Privacy Policy

Last Updated On 16-Jun-2023

Effective Date 20-Jun-2023

General Information.
Who are we?
Personal data collected, how and why we collect it, and on what lawful basis.
Fundraising and Marketing Communications.
If you contact us with enquiries.
If you are captured on our CCTV Systems.
Your Rights.
Keeping your information safe.
Transferring your information outside of the United Kingdom.
Making a complaint.
Changes to our Privacy Notice.
Appendix One – Service Users.
Appendix Two – Donors, Website Visitors, and Cookies.
Appendix Three – People and Culture.

General Information
- This Privacy Notice explains when and why we collect personal information about you, how we use it and the conditions under which we may disclose it to others. Your personal data is defined as any information that can directly or indirectly identify you. This notice also explains how we keep your data safe and secure and includes information you need to know about your rights and how to exercise them.
- We have appointed a data privacy manager to oversee compliance with this privacy notice. If you have any questions regarding our Privacy Notice and our use of your personal data or would like to exercise any of your rights, please contact the data privacy manager at: [email protected]
- You can also contact our Data Protection Officer at: Hope & May – [email protected] - Helpline 0330 111 0013
- If you are unhappy with the way we process your data, you can also make a complaint to the Information Commissioner’s Office (ICO) which regulates the use of information in the UK. They can be contacted by:
  - Telephone 0303 123 1113
  - Write to the ICO: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
  - Or by going online to www.ico.org.uk/concerns

Who are we?
- Causeway is a registered charity that supports marginalised and vulnerable people, including survivors of Modern Slavery and those with experience of the criminal justice system.
- In this Notice, ‘Causeway’'we', 'us', 'our' means:
  - Causeway (charity registration number (no. 1110314) with a registered address at 3^rd Floor, 32 Eyre Street, Sheffield, S1 4QZ

Personal data collected, how and why we collect it, and on what lawful basis.
- Appendix 1 – Service Users
- Appendix 2 – Donors, website visitors and cookies
- Appendix 3 – Human Resources

Fundraising and Marketing Communications.
- Your contact details may be used to provide you with information about our services or our fundraising opportunities via:
  - Post
    - We may use your Consent or our Legitimate Interest to send you fundraising or marketing communications by post. If you prefer not to hear from us this way, please get in touch by using any of the contact details listed at the top of this notice.
  - Phone
    - If you have provided us with your telephone number or email address, we may contact you by phone with fundraising and marketing communication under our legitimate interest (unless you are enrolled to TPS or you told us not to do so).
  - Email, text or other electronic message
    - We will only send you fundraising and marketing communications by email, text or other electronic message if you have explicitly provided your consent or if you have been involved in a commercial transaction with us. You may opt-out of our fundraising and marketing communications at any time by clicking the unsubscribe link at the end of our marketing emails. Alternatively, you can get by using any of the contact details listed at the top of this notice.
    - When you give us consent to receive marketing and fundraising communications, we will retain your personal information (name, address, email address) unless and until you inform us that you no longer wish to receive direct marketing information from us. You can ask us to stop sending direct marketing to you at any time by contacting us at [email protected] or by clicking on the unsubscribe button at the bottom of any marketing communication you receive from us.
    - Our approach is designed to uphold your privacy and information rights, to respect your choices, and to ensure we are not intrusive. You can opt-out of receiving related information at the time you subscribe to our newsletters and updates and each subsequent time we contact you.

If you contact us with enquiries
- When you contact us with for an enquiry, we will use your personal information (name, contact details, details of the enquiry) provided by you to deal with your enquiry and to make a record of your enquiry for internal administrative purposes.
- Our use of your personal information to deal with your enquiry and for record keeping is based our legitimate interests in ensuring our organisation is run efficiently and effectively.

If you are captured on our CCTV Systems.
- In our premises, we have installed CCTV systems that may capture your image, the dates and times you accessed our premises. We will use the personal information referred to above for security purposes. Our legal basis for doing so is our legitimate interest in ensuring that our premises are secure. For more information, please contact [email protected]

Your Rights
- Under data protection laws in the UK and EU, you have certain rights over the personal information that we hold about you. If you would like to exercise your rights, please get in contact with any of the details listed above. In most circumstances, we will need to comply with your request within 1 month of your request.
- We may need to request specific information from you to help us confirm your identity and ensure your right to exercise any of your rights. This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.
- You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
- Here is a summary of the rights we think apply:
  - Right to be Informed
    - You have the right to be informed as to how we use your data and under what lawful basis we carry out any processing. This Privacy Notice sets this information out however if you would like further information, please get in touch.
  - Right of Erasure – also known as the right to be forgotten
    - This is a right to have your personal information deleted or removed. This right only applies in certain circumstances (such as where we no longer need the personal information for the purposes for which it was collected). We have the right to refuse to delete or remove your personal data in certain circumstances.
  - Right to Object
    - This is a right to object to the use of your personal information. The right applies in certain specific circumstances only. You can use this right to challenge our use of your personal information based on our legitimate interests; you can also use this right to object to use of your personal information for direct marketing
  - Inaccurate personal information corrected
    - Inaccurate or incomplete information we hold about you can be corrected. The accuracy of your information is important to us and we are working on ways to make this easier for you to review and correct the information that we hold about you. If any of your information is out of date or if you are unsure of this, please get in touch through any of the contact details listed in this notice.
  - Right of restriction
    - This is a right to ‘block’ or suppress processing of your personal information.
    - This right applies in various circumstances, including where you contest the accuracy of your information.
  - Right to access your information
    - You have a right to request access to a copy of your personal information that we hold about you, along with the information on what personal information we use, why we use it, who we share it with, how long we keep it for and whenever it has been used for automated decision making. You can make a request for access free of charge and proof of identity is required.
  - Automated decision making
    - Automated decision making takes place when an electronic system uses personal information to make a decision without human intervention.
    - We do not undertake any processing activities which involve making decisions about you using automated means.
  - Portability
    - This is a right to obtain and re-use your personal information for your own purposes; It includes a right to ask that your personal information is transferred to another organisation (where technically feasible).
    - This right only applies in certain limited circumstances.
  - Right to withdraw consent
    - Where you have provided consent to our use of your data, you also have the right to withdraw that consent at any time. This means that we will stop processing your data. Any withdrawal of consent will not affect the lawfulness of any processing of your personal data based on consent before the withdrawal is notified.

Keeping your information safe.
- We take looking after your information very seriously. We have implemented appropriate physical, technical and organisational measures to ensure that your personal information is secure when under our control, both on and offline, from improper access, use, alteration, destruction and loss.
- When we are provided with personal information about you, steps are taken to ensure that it is treated securely. All information we collect about you is stored securely in the offices in locked cabinets, the keys for which are also stored securely in a locked cabinet. Electronic data is stored on a secure server and is accessed via password-protected computers that are used only by authorised individuals. We regularly review data security measures implemented by service providers who may handle your personal data. CCTV recordings will only be accessed by employees and DBS checked volunteers on a ‘need to know’ basis.
- Any personal information that is shared with third parties mentioned in this privacy notices will be communicated via secure email systems. We have put appropriate systems in place to enable third parties to communicate information securely, and third parties are provided with information regarding how to do so. We cannot, therefore, be held accountable for the security of any personal information sent from a third party which is not sent via secure arrangements. Whilst we make every effort to protect your personal information we cannot guarantee the security of any information you transmit to the third parties, and you do so at your own risk. When we receive information about you, best efforts are made to ensure its security on their systems.

Transferring your information outside of the United Kingdom.
- We must not transfer your personal information outside the European Economic Area (“EEA”) unless certain safeguards are in place. One such safeguard is that the personal data is only transferred to a country that has been approved by the European Commission as having an acceptable level of data protection law.

