PRIVACY NOTICE

 

Introduction

Action Deaf Youth is committed to data security and the fair and transparent processing of personal data. This privacy notice sets out how we will treat the personal data which you provide us in compliance with applicable data protections law, in particular the General Data Protection Regulation (EU) 2016/679 (GDPR).

Who we are

Action Deaf Youth is the leading deaf youth organisation, supporting deaf children, young people and their families in Northern Ireland. Action Deaf Youth is a Northern Ireland registered charitty (NIC102041) and is also registered as a charity with the HMRC (XR41413) and a Limited Company by Guarantee (NI619842).

For the purposes of GDPR, Action Deaf Youth at varying times is both a controller and processer of the personal data you provide to us. If you have any queries about this Privacy Notice or the way in which Action Deaf Youth processes personal data, or about exercising any of your rights, please send an email to info@actiondeafyouth.org or write to Data Protection, Action Deaf Youth, 385a Holywood Road, Belfast, BT4 2LS.

Privacy Notice

Action Deaf Youth have taken considerable time to consider and catalogue all of our data processing activities. We have considered what personal data we hold, why we hold it and how we use/share it. It may seem like a lot of effort, but we felt it was important and beneficial not only to ensure we complied with legal requirements, but to ensure we could legitimately stand over the data we held.

The concern for transparency and an individual’s right to be informed means that we need to communicate our data collection activities to all our data subjects. This Privacy Notice attempts to establish Action Deaf Youth’s rationale for data collection in a straightforward manner.

This Privacy notice comes into effect on 25th May 2018.

Data protection law in the UK and EU changes on 25 May 2018. This notice sets out your rights as a member of Action Deaf Youth or as a visitor to our website, under the new law.

This privacy notice tells members of Action Deaf Youth what to expect Action Deaf Youth collects, uses, retains and discloses your personal information. Personal information is information that (on its own or together with other information) identifies you and is about you. This includes what you tell us about yourself and what we learn by having you as a member or customer.

To ensure that we process your personal information fairly and lawfully, this notice informs you

  • Why we need your personal information;
  • How it will be used;
  • With whom it will be shared; and
  • What rights you have in relation to the personal information we collect.

Within this notice we describe instances where Action Deaf Youth is the ‘data controller’ (the organisation who decides what personal information is collected and how it is used),

There will be situations where Action Deaf Youth is also the data processor. An example, is when we are contractually obliged to processes data under the instructions of another organisation or funder, this is known as acting as a (‘data processor’). In instances such at this our use of data will be governed by that organisation e.g. a Government Department.

Our commitment to your privacy

Action Deaf Youth recognises the importance of protecting personal and confidential information in all that we do; we take our legal duties seriously. Be assured that Action Deaf Youth has established all reasonable technical, security and procedural controls required to protect your personal information for the whole of its life, in whatever format we hold your information.

How the law protects you

Your privacy is protected by law, which states that we can use your personal information only if we have a proper reason to do so. This includes sharing it outside of Action Deaf Youth.

The reasons why Action Deaf Youth may process your personal information are:

  • To fulfill the membership mandate we have with you;
  • When it is our legal duty;
  • When it is in our legitimate interest; or
  • When you consent to it.

A legitimate interest is when we have a business or commercial reason to use your information, but this must not unfairly go against your rights or freedoms. If we rely on our legitimate interest, we will tell you what that is.

Below in table format we have listed the ways and rationale for maintaining your personal information. The table also outlines our legitimate interests for keeping personal information.

