Data Protection

Easy Read Version here (with thanks to Easy-Read-Online Limited)

1. Our Privacy Policy.

Equal Say Ltd. (this includes North Lanarkshire Advocacy) takes privacy seriously and we are committed to protecting it. This policy explains when and why we collect personal information about you, how this information is used, the conditions under which it may be disclosed to others and how it is kept secure.

2. Who are Equal Say Ltd?

Equal Say is an independent advocacy organisation. We exist to support people who are marginalised or excluded to have a fair say in all aspects of their lives. Our advocacy partners are people who may have a label of disability, long term condition or mental ill health. As an organisation that exists to champion the rights of vulnerable citizens we take care to ensure that they have as much choice and control as possible in their lives. Where we can, we will do everything possible to ensure that our own policies respect these values and that advocacy partners are at the centre of everything we do including having control over their personal information held by Equal Say.
Equal Say Ltd. is the data controller in relation to the processing activities described below. This means that we decide why and how your personal information is processed. Our registered address is 104 Stewarton Street, Wishaw, ML2 8AG. Equal Say Ltd is a Scottish Charity No SC 023806 and we are a Company Limited by Guarantee, No SC246026. North Lanarkshire Advocacy is a trading name of Equal Say Ltd.

3. How we collect your information.

When you use our website, our services, interact with us in person, interact with us online, or by phone, email or otherwise, the categories of information that we may collect about you are as follows:

  • Personal information
  • Name, address, DOB, email, telephone number (for both referrers and people referred)
  • Special category data (very sensitive personal information for people referred to us)
  • Ethnicity
  • Client group (e.g. mental ill health, learning disability, physical disability etc.)
  • Advocacy issues (for instance issues with Health or Social Work services including Child or Adult protection).
  • Reports you share with us (Social Work and Health reports etc.)
  • Letters we receive about you
  • Documents you share with us
  • Notes about or meetings with you or other people (case notes)

4. How we use your personal information.

The purposes for which we use your information and the legal basis under data protection laws on which we rely to do this are explained below.

  • Where there is a LEGITIMATE INTEREST
  • We may use and process your personal information where it is necessary for us to pursue our legitimate interests as an independent advocacy organisation, or those of a third party, for the following purposes:
  • To inform the work of Equal Say Ltd. and to provide you with free independent advocacy services.
  • To ensure good governance of Equal Say Ltd, for instance in maintaining our membership records.
  • To correspond with you or contact you, for instance about your advocacy issues or to invite you to an Equal Say group, meeting or social event.
  • To conduct research or for the management of queries, concerns or complaints.
  • Where it is required to complete or perform a CONTRACT with you
  • We may use and process your personal information where we have supplied you (or continue to supply you) with any products or services or where you are supplying us with products and services. We will use this information in connection with the contract for the supply of products or services when it is needed to carry out that contract with you or for you to enter into it.
  • Where you have provided CONSENT

We will process your personal information including very sensitive personal data (special category data) in exactly the same way as above. You may withdraw your consent for us to use your information in any of these ways at any time. To do this please contact the office or your advocacy worker.

If you withdraw your consent for us to hold your information this will affect the quality of the service we offer and we may not be able to offer you a service at all.

5. Contract monitoring and aggregated reports.

Equal Say is funded in a number of ways including grants from the Big Lottery, Scottish Government and some Councils or Health Boards. In addition to this the Board of Directors of Equal Say Ltd. receives regular reports on our advocacy activity and the outcomes of our work.

Your information may be converted into statistical or aggregated data in such a way as to ensure that you are not identified or identifiable from it. Aggregated data cannot be linked back to you as a natural person. We may use this data for analytical and research purposes.

6. Who has access to your personal data and where is it stored?

All advocacy staff and managers (employees of Equal Say Ltd.) have full access to our case management systems. All employees sign our Data Protection and Confidentiality polices and are bound to hold the highest of standards of data protection and confidentiality.

Our electronic data is stored on our own servers based in Scotland and hosted by our data processor, Bluedoor Software, whose servers are located in London. When we use third party service providers (such as Bluedoor Software), we only disclose to them any personal information that is necessary for them to provide their service. We have a contract in place that requires them to keep your information secure and not to use it other than in accordance with our specific instructions.

7. How long will we keep your personal information?

We will keep your information securely and in line with our data protection policy. For people who use our services, this is three years after the end of an intervention. After this period ALL data is permanently erased.

Other data, such as staff records will be held as long as necessary.

8. Third party marketing.

We will never sell or trade your data with any other body for the purposes of sales or marketing.

9. Your rights

You have a number of rights in relation to your personal information under data protection law. In relation to certain rights, we may ask you for information to confirm your identity and, where applicable, to help us to search for your personal information.

Except in rare cases where additional time may be required, we will respond to you within one month from either (i) the date that we have confirmed your identity, or (ii) where we do not need to do this because we already have this information, from the date we received your request.

Accessing your personal information

Under data protection laws you have a legal right to ask to see a copy of the personal information that we hold about you. Such requests are called subject access requests.

If you would like to make a subject access request, please contact Sam Cairns, Data Protection Officer.

You will also need to provide one form of identification and proof of your address, for example, staff pass, driving licence, utility bill, and if appropriate, any particulars about the source or location of the information you are requesting.

Further information about subject access requests can be found on the Information Commissioner’s website

We may not provide you with a copy of your personal information if this concerns other individuals or if we have another lawful reason to withhold that information.

Correcting and updating your personal information

The accuracy of your information is important to us. If you change your name or address/email address, or you discover that any of the other information we hold is inaccurate or out of date, please let us know.

Withdrawing your consent

Where we rely on your consent as the legal basis for processing your personal information, as set out under section 4 on how we use your personal information, you may withdraw your consent at any time by contacting us using the details in section 2 of this policy.

Erasing your personal information or restricting its processing

In certain circumstances, you may ask for your personal information to be removed from our systems by emailing or writing to us at the address in section 2. Unless there is a reason that the law allows us to use your personal information for longer, we will make reasonable efforts to comply with your request.

You can ask us to send your personal information directly to another service provider; we will do so if this is technically possible. We may not provide you with a copy of your personal information if this concerns other individuals or we have another lawful reason to withhold that information.
Complaining to the UK data protection regulator

We’d like to be able to resolve all your concerns, and we hope that we can do so. Where we haven’t been able to do this, you have the right to complain to the Information Commissioner’s Office (ICO) if you are concerned about the way we have processed your personal information. Please visit the ICO’s website for further details.

10. Changes to this policy

We may review this policy from time to time and any changes will be notified to you by posting an updated version on our website. We recommend you regularly check for changes and review this policy whenever you visit our website. If you do not agree with any aspect of the updated policy you must immediately notify us and cease using our services.