Making a complaint.
- If you think your data rights have been breached or you are not happy with how we handle your data, you are able to raise a complaint with us by contacting [email protected] or [email protected]. Our complaint policy is available via the link at the bottom of our website. Alternatively, you can contact the ICO at Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF or by telephone on 0303 123 1113 (local rate) or 01625 545 745. However, we hope that you would consider raising any issue or complaint you have with us first. We will always do our very best to solve any problems you may have.

Changes to our Privacy Notice
- This privacy notice is kept under regular review. If we make any significant changes to the way in which we process your information, we’ll make the required changes to this Privacy Notice and will notify you so that you can raise any concerns or objections with us.
- When making less impactful changes, we’ll update this notice and post a summary of the changes on our website.

Appendix One – Service Users
- Causeway delivers a variety of services to our service users. This privacy notice is to give you general information on how we manage your personal data. However, we have specific privacy notices depending on the service. We will provide you with more specific information during your induction into the service you intend to engage with.
- When do we collect information about you and who provides it?
  - The personal information that we obtain about you is collected during the referral process and the delivery. It includes information from the organisation referring you (e.g. referring agencies, NHS, Probation, Home Office, Police, Social Services) as well as information that you provide yourself. Written information is submitted to the Causeway via secure email and secure online forms. Information is safely stored in our database system.
  - CCTV images will be captured by automated CCTV recording cameras.
- What type of information is collected about you and who provides it?
  - Depending on the type of service you engage in, we may collect the following info:
    - Your address
    - Your email address
    - Your telephone number
    - Your date of birth
    - Your photograph
    - Your gender
    - Your religion
    - Your racial origin
    - Information concerning your health
    - Information concerning your personal history which may include other sensitive information such as sexual orientation
    - Details of any criminal convictions
    - Images of you on CCTV and dates and times you access Causeway premises
    - Support needs and associated information such as immigration status, employment
    - Details of any complaints you have made in relation to Causeway services
  - How is your information used?
    - We may use your personal information to
      - Communicate with you, and for administration purposes;
      - Facilitate your access to our services;
      - Better understand your needs to provide you with the advice and support you require;
      - Provide progress reports to funders;
      - Monitor and manage risk;
      - Protect yourself and the general public;
      - Safeguarding;
      - Conduct research and evaluation;
      - Collate anonymised or pseudonymised statistical information for funders, the charity and delivery partners
      - Understand trends in the issues our clients face to inform our practices, policies and procedures.
      - To comply with the law when required, for example to comply with a request from a competent authority.
    - Lawful basis for processing
      - In most circumstances, we rely on our legitimate interest when processing your personal data – we have a legitimate interest in ensuring that our services are run properly and in ensuring that you are given the appropriate advice and support.
      - When we process special category of data and criminal records, our legitimate interest is further supported by additional provisions, as required by the data protection legislation. These additional provisions may refer to the following articles of the UK GDPR:
        
        Art 9(2) d - Processing is carried out in the course of our legitimate activities as a not-for-profit charity. On the condition that the processing relates solely to clients, former clients or persons who have regular contact us.
        
        Art 9 (2) g – processing is necessary for reasons of substantial public interest, such as, preventing or detecting unlawful acts or safeguarding children or individuals at risk
      - We may also process your data if it’s necessary to protect vital interests of yourself and others.
      - In other circumstances where it is necessary to share your special category personal data with other organisations outside Causeway we may use our legitimate interest or obtain your consent, save for where sharing your information is necessary to enable us to establish, exercise or defend a legal claim. For information about how to withdraw your consent see Section Data Subjects’ rights.
      - In relation to CCTV images, we rely on legitimate interest in ensuring that you, other residents and our staff are safe.
    - How long do we keep your data for?
      - We usually keep records relating to service users for 7 years (after the end of your involvement with us). This retention period is either required by law or is with the limitation period from bringing a contractual or personal injury claim.
      - Information relating to individuals who are referred to us who do not, for whatever reason, progress into one of our services will have their personal data retained for shorter period of time.
      - Safeguarding records relating to your involvement with us will be retained for a longer period of time.
      - Data is destroyed or deleted in a secure manner as soon as the retention date has passed.
    - Confidentiality, data sharing and safeguarding
      - Sometimes we may need to share your personal information to our Service Partners or other organisations (e.g. the Salvation Army, the Home Office, NHS, Police, Local authorities) in order to facilitate the services we provide to you and to ensure that you obtain the advice and support you need. We may share your data when we need to comply with a legal obligation, when we have your consent or when we have legitimate interests to do so and these are not outweighed by your rights or interests.
      - We will never sell your personal information on to third parties.
      - To comply with our duty of care and safeguarding, we may need to pass some information raising safeguarding concern with the authorities. In such circumstances, we apply the following lawful basis:
        