What We Use Your Personal Information For

  • Managing our relationship
  • Communicating membership information
  • To develop and carry out marketing* activities
  • To conduct analysis and research activities to improve and develop our services
  • To provide tailored assistance
  • To administer application forms relating to membership
  • To administer payments relating to product sales
  • To administer payments for services we can offer when members request assistance
  • To detect, investigate, report and seek to prevent financial crime
  • To manage risk for us and our members or stakeholders
  • To comply with regulations that apply to us
  • To respond to complaints and seek to resolve them
  • To run our business in an efficient and proper way. This includes managing our financial position, business capability, planning, communications, corporate governance and audit
  • To exercise our rights as set out in agreements or contract

Our Reason For Keeping This Information

  • Fulfilling contracts
  • Our legal duty
  • Our membership mandate
  • You have given consent
  • Our legitimate interests
  • Fulfilling contracts

Our Legitimate Interests (Where Applicable)

  • Keeping our records up to date
  • Working out which of our products and services may interest you and telling you about them
  • Seeking your consent when we need it to contact you
  • Being efficient about how we fulfill our legal and contractual duties
  • Complying with regulations that apply to us
  • Developing and improving how we deal with financial crime

What types of personal information do we handle?

We process personal information to enable us to run Action Deaf Youth to support the provision of services to members and stakeholders, to maintain our own accounts and to promote our services.

The types of personal information we hold:

  • Personal details such as names, addresses and telephone numbers of members;
  • Financial details, including payments to Action Deaf Youth suppliers and payments made by Action Deaf Youth for services provided to members;
  • Details of how you interact with us on social media;
  • Organisational and personal information in the fulfilment of contractual agreements through statutory and Government departments.
  • Details of when you contact us and when we contact you (including copies of written communications such as emails or letters);
  • Any consents which you have given us in relation to the processing of your information or use of photos;
  • Details of your use of services offered by Action Deaf Youth

Where we collect personal information from

We may collect your personal information from the following sources:

Personal information you give to us:

  • When you join Action Deaf Youth;
  • When you contact Action Deaf Youth (for example by phone, email or letter);
  • In member or stakeholder surveys or any other research activity we may conduct with you [not all survey or research information we collect will have personal information]
  • When you use our services;
  • When you update your membership information

Personal information from third parties that we work with:

  • Details obtained from social media e.g. twitter or Facebook;
  • Organisational & personal information in the fulfilment of contractual agreements through statutory and Government departments.

If you choose not to give personal information

We may be obliged to collect personal information by law, or under the terms of a contract we have with you.

If you choose not to give us this personal information, it may delay or prevent us from meeting our obligations. It may also mean that we cannot provide you with services under your membership or contractual agreement. We will notify you if your choice not to give personal information to us would result in a delay or prevent us from meeting our obligations.

Any personal information that is optional will be clearly marked at the point of collection.

Who we share your personal information with

No personal information will be shared other than information gathered in;

  • Fulfilling a contractual agreement or
  • Legal and regulatory compliance;
  • Preventing or detecting financial crime;
  • Complaints handling

These types of organisations are:

  • Charity Commission for Northern Ireland
  • Government Departments to fulfil contractual agreements
  • HM Revenue & Customs, our regulators and other authorities, including fraud prevention agencies (where required or permitted by law).

These types of organisations are:

  • Mailing or email (to enable us to communicate with you efficiently);
  • Play providers who deliver services on behalf of Action Deaf Youth
  • Providers of business services such as auditors, consultants, solicitors and/or insurers (to enable us to run Action Deaf Youth efficiently);
  • Providers of IT systems or services (to enable us to run Action Deaf Youth efficiently);

When we share your information with our approved third party providers, our contractual relationship with them prevents them from using your information for any other purpose outside of our instructions to them. They may use their own third party data processors, but are always required to meet the same legal requirements as Action Deaf Youth does.

Action Deaf Youth will never share or sell your information to any external company for their own marketing purposes.

Marketing

We may use your personal information to tell you about relevant information or services offered by Action Deaf Youth. This is what we mean when we talk about ‘marketing’. We can only use your personal information to send you marketing messages if we either have your consent or a ‘legitimate interest’. Legitimate interest is when we have a business reason to use your information for marketing purposes (which will not unfairly go against your rights and freedoms). In other words, we will not market to you based on legitimate interest if you have told us that you do not want to receive such marketing or are registered on a preference services list.

