Privacy Notice

With the introduction of the General Data Protection Regulation (GDPR) on the 25th May 2018, we have reviewed POhWER's privacy policy. The revised policy is shown below.

POhWER is a charity and membership organisation. We provide information, advice, support and advocacy to people who experience disability, vulnerability, distress and social exclusion.

We are committed to maintaining the trust and confidence of the people we support, those we work with, those who support us, and those we come into contact with in other ways. We do this in line with POhWER’s values and with the law.

Our registered office is Hertlands House, Primett Road, Stevenage SG1 3EE.

Our registered charity no. is 1061543

Our company no. is 3323040

We are registered with the Information Commissioner’s Office under reference: Z8575018.

We will never sell, rent or trade personal information.

We will make sure that any personal information we hold is secure, accessible only to those who need to access it, and held for only as long as is needed. We will not transfer personal information outside the European Economic Area.

This Privacy Notice tells you what to expect when POhWER collects personal and/or sensitive information. It applies to information we collect about:


People who use our services

Why we collect and process your information

We have to explain the legal reasons why we collect and process personal information.

Local authorities, (and sometimes other organisations such as CCGs), award contracts to POhWER to deliver information advice and advocacy services in the parts of the country where we work. This means those organisations are the ‘data controller’ for the personal and sensitive information of the people we support under those contracts. POhWER is the ‘data processor’ for that information because we use the information to make sure we deliver the service the local authority has awarded us a contract to deliver.

The local authorities require us to process this information in order for them to deliver a ‘public task’. This means they have to do something (such as provide information, advice and advocacy services) in the public interest and/or as part of their official functions. As the data processor, we hold and use your personal and sensitive information under the ‘lawful basis’ of ‘legitimate interest’. This means that we have a legitimate interest in processing your personal and sensitive information in order to deliver the services we are contracted to deliver by the data controller; it is necessary for us to use the personal and/or sensitive information to provide you with the support you can receive under these services; and without using that personal or sensitive information we would not be able to provide that support.

We’ll only record personal information that we need to provide support to you. This support may be information, advice, and/or advocacy. Depending on your support needs, this could include:

  • Your name and contact details
  • Other personal information such as your gender, race or ethnic origin, sexual orientation and health information.

Using your information

We collect this personal information to help us support you. We also have to provide anonymous reports to the organisations who have awarded us the contracts to deliver the service. These anonymous reports mean that you cannot be identified from the report. The local authorities and other organisations we provide this anonymous information to, require us to do this under our contracts so that they can be sure we are supporting all members of the local communities where we work who need the support. We may also share anonymous information with regulators, government departments and publicly in our reports, social media and website. If you don’t want to give us this information, you don’t have to.

If we want to use your personal information to keep you updated about POhWER’s activities, or to send you any other information that is not related to supporting you to resolve a specific problem, we will ask for your permission before we do this.

Sharing your information

With your permission, we may contact other organisations to help you solve your problem, or because another organisation may be able to help you solve your problem if we can’t.

There are times when we might have to share your information without your permission. If we do, we will always make sure there is a legal basis for us to do that. For example, if we receive a court order, we have to produce information demanded in that order, or if you have told us something that makes us think you may harm yourself or someone else, we may have to tell the police or social services.

Storing your information

You may give us personal or sensitive information when we give you information, advice or advocacy support face-to-face, over the phone, by email or letter. We store that information on our secure case management system, including copies of any emails or correspondence and notes about the support we have given you. Our case management system uses encryption and password protection.

Calls to our Information, Advice and Advocacy Support Centre are recorded for quality and training purposes. Recordings of these calls are not loaded on to our case management system and are automatically deleted from the secure telephone system six months after the recording is made. If we need to save any of these recordings, for example, to respond to a complaint, we will save that recording under a separate process for handling complaints that is detailed elsewhere in this Privacy Notice.

We will retain your information on our case management system for six years after the closure of your case with us (or as determined by individual contracts, if different). After that, your information will be permanently deleted.

Your rights about your information as a user of our services

Under data protection laws, you have certain rights about how your information is used and these rights are outlined below. If you want more information or guidance about your rights, we will try to help you, or you can contact the Information Commissioner’s Office. The contact details are at the end of this Privacy Notice.

If we hold inaccurate or incomplete information about you, please tell us and we will correct or complete the data. If we have shared that information with anyone else, in the circumstances we have outlined above, we will, where possible, inform them of any corrections and tell you where this has happened. This is called your right to rectification.

You have a right to access the personal information we hold about you. You can request a copy of the information we hold about you and we will provide that to you as quickly as we can but certainly within one month of us receiving the request. This is called a Subject Access Request. We must verify your identity when you make the request to make sure we do not send personal information to someone pretending to be you. We will try to as flexible as possible in how we do this but sometimes you may be asked to provide copies of documents that prove your identity because we must make sure your personal information is not sent to the wrong person.

Under most circumstances you will be provided with a copy of the information free of charge. In the rare circumstances where we may charge, we would let you know at the time of your request and any charges would only be based on the administration cost of providing the information to you.

In some circumstances, you have a right to erasure. We have already explained how long we keep your personal information. At the end of that period, when we no longer have any reason to keep or process it, it will automatically be deleted it from our systems.

You have a right to restrict processing in some circumstances. This means that in those circumstances, we would still store your information but not process, or use it. These are the situations where you can ask us to restrict processing your information:

  • Where you believe that the information we hold is not accurate, we would restrict processing until we have verified the accuracy of the personal information;
  • If you object to us using the information to provide you with information, advice or advocacy support, we would restrict processing until the local authority (the data controller) decided how we should move forward;
  • If we have used your information unlawfully, and you don’t want us to erase the information, you can ask us to simply hold it instead;
  • If we no longer need the personal information and before we automatically delete the information from our system, you request us to hold it to make or defend a legal claim.

If our contract with a local authority ends, you have the right to have your information transferred on active cases to a new provider. Either the local authority or we would ask for your permission to do this. This is called the right to data portability.

You have the right to object to POhWER using your information, even though we are doing so to support you and the local authority to complete their ‘public task’. If you do object, we would stop processing the information and raise this with the local authority as the data controller. They would then have to decide if there were circumstances that meant their grounds for asking us to process the information overrode your right to object.

A ‘personal data breach’ means that personal information is disclosed to, or accessed by, someone who is not authorised to see it. We make sure that our systems are secure in line with recognised standards but if a personal data breach did happen that involved your personal information, we would tell you as soon as we became aware of it and let you know what we were planning to do about it. We would also tell the Information Commissioner’s Office about it and make sure you know how to complain to the Information Commissioner’s Office about the personal data breach.


Our current and former staff, volunteers and people who apply for roles in POhWER

Why we collect and process your information

POhWER is the data controller for the information you provide during the process of applying for a job with POhWER or applying to volunteer with us. All of the information you provide during the application process will only be used so that we can progress your application, or to fulfil legal or regulatory requirements if necessary.

The information you provide will be held securely by us and/or our data processors (eg a recruitment agency), whether the information is in electronic or paper format.

Using your information

We will use the contact details you provide us to contact you to progress your application. We will use the other information you provide to assess your suitability for the role you have applied for.

Application stage for employment with POhWER

We ask you for your personal details including name and contact details. We will also ask you about your previous experience, education, referees and for answers to questions relevant to the role you have applied for. Our HR department will have access to all those details but the people responsible for shortlisting will not have access to your name and contact details until after shortlisting has taken place, and only then to the details of those applicants who are chosen for interview.

You will also be asked to provide equal opportunities information. This is not mandatory information – if you don’t provide it, it will not affect your application. This information will not be made available to any staff outside the recruitment team, including those responsible for shortlisting and interviewing, in any way that can identify you. Any information you do provide will be used only to produce and monitor equal opportunities statistics.

We might ask you to complete tests and attend an interview. Our interviewing managers will take notes during the interview to enable them to score your answers to set interview questions that are the same for all interviewees. After interview, these notes will be held by the HR department.

If you are unsuccessful following interview for the positon you have applied for, we may ask you if you would like your details to be retained by our HR department for a period of six months. If you say yes, we would proactively contact you if any suitable vacancies arise during this period.

Application stage to volunteer with POhWER

When you apply to volunteer with POhWER, you will complete an application form. The information on that form will be used to contact you to arrange an interview with the local team where you are applying to volunteer.

If you are unsuccessful in the application process, we will retain your application for period of six months and then the information will be permanently deleted.

Successful volunteer applicants

If you are successful in your application to volunteer, we will ask you for information so that we can carry out pre-volunteering checks. You must successfully complete pre-volunteering checks prior to the start of your volunteering with POhWER. Due to the nature of our work and the client groups you may be supporting or otherwise interacting with, we must seek assurance as to volunteers’ trustworthiness, integrity and reliability.

  • Proof of your identity – you will be asked to provide original documents and we will take copies
  • All POhWER staff and volunteers who work unsupervised with vulnerable adults or children must hold a valid enhanced Disclosure and Barring Service check. We will support you to obtain this.
  • We will contact your referees, using the details you provide in your application, directly to obtain references
  • Your bank details to enable us to process any expenses you may incur while volunteering with POhWER to enable us to reimburse
  • Emergency contact details – so we know who to contact in case you have an emergency while volunteering for POhWER.

Sharing your information

Staff

We may use recruitment agencies, payroll providers, and workplace pension providers to provide services associated with recruitment and employment. These are data processors. We have contracts in place with them and they cannot do anything with your personal information unless we have instructed them to do it. They will not share your personal information with any organisation apart from us. They will hold it securely and retain it for the period we instruct.

There are times when we might have to share your information without your permission. If we do, we will always make sure there is a legal basis for us to do that. For example, if we receive a court order, we have to produce information demanded in that order.

When a contract with a local authority is coming towards the end of its term, we are required to provide certain details to the local authority, which shares those details with other potential providers of the service. These details are required under TUPE legislation and will include length of service and role but no other identifying personal information. If a new provider is appointed and you are eligible for TUPE HR would notify you that we will be sharing additional personal and/or sensitive information with the new provider. We will only share information as required under TUPE legislation.

Volunteers

There are times when we might have to share your information without your permission. If we do, we will always make sure there is a legal basis for us to do that. For example, if we receive a court order, we have to produce information demanded in that order or if there are safeguarding concerns raised that involve you.

Storing your information

Staff

If you are successful, the information you provide during the application process will be retained by us as part of your personnel file for the duration of your employment plus 6 years following the end of your employment. This will include your criminal records declaration, references, DBS check results (including updates). During the course of your employment, we may collect further personal or sensitive information with your permission, for example, the results of occupational health assessments. This information will also be retained for the period of your employment plus 6 years following the end of your employment.

Volunteers

If you are successful, the information you provide during the application process will be retained by us as part of your personnel file for the duration of your employment plus 6 years following the end of your employment. This will include your criminal records declaration, references, DBS check results (including updates). During the course of your volunteering, we may collect further personal or sensitive information with your permission, for example, you may want to tell us about any health issues that impact on your volunteering. This information will also be retained for the period of your volunteering plus 6 years following the end of your volunteering.

Your rights about your information as our current and former staff and volunteers, and people who apply for those roles in POhWER

Under data protection laws, you have certain rights about how your information is used and these rights are outlined below. If you want more information or guidance about your rights, we will try to help you, or you can contact the Information Commissioner’s Office. The contact details are at the end of this Privacy Notice.

If we hold inaccurate or incomplete information about you, please tell us and we will correct or complete the data. If we have shared that information with anyone else, in the circumstances we have outlined above, we will, where possible, inform them of any corrections and tell you where this has happened. This is called your right to rectification.

You have a right to access the personal information we hold about you. You can request a copy of the information we hold about you and we will provide that to you as quickly as we can but certainly within one month of us receiving the request. This is called a Subject Access Request.

In some circumstances, you have a right to erasure. We have already explained how long we keep your personal information. At the end of that period, when we no longer have any reason to keep or process it, we will delete it from our systems.

You have a right to restrict processing in some circumstances. This means that in those circumstances, we would still store your information but not process, or use it. These are the situations where you can ask us to restrict processing your information:

  • Where you believe that the information we hold is not accurate, we would restrict processing until we have verified the accuracy of the personal information;
  • If you object to us using the information to provide you with information, advice or advocacy support, we would restrict processing until the local authority (the data controller) decided how we should move forward;
  • If we have used your information unlawfully, and you don’t want us to erase the information, you can ask us to simply hold it instead;
  • If we no longer need the personal information and before we automatically delete the information from our system, you request us to hold it to make or defend a legal claim.

You have the right to object to POhWER using your information. If you do object, we would stop processing the information and then determine if there were circumstances that meant POhWER’s grounds for processing the information overrode your right to object.

A ‘personal data breach’ means that personal information is disclosed to, or accessed by, someone who is not authorised to see it. We make sure that our systems are secure in line with recognised standards but if a personal data breach did happen that involved your personal information, we would tell you as soon as we became aware of it and let you know what we were planning to do about it. We would also tell the Information Commissioner’s Office about it and make sure you know how to complain to the Information Commissioner’s Office about the personal data breach.


Our members and supporters, including people who donate to support POhWER’s activities

Why we collect and process your information

We collect your information, with your permission, so that we can keep you updated with POhWER’s activities as a charity.

As a member, we hold your contact details so that we can communicate with you about our Annual General Meeting. We may also hold any information you provide us about any disabilities so that we can make sure proper arrangements are in place to support you attending the Annual General Meeting. You can stop being a member at any time by telling us that this is what you want to do. If you do this, we will erase all the personal information we hold on you. We will ask you annually if you want to continue to be a member and if we have your permission to continue to use and store your personal information. If you say no, we will erase all the personal information we hold on you and you will no longer be a member of POhWER. You can switch to being a supporter at any time.