        Where an individual’s life may be at risk we may processing the data according to the UK GDPR Article 6(d) and GDPR Article 9 (c) where such processing is vital to the individual’s life
        
        Where an individual or child is at risk – UK GDPR Article 6(f) legitimate interest, Article 9(g), substantial public interest, DPA 2018 Schedule 1, Part 2 paragraph 18 Safeguarding of children and of individuals at risk
        
        Where an individual is at economic risk – UK GDPR Article 6(f) legitimate interest, Article 9(g), substantial public interest, DPA 2018 Schedule 1, Part 2 paragraph 18 Safeguarding of economic well-being of certain individuals
      - Data subjects’ rights and other UK GDPR provisions may be restricted when concerning personal data processed in the circumstances described above. Restrictions on the data subjects’ right may be permitted by the exceptions included in the articles of the individual rights (UK GPDR) or by one of the exemptions included between Schedule 2 and 4 of the DPA 2018. Examples of exemptions that might apply in the circumstances of safeguarding are the following:
        
        Schedule 2, Part 1, paragraph 2 (crime and taxation)
        
        Schedule 2, Part 3 (right of others)
        
        Schedule 3 – Part 5 (child abuse data)
      - Exceptions and exemptions are applied on a case by case basis.
    - Involvement with Research and Evaluation
    - While we may rely on our legitimate interest to use your personal data for research and evaluation purposes, on occasion there may be the opportunity to become additionally involved in other active research and evaluation programs. You are under no obligation to become involved in any additional research programme and this will not impact upon the service you receive. We will reach out to you with communications related to these opportunities only if you are happy for us to do so.

Appendix Two – Donors, Website Visitors, and Cookies
- Donors
  - When you make a donation through our website or third parties platforms, we may collect the following personal information that are provided directly by you:
    - Your title and name
    - Your contact details (such as your postal address, telephone number and/or email address)
    - Whether you are a UK tax payer
  - We will use the personal information in order to process your donation (whether a one off or a regular donation) and to obtain any tax reimbursements through gift aid.
  - We will share your personal information with HMRC in order to obtain any gift aid tax reimbursements, where applicable.
  - It is in our legitimate interests to process the personal information to process your donation and to obtain any tax reimbursements. These donations allow Causeway to further the interests of the charity.
- Social Media
  - When you interact with us on social media platforms such as Facebook and Twitter, we may obtain information about you (for example, name/user name, location data, personal information contained in the post). The information we receive will depend on the privacy preferences you have set on those types of platforms.
  - We will only use the above information to interact with you on the relevant social media site. We won’t use the above information for any other purpose.
  - Any social media posts or comments you send to us (on our Facebook page, for instance) will be shared under the terms of the relevant social media platform (e.g. Facebook or Twitter) on which they're written and could be made public. Other people, not us, control these platforms. We are not responsible for this kind of sharing. So, before you make any remarks or observations about anything, you should review the terms and conditions and privacy policies of the social media platforms you use. That way, you'll understand how they will use your information, what information relating to you they will place in the public domain, and how you can stop them from doing so if you're unhappy about it.
- Links to other websites
  - Our website may contain links to other websites of interest. Once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy notice. You should exercise caution and look at the privacy notice applicable to the website in question.
- Cookies
  - To learn more about how we use these and your choices in relation to these tracking technologies, please refer to our Cookies policy available at the bottom of our website.

