriate technical and organisational security measures based on risks to data subjects.
Not transfer outside the UK, EEA or other countries which have data adequacy agreement with the UK without suitable safeguards.
Ensure that any information incidents are reported to the Information Commissioners Office and where appropriate the data subject.
Mitigate risks to the data subjects in the event of an information incident using an appropriate data breach policy.
Ensure that the rights of our data subjects can be properly exercised. These rights include:
- The right to be informed
- The right of access
- The right to rectification
- The right to erase
- The right to restrict processing
- The right to data portability
- The right to object
- Rights in relation to automated decision making and profiling.

In addition, we will ensure that:

There is someone with specific responsibility for data protection in the organisation. The post responsible for data protection are the Joint Centre Managers.
Organisational information and in particular privacy risks are risk assessed, documented and controlled.
Everyone managing and handling personal data and special category personal data understands that they are responsible for following good Information Governance / Assurance practice, and for complying with the data protection legislation.
Everyone managing and handling personal data and special category personal data is appropriately trained and supervised to do so.
Queries about processing personal data and special category personal data are promptly and courteously dealt with within the requirements of the data protection legislation.
Data sharing and processing is carried out under an appropriate written agreement, setting out the scope and limits of the sharing. Any disclosure of personal data will be in compliance with approved procedures.

All employees and volunteers will be made fully aware of this policy and their duties and responsibilities under it. All employees and volunteers will take steps to ensure that personal data is kept secure at all times against unauthorised or unlawful loss or disclosure.

Training

CHAC will ensure that all new staff receive training on this policy and that regular refresher training on information assurance is carried out with all staff that have access to client data.

Data Controller & Data Protection Lead

The Data Controller for Data Protection purposes is Cleveland Housing Advice Centre. The lead for Data Protection is Leona Gellatly, Joint Centre Manager. She can be contacted by phone on 01642 254544, by email to admin@chac92.co.uk, or by visiting our office at 16 Borough Road, Middlesbrough, TS1 5DW.

Review

This policy will be reviewed as required by the Joint Centre Managers to ensure continuing compliance with data protection legislation but in any event no later than below.

Date of last review: June 2024

Date of next review: June 2025