- Honesty – We will be open and accessible about the information that we are collecting and who it might be shared with.
- Courage – We understand that entrusting your personal information to people can be daunting and requires courage.
- Compassion – We know that sharing personal information about yourself can make you feel vulnerable.
- Respect – We respect that your personal information is unique and precious to you. We will keep it safe and not share it with anyone who does not need it.
- Integrity – We will store your data in line with our values and in line with the relevant and current Data Protection legislation.
If you have any comments or questions about this policy, please contact us:
Data Protection Officer
Dorset Mental Health Forum
29-29A Durngate Street
Dorset DT1 1JP
Telephone: 01305 257172
Email: [email protected]
Charity Number: 1169215
We aim to process people’s data in line with the following six privacy principles:
- Personal data must be processed lawfully, fairly and in a transparent manner.
- Personal data must only be collected for “specified, explicit and legitimate purposes”.
- Data collected must be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
- Personal data must be accurate and where necessary kept up to date.
- Personal data that is no longer required should be deleted.
- Processors should ensure all personal data they hold is secure.
1. How do we collect personal data from you?
Personal data is information that relates to an identified or identifiable individual.
What identifies an individual could be as simple as a name or a number or could include other identifiers such as an IP address or a cookie identifier, or other factors.
We may collect, process and store personal information from you when you:
- Enquire about our activities or ask another question about the Forum.
- Make contact with one of our activities, projects or services for yourself or another person.
- Interact with us directly, through one of our projects, over the phone, via post, over email, through the website, or in person.
- Access one of our activities, projects or services.
- Support our work or donate to us.
- Apply for a job or to get involved with our work and when you become a member, employee, volunteer or trustee.
- Share your story or your experiences with us through the website, in conversation, through projects and focus groups.
- Submit information directly to us via online forms or sign up to be contacted or to receive information from us.
- Instruct other people to make contact with us on your behalf and to share your personal information with us, such as a relative, friend or health professional.
- Access one of our partnership projects with Dorset HealthCare University NHS Foundation Trust such as the Recovery Education Centre, The Retreat, Dorset Work Matters or the Discovery Project. You can read Dorset HealthCare’s Privacy Notice here: Dorset HealthCare :: Privacy Notice
- When you visit our website (this information does not identify people).
We will only collect and process personal data from you for a specific and stated purpose. Your data will be stored securely and only utilised for this stated purpose.
Please see the information about Cookies on our website. You can accept all the cookies that we use by clicking on the ‘Accept Cookies’ button displayed on our cookie banner. If you would rather decide what cookies are set, you can choose your preferences by clicking on ‘Cookie Settings’. You can opt out of all our cookies (except the strictly necessary ones). It is possible to switch off cookies on your computer by setting your browser preferences. Please note, if you choose to turn cookies off or refuse all cookies, our website may not function for you as we would like.
- Facilitate people’s ability to navigate through the website.
- Ascertain whether the website is operating effectively.
- Compile statistics on how our website is being used, which can help us to improve our website and online services.
- Personalise and improve the service we offer you by understanding your preferences and establishing which areas of the website are most relevant to you.
Google Analytics generates statistical and other information about website usage by means of cookies, which are stored on people’s computers. The information collected by Google Analytics about usage of our website is not personally identifiable. The data is collected anonymously, stored by Google and used by us to create reports about website usage. We do this to learn things such as the number of visitors to the various parts of the site. We do not make, and do not allow Google to make, any attempt to find out the identity of anyone visiting our website.
2. What types of data do we collect and process?
We collect personal data from you for the activities described in section 1. above. The personal information that we collect and process depends on the nature of these activities and your relationship with us. Information might include your name, address, email address, IP address, telephone numbers, information regarding projects that you have accessed, payment information, websites pages you have visited, your story or your experiences, information about how we are working together and sensitive data.
Sometimes, if you have shared this information with us for a specific purpose, we may collect and store information that is defined by legislation as Special Category Data:
- Personal data revealing racial or ethnic origin.
- Personal data revealing political opinions.
- Personal data revealing religious or philosophical beliefs.
- Personal data revealing trade union membership (if you are an employee).
- Data concerning health.
- Data concerning sex life and sexual orientation.
- Data concerning criminal convictions and offences.
We also may store information about the following protected characteristics as defined by the Equality Act.
- Gender reassignment
- Marriage and civil partnership
- Pregnancy and maternity
We collect this sensitive data for the following reasons:
- To ensure that we are reaching a cross-section of people across Dorset, as we undertake our activities and fulfil our charitable purposes.