As a supporter, we hold your contact details so that we can communicate with you about activities that you can take part in to support POhWER. You can stop being a supporter at any time by telling us this is what you want to do. If you do this, we will erase all the personal information we hold on you. We will ask you annually if you want to continue to be a supporter and if we have your permission to continue to use and store your personal information. If you say no, we will erase all the personal information we hold on you and you will no longer be a supporter of POhWER. You can apply to become a member of POhWER at any time.

As someone who donates to support POhWER’s activities, where you provide us with personal information, we will hold this securely. We will only use the information that you have given us for to meet legal requirements for example, auditing and Gift Aid recording. We are required to hold this information for 6 years after you have donated to POhWER, if you have given us your personal information at that time.

Sharing your information

In all three cases above, we will not share, rent or sell any of your personal information. 

Storing your information

In all three cases above, we will make sure that any personal information we hold is secure, accessible only to those who need to access it, and held for only as long as is needed. We will not transfer personal information outside the European Economic Area.

Your rights about your information as a member, supporter or someone who donates to support POhWER’s activities

Under data protection laws, you have certain rights about how your information is used and these rights are outlined below. If you want more information or guidance about your rights, we will try to help you, or you can contact the Information Commissioner’s Office. The contact details are at the end of this Privacy Notice.

If we hold inaccurate or incomplete information about you, please tell us and we will correct or complete the data. If we have shared that information with anyone else, in the circumstances we have outlined above, we will, where possible, inform them of any corrections and tell you where this has happened. This is called your right to rectification.

You have a right to access the personal information we hold about you. You can request a copy of the information we hold about you and we will provide that to you as quickly as we can but certainly within one month of us receiving the request. This is called a Subject Access Request.

You have a right to erasure. Except where we are required to retain your information by law, for example Gift Aid donations, you have the right to have your personal information permanently deleted from our system whenever you request this to happen. Where we are required to retain the information by law, at the end of that period, when we no longer have any reason to keep or process it, we will delete it from our systems.

You have a right to restrict processing in some circumstances. This means that in those circumstances, we would still store your information but not process, or use it. These are the situations where you can ask us to restrict processing your information:

  • Where you believe that the information we hold is not accurate, we would restrict processing until we have verified the accuracy of the personal information;
  • If you object to us using the information you have provided us when you have made a donation, we would restrict processing until we have taken advice on how we should move forward;
  • If we have used your information unlawfully, and you don’t want us to erase the information, you can ask us to simply hold it instead;
  • If we no longer need the personal information and before we automatically delete the information from our system, you request us to hold it to make or defend a legal claim.

You have the right to object to POhWER using your information. If you do object, we would stop processing the information and then determine if there were circumstances that meant POhWER’s grounds for processing the information overrode your right to object.

A ‘personal data breach’ means that personal information is disclosed to, or accessed by, someone who is not authorised to see it. We make sure that our systems are secure in line with recognised standards but if a personal data breach did happen that involved your personal information, we would tell you as soon as we became aware of it and let you know what we were planning to do about it. We would also tell the Information Commissioner’s Office about it and make sure you know how to complain to the Information Commissioner’s Office about the personal data breach.


Visitors to our website

When someone visits www.pohwer.net we use a third party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site. This information is only processed in a way that does not identify anyone. We do not make, and do not allow Google to make, any attempt to find out the identities of those visiting our website. If we do want to collect personally identifiable information through our website we will be upfront and explain what we intend to do with it, for example asking if you want to subscribe to our newsletter, or giving us feedback about our services. The way we do this is by using ‘cookies’.

You can read more about what Cookies we use and what they do on our Cookies page.

Our search engine does not collect any user-specific data. The search queries and results are logged anonymously to help us improve our website and search functionality.

POhWER’s E-newsletter – we use a third party provider, Mail Chimp, to deliver our newsletter. We do not use personal information that you give us to enable us to send you the newsletter for any other purpose. We store the personal information in a secure electronic file, and will not share, rent or sell any personal information. You can unsubscribe to our newsletter at any time.

Why we collect and process your personal information as a subscriber to our newsletter

We only collect your personal information, such as your name and contact details, with your permission and in order to provide you with our newsletter.

Your rights about your information as a subscriber to our newsletter

You have the right to ask us to stop using or storing your personal information. If you unsubscribe from our newsletter, we will permanently delete the personal information we hold about you.

If any of the personal information we hold about you is incorrect, you have the right to ask us to correct it.

