Amaze's privacy statement 2022
Who are we?
Amaze is a charity (registered charity number 1078094) established in 1997, that offers a range of information, advice and support services to families of children and young people with special educational needs or disabilities, across Sussex. Amaze also manages the Compass Brighton and Hove scheme (Disability Register) which provides discounts on a wide range of leisure offers.
Amaze takes your privacy seriously and this Privacy Statement sets out how we will use and store your data, in full accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Regulators Code of Fundraising Practice (2016). Amaze is registered with the ICO.
What information will you collect about me?
We currently collect and process the following information:
- Personal identifiers, contacts and characteristics (for example, name and contact details)
- Diversity information such as gender, ethnicity, religion, disabilities, sexual orientation and age or age range
- Details about your, or your child’s, health issues
- Details about your, or your child’s, school and GP
- If we are helping you or your child to apply for benefits, we may need to ask for information such as hospital number, national insurance number and bank details to receive payments.
Most of the personal information we process is provided to us directly by you/your parent carer in order for us to provide a service. The lawful basis we rely on for processing this information is Your Consent. We will always ask for your consent to store and process your personal information and you may give this consent verbally or in writing. You are able to remove your consent at any time. You can do this by emailing us on firstname.lastname@example.org.
We may also receive personal information indirectly, from the following sources, in the following scenarios:
- If you are a child or young person, we may receive this information directly from the person(s) who has Parental Responsibility for you. If you are over 16 years, we will ask your parent/carer to check with you that you consent to us processing your data. Where a person over 16 does not have capacity to make this decision we will follow the principles set out in the Mental Capacity Act 2005 and take consent from the appropriate decision maker. For this decision, this is likely to be the primary carer.
- From an external agency referring you to access one of our services. They must obtain consent from you first, before they pass us your data. We will request personal contact details, and details about why the referral is being made.
- From other agencies working with you/your child. If we are supporting you to apply for benefits or to make an appeal against a benefits decision, we may need more information. With your consent, we may gather supporting information on your behalf such as clinic letters, assessments, reports and therapy programmes.
What are we going to do with your information?
We will use your personal information to provide services or information to you. We will also collate your personal details with that of others to create anonymised data for general reporting about our work and the impact it has to our funders, or to identify and provide trends about the needs of families with children and young people with SEND to service providers/partners.
What will you ask me to consent to?
When you contact Amaze we will ask you for basic personal information in order to support you and to collect information that we report in an anonymised format to our funders. If we need to share information such as with a benefits application, we will ask for this additional/explicit consent from you.
Will you be sending me mailouts?
Going forwards you will be given the option to ‘opt in’ to receive other useful information e.g. our newsletters, surveys, subscribing to be a member of PaCC, involvement in fundraising opportunities or events etc. You will be able to update your ‘opt in’ agreement at any time with us.
Will we share your information with anyone else?
No. Unless we have your permission to do so, we won’t share your personal information with any organisations or individuals outside of Amaze. The only exception would be where a failure to share your personal information would lead to a risk of significant harm to you or others.
There will be some occasions we will need your consent to pass on personal information in order to submit or process applications on your behalf e.g. for DBS checks, registering trustees with Charity Commission, supporting applications for disability benefits etc. These are ‘legitimate interests’ where an individual would reasonably expect us to use their information.
We will never sell, rent, or trade your personal data.
Where is your data stored?
All details about our clients (children and young people with special educational needs and disabilities, and their families) provided to Amaze staff or volunteers are input carefully and stored securely on a database called Charitylog. In addition, data may be stored in Excel spreadsheets contained within the Amaze server. Email addresses may also be stored on ‘Send In Blue’ which we use to send bulk email messages.
The Compass online registration form is also stored securely with the host of the Compass Online Registration form website, Memset (see https://www.memset.com/about/security-compliance/accreditations).
We scan and save other supporting documentation (reports, letters etc) into the secure Amaze electronic filing system. We are trying to move to a paperless office, but where hard copies are provided to us, including any personal data, these are stored in locked filing cabinets before being returned/shredded.
Sometimes you may be asked to access a third-party site for example to complete a survey, enrol on a workshop or submit a form. Where possible we minimise the amount of personal data we ask for and we check the website’s security meets UK GDPR before asking you to use it.
How long do we hold your data for?
We follow national best practice and retention periods vary according to the nature of the record.
|Casework records:||Records held by Amaze about you and your related child or young person will be made inactive and anonymised by removing all personal data after 7 years of our last contact with you. We keep records for this period to facilitate ongoing support for you or your child as they go through key developmental stages.|
|Non-casework records and exceptions||For those not receiving casework support, for example, with a Compass Card. Records will be anonymised 3 years after the Compass Card has expired or the last contact with us. In addition, if we supported a young person (either directly or via a parent carer) who is now over 25 years with no ongoing support, their records will be anonymised after a 3-year period.|
What are your rights about the information we hold about you?
You can ask to see the personal information that Amaze holds about you, this is called a subject access request, and you can choose to receive that personal information in paper or electronic form. You have the right to ask us to correct any inaccuracies in the personal information that we hold about you and you can also choose to reuse your personal information for your own use, e.g. give it to another organisation. You can also ask us to delete any of the data we hold about you or restrict how we use it. We follow strict GDPR guidelines and our internal policies whenever handling your data. You also have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.
You can find more information about GDPR on this link https://ico.org.uk/your-data-matters/. You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you, contact us at email@example.com.
What about our websites?
Amaze operates the following websites: www.amazesussex.org.uk; www.compasscard.org.uk; www.registercompasscard.org.uk; www.paccbrighton.org.uk; www.espcf.org.uk and at the bottom of each website there is a link to the privacy statement for that website. These will tell you what information Amaze gathers from visitors to our websites, and what we do with it. Please also see our Cookies Policy.
How can you get in touch with us?
If you would like to know more how we look after your personal information, or would like to request a copy of the personal information that we hold about you, you can contact our Data Protection Officer in the following ways:
phone: 01273 772289
post: Amaze, Community Base, 113 Queens Road, Brighton, BN1 3XG
How to complain
If you have any concerns about our use of your personal information, you can make a complaint to us at firstname.lastname@example.org or using the contact details above.
You can also complain to the ICO if you are unhappy with how we have used your data.
The ICO’s address:
Information Commissioner’s Office; Wycliffe House; Water Lane; Wilmslow; Cheshire; SK9 5AF
Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk