The Rose Road Association Privacy Statement

April 2021

Privacy Statement

The Rose Road Association is committed to protecting your privacy. We ensure all your personal information is held securely and safely.

This Privacy Statement explains how we collect, use and store information, and what that might mean for you. The Rose Road Association holds and processes personal details in accordance with the General Data Protection Regulations and is registered with the Information Commissioner (Registration Number Z5670976) as a data controller.

We collect and process information for the following purposes:

• To provide safe and effective care and support services and to give appropriate information advice and support.
• To send you information about how to book sessions or stays with us or general news about disability or The Rose Road Association.
• To promote the Association, our events and campaigns and the work we are doing.
• To ensure the health and safety of our service users, staff and visitors and to assist in the prevention and detection of crime.

What information we collect

We currently collect and process the following information about the people who use our services, visitors, our supporters and donors:

• Personal identifiers, contacts and characteristics (for example, name, date of birth and contact details) about the individuals who use our service and their main carer.
• Contact details, donation information, interests, events attended and contact preferences for our supporters and donors.
• Photographs and videos of people using our services.
• Photographs and videos of people attending events at The Bradbury Centre and elsewhere.
• Information about health and care needs and disabilities of the people using our services.
• Information about enquiries made to our SEND Information, Advice and Support Service helplines.
• Demographic information such as race or employment status.
• CCTV Images of people and vehicles outside our premises at The Bradbury Centre.
• Dashboard Camera images of people and vehicles in view of our Rose Road Association Vehicles.
• Data from our main website and other collection methods, including anonymous and aggregate data.

How we get the information and why we have it

Most of the personal information we process is provided to us directly by you for one of the following reasons:

• We collect information about your health and social care needs to enable us to provide the appropriate care and support to people using our services.
• We take photographs of our service users to evidence activities they have taken part in and to promote the work of the Association.
• We collect information about enquiries you make to our helplines to enable us to provide the appropriate information advice and support.
• We collect demographic information about people using our services so that we can monitor and ensure we are providing support to all who need it.
• We collect information about our donors and supporters to confirm receipt of donations and where appropriate inform supporters of their impact.
• We collect marketing consent, record attendance at events and communication from and to our donors and supporters to enable us to plan events and make contact about events and campaigns they may be interested in.
• We use cookies on our website to track popular points of entry to our site and routes around areas of our site. This data may be connected to you personally in order to provide you with a better service.
• We communicate electronically in accordance with the Privacy and Electronic Communications Regulations. All our fundraising emails will offer you the opportunity to decline future emails. You can also amend your email and electronic communications preference by contacting us.
• We collect CCTV images at the entrance and car park area of The Bradbury Centre. We have positioned the cameras so that they only cover communal or public areas on the Association’s business premises and they have been sited so that they provide clear images. We also collect dashboard camera images of the driver view in our Association vehicles. We do this:
  • To assist in the prevention or detection of crime.
  • To assist in the identification and prosecution of offenders.
  • To monitor the security of the Association’s business premises and vehicles.
  • To ensure the safety of the Association’s staff and service-users.
  • To ensure that health and safety rules and Association procedures are being complied with.
• To assist with the identification of unauthorised actions or unsafe working practices that might result in disciplinary proceedings being instituted against employees and to assist in providing relevant evidence.

• We receive personal identifiers, contact details and health and social care information from commissioners referring to our care and support services.

Lawful basis for processing personal information.

Under the General Data Protection Regulation (GDPR), the lawful bases we rely on for processing your information are:

• We have a contractual obligation to collect demographic information for our commissioners to demonstrate our reach.
• We have a legal obligation to collect information about your health and social care needs to provide an appropriate health and social care service.
• We need to collect information from callers to our helplines to perform a public task on behalf of the local authorities and CCGs which commission us to provide SEND Information Advice and Support, which is a statutory service.
• We ask your consent to share your images outside of the organisation for publicity purposes - it is up to you whether you give your consent or not.
• We have a legitimate interest (see below) to collect and use information about our donors and supporters.

Legitimate Interests

Legitimate interests mean that we can process personal information if we have a genuine and legitimate reason to do so and we are not infringing on your rights or best interests.

This enables us to use your information for our legitimate business interests to support severely disabled children and young adults and their families in Hampshire and surrounding areas. We will only do this with appropriate consideration being given to your rights and any impact this may have on you personally.

We believe that our donors and supporters would be keen to learn more about the impact they have had on the lives of children, young adults and families we have supported, and also better understand how they might support these families in the future.

Legitimate Interests may enable us to send you marketing and other communication which is relevant and timely. It may enable us to undertake customer research and improve our communications. It may enable us to thank our supporters and inform them of the impact of their donation. It may assist us in processing orders, keeping in touch about events and giving you the opportunity to update your communications preferences.

Sharing Information

We may share information about our service-users with health and social care practitioners if we need to do so to keep you safe and healthy. If we need to share service-user information for other reasons we will obtain your consent to do so.

We may share CCTV and Dashboard Camera images with our insurers, with law enforcement organisations or in response to a Data Subject Access Request.

We do not sell, rent or pass on any information about you to other organisations. We may provide third parties with information about visitors to and users of our website but this is aggregate and anonymous.

How we store your information

Your personal information is securely stored on our electronic databases which are password protected, or in locked cabinets on our premises.

CCTV images are stored on a hard drive and deleted and overwritten on a recycling basis and, in any event, are not held for more than one month.

Dashboard Camera images are recorded onto the SD card within the device, which holds around 1.5 hours of footage. Images are overwritten on a recycling basis.

We keep information as outlined in our Records Retention Policy which is available on request.

Your Data Protection Rights

Under data protection law, you have rights including:

Your right of access - You have the right to ask us for copies of your personal information.

Your right to rectification - You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.

Your right to restriction of processing - You have the right to ask us to restrict the processing of your information in certain circumstances. This may include changing the way you hear from us.

Your right to object to processing - You have the right to object to the processing of your personal data in certain circumstances. This may include being removed from our mailing lists.

Your right to data portability - You have the right to ask that we transfer the information you gave us to another organisation, or to you, in certain circumstances.

Changing how we store and process your data

From time to time, we will make changes to our privacy notice and policy to keep them up to date and relevant. Please make sure you check regularly to see what has changed.

Our data protection contact details

Please contact us if you wish to make a request or you have a question or complaint about how we are processing your personal information.

Data Security & Protection Lead: Chloe Atkins, Head of Fundraising
Phone: 023 8072 1234
Email: gdpr@roseroad.org.uk
Post: The Rose Road Association, The Bradbury Centre, 300 Aldermoor Road, Southampton SO16 5NA.

You can complain to the Information Commissioners Office (ICO) if you are unhappy with how we have processed your data.

The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113

Download our full Privacy Notice in PDF below.

• Download our Privacy Statement
• Download Our Easy-Read Privacy Statement