Appendix Three – People and Culture
Employees, volunteers, director, worker or a secondee, work experience placement student, consultant or trustee
- How and when do we collect information about you?
  - This information is collected either directly from you or sometimes from an employment agency or background check provider. We may sometimes collect additional information from third parties including former employers, credit reference agencies or other background check agencies, pension administrators, medical professionals, other employees, the Home Office, the Disclosure and Barring Service, intranet and internet facilities. We collect information during the recruitment period and subsequently upon the start of your employment/engagement.
- What types of information is collected about you and who provides it?
  - We keep several categories of personal data on our employees/freelancers/job applicants/trustees and volunteers in order to carry out effective and efficient processes. Depending on your type of engagement with us, we may process the following types of your personal data:
    - Name, address and contact details
    - Date of birth
    - Gender
    - Family details
    - Education and qualifications skills, experience and membership of professional bodies, employment history and other information collected during the recruitment process that we retain during your employment/engagement
    - National insurance number and tax code
    - Emergency contact details and next of kin
    - Bank details, payroll details and tax status information
    - Salary, annual leave, pension and benefits details;
    - Evidence of your ability to work in the UK, your nationality and immigration status,
    - Driving license, vehicle information and proof of vehicle tax insurance in used for business
    - Information provided about you from your previous employer(s) and other referees,
    - Your working terms and conditions (e.g. Pay, hours of work, holidays, benefits)
    - Details of any other offices or appointments or business interests you hold
    - Any accidents connected with work
    - Training you have undertaken
    - Any disciplinary, grievance or other issues relating to your employment/engagement or in relation to which you are able to provide information
    - Attendance record and leave taken (e.g. Holiday, sickness absence, family leave);
    - Performance reviews
    - Any other personal information you share with us, including lifestyle and social circumstances
    - Information about medical and health conditions if relevant to the workplace,
    - Any reasonable adjustment(s) made to your role or your work under the equality act 2010
    - Equal opportunities monitoring information
    - CCTV footage and any other information obtained through electronic means
    - Information about your use of our it, communication and other systems
    - Details of your use of business related social media such as LinkedIn
    - Details of any interests or appointments that may conflict with employment by Causeway
    - GP name and address
    - Details of student loan repayments or postgraduate loans.
  - We may also process special category of data which include health information, sexual orientation, race, ethnic origin, political opinion, religion, trade union membership, genetic and biometric data.
  - We may also process records of criminal behaviour, details of convictions and Photo ID if the role involves a DBS check.
  - If any of your personal details change during your employment/engagement you should email [email protected] and put onto HiBob to notify our staff team, providing us with the updated accurate information.
- What will we use your personal information for and what is out legal basis for doing so?
  - We are required to use your personal data for various legal and practical purposes for the administration of your contract of employment or your volunteer/trustee agreement, without which we would be unable to employ you.
  - Holding your personal data enables us to comply with our contractual obligation (e.g. to pay and provide you with any benefits you are entitled to, to deal with any disciplinary and grievance issues which may arise, to record your leave, to assess your fitness to work).
  - We may also process your data under a legal obligation, for example, to check that you are legally entitled to work in the UK, to deduct PAYE and National insurance contributions, to prevent fraud, to comply with health and safety obligations and so on.
  - We may also process your data based on our legitimate interest (e.g. to manage volunteers agreement in the absence of a contract, to review and manage performance and development, to make decisions about your employment, to monitor equality and diversity, to defend any claims brought to the organisation, to monitor your use of our information and communication systems, to ensure network and information security, including preventing unauthorised access to our computer and electronic communications systems and preventing malicious software distribution).
- Criminal data and lawful basis
  - We will only use information relating to criminal convictions where the law allows us to do so. This will usually be where such processing is in our legitimate interests and is necessary either for the purposes of carrying out the obligations and exercising specific rights in the field of employment law or for reasons of substantial public interest, namely, preventing or detecting unlawful acts, protecting the public against dishonesty, safeguarding, preventing fraud or suspicion of terrorism or money laundering. Less commonly, we may use information relating to criminal convictions where it is necessary in relation to legal claims, where it is necessary to protect your interests (or someone else's interests) and you are not capable of giving your consent, or where you have already made the information public. When processing criminal records (for example, in order to perform DBS check), we rely on the lawful basis of legitimate interest, and Condition 10 from Schedule 1, DPA 2018, ("preventing or detecting unlawful acts").
- Special category and lawful basis
  - When processing special category of data in order to monitor equality and diversity, we rely on our legitimate interest – this activity is necessary for reasons of substantial public interest, namely for the purposes of identifying or keeping under review the existence or absence of equality of opportunity or treatment between groups of people specified in relation to that category with a view to enabling such equality to be promoted or maintained.
  - We may also process special category of data under our legitimate interest, when necessary for the for the purposes of carrying out the obligations and exercising specific rights in the field of employment law and when necessary for the establishment, exercise or defence of legal claims.
- Further general information about using your personal information
  - We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
  - Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
  - We do not carry out any automated decision-making or profiling in relation to you.
- How long do we keep your data?
  - To make sure we meet our legal data protection and privacy obligations, we only hold on to your information for as long as we actually need it for the purposes we acquired it in the first place.
  - In most cases, this means we will keep your information for as long as you are employed or engaged by us and for a period of 7 years thereafter. The reason for keeping your personal data for this length of time is to comply with HMRC requirements and because of the fact that some claims can be brought up to 6 years after your employment/engagement ends. If you’ve applied for a vacancy but your application hasn’t been successful, we will keep your data only for a maximum of 12 months.
  - To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
  - Some data retention periods are set by the law. Retention periods can vary depending on why we need your data. Please get in touch by contacting us at [email protected] if you want to know more about retention period.
- Data is destroyed or deleted in a secure manner as soon as the retention date has passed.
- Confidentiality - who do we share your data with?
  - Your personal data will be held by the People and Culture Department. Your personal data will be shared internally with other individuals and/or departments where this is reasonably necessary for the processing purposes set out in this privacy notice. For example, it will be necessary to share some of your personal information with our Finance department in order to pay you.
  - From time to time we will need to share your information with external people and organisations. We will only do so where we have a legitimate or legal basis for doing so and in compliance with our obligations under data protection laws.
  - Your information may be disclosed to:
    - Her Majesty’s Revenue and Customs (HMRC) in connection with your pay and benefits,
    - Banks and other financial institutions (Barclays Bank) in connection with your pay and benefits,
    - Pensions providers (Peoples Pension) for providing and administering your pension,
    - Payroll provider (C21) to process and Hope City Church to enable us to pay you,
    - Companies and businesses who provide or administer any benefits we offer. For example, MediCash
    - Other people who help us provide our website, in-house WIFI network, they include information technology experts who design and host our website (AMGB);
    - Our insurers and insurance brokers (Ansvar) who provide us with comprehensive cover against the risks of running a business,
    - Employment and recruitment agencies and outplacement organisations,
    - Professional bodies and regulators such as (Charity Commission),
    - Our professional advisors including our accountants when they need it to give us their professional advice (Salvation Army, Wirehouse – our HR and health and safety consultants);
    - Occupational Health and other medical professionals including social and welfare organisations to provide us with medical opinions in relation to any medical condition, illness or disability you may have or develop during the course of your employment/engagement;
    - The Police, local authorities, the courts and any other government authority if they ask us to do so (but only if us doing so is lawful);
    - Other people who make a subject access request, where we are allowed to do so by law;
    - Complainants, where this is necessary to respond to any complaints received;
    - Private investigators,
    - DWP – debt collection, where we are legally obliged to do so, e.g. to comply with a court order;
    - Prospective employers in response to reference requests,
    - Educational establishments, examination bodies, course providers in relation to any training you undertake or have undertaken;
    - Marketing service providers who carry out marketing activities on our behalf e.g.
    - Mail Chimp and HiBob,
    - Your family or representatives,
    - HiBob – people management platform, Wirehouse, The Salvation Army, CJSM;

Privacy Policy

Privacy Policy

Contents