- To support you during the course of our activities, for example:
- Your date of birth if you have asked us to contact services on your behalf.
- Your religion to ensure your personal needs are met in hospital.
- Your first language, so we can ensure your voice is heard and understood.
The law is specific about how personal data can be processed. We are required to have a lawful basis for processing people’s personal data:
The person has given clear and active consent for us to process their personal data for a specific purpose. Consent can be removed at any time by contacting [email protected]
The processing is necessary for a contract we have with the individual, or because they have asked us to take specific steps before entering into a contract.
The processing is necessary for us to comply with the law (not including contractual obligations).
The processing is necessary to protect someone’s life.
Public Interest (Task)
The processing is necessary for us to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law.
The processing is necessary for us to respond to the person as they have requested, for our legitimate business interests, or for the legitimate interests of a third party, unless there is a good reason to protect the person’s personal data which overrides those legitimate interests.
In many situations, we will only use your personal information where we have your consent. Sometimes we need to collect personal data by law, or because we need to use it in order to fulfil a contract with you (for example you are employed by us).
However, there are other lawful reasons that allow us to process your personal information. One of these is legitimate interests, which means we have a legitimate reason for processing your information, such as to report to funders. Wherever possible we use anonymous information which does not identify people individually. If we process your personal information under the legitimate interests lawful basis, we will make sure that we take into account and balance your rights and interests. We will not process your personal information if we feel that there is an imbalance in relation to your rights.
3. How we use people’s personal data
We will only use your personal data for specific and stated purposes and in line with the legal basis for collecting your data, as described in sections 1. and 2. above.
4. Sharing people’s personal data
The personal information that we collect about you will be used by our staff, for the specific purposes identified. We will only pass your data to third parties in the following circumstances:
- You have provided your explicit consent for us to pass your personal data to a named third party;
- We are using a third party purely for the purposes of processing data on our behalf and we have in place a data processing agreement with that third party that fulfils our legal obligations in relation to the use of third-party data processors; or
- We are required by law to share your data.
In addition, we will only pass data to third parties outside of the EU where appropriate safeguards are in place as defined by Article 46 of the General Data Protection Regulation (GPDR).
We will never sell or share your personal information with other organisations for contact or marketing purposes, including web browsing activity.
5. How we keep people’s personal data
Often we need to keep your information so that we can carry out the activity that you have requested, such as being a member, an employee, accessing one of our projects, sharing your story or your experience (this information is always anonymised), sending you information and so on. All personal data is stored securely.
We only keep personal data for as long as is reasonable and necessary for the relevant activity and to fulfil our statutory obligations (for example, the collection of Gift Aid).
We take the principles of data minimisation and removal seriously. We have internal policies and procedures in place to ensure that we collect the minimum amount of data for specific purposes and that we delete and destroy data promptly and securely once it is no longer required.
We seek renewal of consent regularly for data that is collected on the basis of consent.
6. Your rights over your personal data
You have a range of rights in relation to your personal data, which are set out below:
- Access – You have the right to ask us for copies of any information that we have about you. We will need to remove any third party information (about other people) which may be in your file. We will send your information within 30 days and there is no charge for this. Read more
- Rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. We will consider the reasons why you think information is wrong. We will either change the information we hold or make a note that you think information is wrong on your file, as well as what you think should be written down instead. You have the right to ask us not to use your information until this is done. Read more
- Erasure – You have the right to ask us to erase your personal information in certain circumstances. There are some circumstances where we may not be able to do this but we will always tell you why. If we cannot delete your information, you can ask us not to process or use your information. We will explain to you how this might affect any support that you get from us. Read more
- Restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances. If you are concerned about the accuracy of the information we have on you or how it is being used, you can ask us to limit how we use your personal information. If necessary, you can also stop your data being deleted. Read more
- Object to processing – You have the right to object to the processing of your personal information in certain circumstances. This means that you can stop or prevent the organisation from using your data. However, this only applies in certain circumstances and the processing may not need to stop if the organisation can give strong and legitimate reasons to continue using your data. Read more
- Data portability – You have the right to ask that we transfer the personal information that you have given us to another organisation, or to you, in certain circumstances.
A full summary of your legal rights over your data and further information can be found on the Information Commissioner’s website here: https://ico.org.uk
Please contact us at [email protected] or with the contact information provided at the beginning of this policy if you wish to make a request.