We have a legitimate interest to:

  • Contact you via telephone to welcome you to Action Deaf Youth, or to discuss your membership if you decide to leave Action Deaf Youth; and
  • Send you marketing messages by email about services offered by Action Deaf Youth (if you have provided us with an email address).

We will ask your explicit consent to send you any other marketing messages. You can withdraw your consent or ask us to stop sending you any marketing messages at any time. If you want to do so, please contact us by:

  • Calling Action Deaf Youth [028 90992779] to inform us that you do not wish to receive any messages or emails from Action Deaf Youth;
  • Writing to us at; Action Deaf Youth, 385a Holywood Road, Belfast, BT4 2LS;
  • Emailing: info@actiondeafyouth.org

How long we keep your personal information

If you are a Member of Action Deaf Youth, we are required by Law to keep your information so that we can respond to questions or complaints and maintain records according to legal requirements and documented business need.

  • We will make sure that your privacy is protected and only use it for legal or regulatory purposes.
  • If you are an Action Deaf Youth supplier/stakeholder we will only hold and maintain records according to legal requirements and documented business need; currently 7 business years.

Your Rights

Under the GDPR, you have various rights with respect to our use of your personal data:

Right to Access

You have the right to request a copy of the personal data that we hold about you by contacting us at the email or postal address given below. Please include with your request information that will enable us to verify your identity. We will respond within 30 days of request. Please note that there are exceptions to this right. We may be unable to make all information available to you if, for example, making the information available to you would reveal personal data about another person, if we are legally prevented from disclosing such information. Or if your request is manifestly unfounded or excessive.

Right to rectification

We aim to keep your personal data accurate and complete. We encourage you to contact us using the contact details provided below to let us know if any of your personal data is not accurate or changes, so that we can keep your personal data up-to-date.

Right to erasure

You have the right to request the deletion of your personal data where, for example, the personal data are no longer necessary for the purposes for which they were collected, where you withdraw your consent to processing, where there is no overriding legitimate interest for us to continue to process your personal data, or your personal data has been unlawfully processed. If you would like to request that your personal data is erased, please contact us using the contact details provided below.

Right to object

In certain circumstances, you have the right to object to the processing of your personal data where, for example, your personal data is being processed on the basis of legitimate interests and there is no overriding legitimate interest for us to continue to process your personal data, or if your data is being processed for direct marketing purposes. If you would like to object to the pressing of your personal data, please contact us using the contact details provided below.

Right to restrict processing

In certain circumstances, you have the right to request that we restrict the further processing of your personal data. This right arises where, for example, you have contested the accuracy of the personal data we hold about you and we are verifying the information, you have objected to processing based on legitimate interests and we are considering whether there are any overriding legitimate interests, or the processing is unlawful and you elect that processing is restricted rather than deleted. Please contact us using the contact details provided below.

Right to data portability

In certain circumstances, you have the right to request that some of your personal data is provided to you, or to another data controller, in a commonly used, machine-readable format. This right arises where you have provided your personal data to us, the processing is based on consent or the performance of a contract, and processing is carried out by automated means. If you would like to request that your personal data is ported to you, please contact us using the contact details provided below.

Please note that the GDPR sets out exceptions to these rights. If we are unable to comply with your request due to an exception we will explain this to you in our response.

Contact

If you have any queries about this Policy, the way in which Action Deaf Youth processes personal data, or about exercising any of your rights, please send an email to or write to Data Protection, Action Deaf Youth, 385a Holywood Road, Belfast, BT4 2LS.

Complaints

If you believe that your data protection rights may have been breached, and we have been unable to resolve your concern, you may lodge a complaint the applicable supervisory authority or to seek a remedy through the courts. Please visit https://ico.org.uk/concerns/ for more information on how to report a concern to the UK Information Commissioner’s Office.

Changes to our Policy

Any changes we may make to our Policy in the future will be posted on our website and, where appropriate, notified to you by e-mail. Please check back frequently to see any updates or changes to our Policy.

– Privacy Notice Version 1, 22nd May 2018