You have the right to know what personal information we hold about you. If you want to know, you can make a Subject Access Request to the Data Protection Officer whose contact details are at the end of this privacy notice.


People who provide feedback about our services including people who make complaints about POhWER

Why we collect and process your information

When you provide feedback to POhWER we ask you for your contact details so that we can contact you about the feedback you have given us. Feedback can be collected in a number of ways: face-to-face, over the phone, in writing or through our website. Our website uses a third party provider to facilitate collection of feedback and our agreement with that third party ensures they will not process any personal information they collect for us, other than to provide us with the completed feedback form.

Our legal basis in collecting, using and storing personal information from feedback is to review POhWER’s performance of our services and this is called a ‘legitimate interest’.

Using your information

When you provide feedback that is not a complaint or a concern, we use this information to share good practice and to report on our services, but only in a way that does not identify you.

Sometimes things don’t go as well as we would all like them to and we welcome complaints and concerns as a way of highlighting this. When we receive a complaint or a concern, we make up a folder on our secure system containing the details of the complaint or concern. This will include the identity of the person making the complaint or concern, where they have provided this, as well as any other individuals involved in the complaint.

Sharing your information

Non complaint/concern feedback - When you provide feedback that is not a complaint or concern, we remove any identifying personal information from your feedback and use it to help us report to the local authorities who commission our services so that they know what the people who use our services think about them and how POhWER is delivering them. We may also share anonymous feedback with regulators, government departments and publicly in our reports, social media and website.

Complaint/concern feedback - We will only use the personal information we collect to process the complaint and check on the level of service we provide. We compile and publish statistics showing information such as the number of complaints/concerns we receive for the local authorities who commission our services, but not in a way that identifies anyone.

We usually disclose the identity of the person raising the complaint or concern to whoever the complaint or concern is about. This is so that we can investigate properly. If someone complains anonymously we may not be able to fully investigate.

Storing your information

Feedback that is not a compliant or concern is kept for five years after the current financial year on our secure system and then deleted.

For complaints or concerns about POhWER’s services, we retain this information for 6 years after the last action. We store this information outside of our client record database on our secure system. Only those people who need to access this information, for example, to investigate the complaint or concern, have access to the complaint/concern folder.

Your rights about your information as someone who provides feedback about our services, including complaints, about POhWER

If we hold inaccurate or incomplete information about you, please tell us and we will correct or complete the data. If we have shared that information with anyone else, in the circumstances we have outlined above, we will, where possible, inform them of any corrections and tell you where this has happened. This is called your right to rectification.

You have a right to access the personal information we hold about you. You can request a copy of the information we hold about you and we will provide that to you as quickly as we can but certainly within one month of us receiving the request. This is called a Subject Access Request.

You have a right to erasure. Except where we are required to retain your information by law, you have the right to have your personal information permanently deleted from our system whenever you request this to happen. Where we are required to retain the information by law, at the end of that period, when we no longer have any reason to keep or process it, we will delete it from our systems.

You have a right to restrict processing in some circumstances. This means that in those circumstances, we would still store your information but not process, or use it. These are the situations where you can ask us to restrict processing your information:

  • Where you believe that the information we hold is not accurate, we would restrict processing until we have verified the accuracy of the personal information;
  • If you object to us using the information you have provided us when you have provided feedback, we would restrict processing until we have taken advice on how we should move forward;
  • If we have used your information unlawfully, and you don’t want us to erase the information, you can ask us to simply hold it instead;
  • If we no longer need the personal information and before we automatically delete the information from our system, you request us to hold it to make or defend a legal claim.

You have the right to object to POhWER using your information. If you do object, we would stop processing the information and then determine if there were circumstances that meant POhWER’s grounds for processing the information overrode your right to object.

A ‘personal data breach’ means that personal information is disclosed to, or accessed by, someone who is not authorised to see it. We make sure that our systems are secure in line with recognised standards but if a personal data breach did happen that involved your personal information, we would tell you as soon as we became aware of it and let you know what we were planning to do about it. We would also tell the Information Commissioner’s Office about it and make sure you know how to complain to the Information Commissioner’s Office about the personal data breach.


POhWER’s Data Protection Officer is Sandra Black.

You can contact her by:

Email – [email protected]

Post   – POhWER
            PO Box 14043
            Birmingham
            B6 9BL

If you would like more information or further explanation of POhWER’s collection and use of personal information, please contact us using the contact details above.

If you are unhappy with the way that POhWER has handled your information, you can make a complaint us, using the contact details above, or you can complain to the Information Commissioner’s Office:

Website: ico.org.uk

Telephone: 0303 123 1113