An independent charity located in the Vale of the White Horse, providing activities that promote recovery for people who experience significant mental health difficulties
Privacy Policy
How we respect privacy when we deal with personal information collected by our organisation
This Privacy Policy applies to information we, Root & Branch, collect about individuals who interact with our organisation. It explains what personal information we collect and how we use it. If you have any comments or questions about this policy, feel free to contact us at
The type of personal information we may collect
We may collect and process the following information:
Personal data
The information we collect about you may include:
• Your name, title, date of birth and contact details, including your address, email address and telephone number;
• Marital status, next of kin and emergency contact information;
• Interests, activities and accolades, including honours and life achievements;
• Your attendance at events, including details of any payments made, photographs, audio and video recordings in which you may be included;
• Profile pictures that come from publicly accessible sources (where copyright allows and where we have your consent where applicable);
• Payment details, where you make a payment to us, including where you choose to make a donation to Root and Branch;
• Gift preference in respect of donations;
• Details of any relevant criminal convictions, allegations or charges that we ask you to declare to us either when you are referred to us, or whilst you are a service-user, or which are reported to us, and of any Disclosure and Barring Service checks (DBS) that we request. Relevant criminal convictions or charges are those that indicate an individual might pose an unacceptable risk to other service-users, volunteers or staff;
• A record of any volunteering work you have undertaken for us.
When you apply for a job working for us, we will securely store your information for six months after your interview. After six months, your information will be shredded.
When you visit our website, we may collect your computer’s network address, page(s) visited, web browser, any search criteria entered, the date and time of access, previous web pages visited and other technical information. This information is used solely for web server monitoring and to deliver the best visitor experience. Additional data may be collected in forms for specific functions. We use all appropriate technical and organisational security measures to safeguard the security of your data.
When we interact with you, we may also collect notes from our conversations with you, and details of any complaints or comments you make. We may record your age or identity where the law requires this.
We may use technology such as cookies, which are small text files sent by your computer each time you visit our website, unique to your visit or your browser. We use cookies to help us deliver relevant and interesting content in our future communications, by recording information about your previous visits to our website. We may use the information we obtain to find out more about you and to profile you but in the least intrusive way. For example, we may use information we collect to display the most interesting content to you on our website. If you would prefer that we do not use cookies, you should adjust your browser settings to reject cookie use. Where we use cookies for ‘necessary’ purposes such as site security, or to ensure the proper functioning of our website, we do not require (and will not ask for) your consent for these cookies. Please note that if you adjust your browser settings to reject cookies, it may affect your experience in using the site, in the event that any blocked cookies support functionality. For further information, we recommend visiting https://www.aboutcookies.org/
Special category personal data
“Special categories” of particularly sensitive personal data require higher levels of protection. We need to have further justification for collecting, storing and processing this type of personal data. We aim to collect and process special category data as little as possible and we will document all incidents of our processing of special category data in our record of processing activities.
The special categories of personal data consist of data revealing:
• Racial or ethnic origin;
• Political opinions;
• Religious or philosophical beliefs; and
• Trade union membership.
They also consist of the processing of:
• Data concerning physical or mental health; and
• Data concerning someone’s sex life or sexual orientation.
We may process special categories of personal data where one of the following conditions are met:
(a) Explicit consent.
(b) Employment, social security and social protection (if authorised by law).
(c) Vital interests.
(d) Not-for-profit bodies.
(e) The data has been made public by the data subject.
(f) Legal claims or judicial acts.
(g) Reasons of substantial public interest (with a basis in law).
(h) Health or social care (with a basis in law).
(i) Public health (with a basis in law).
(j) Archiving, research and statistics (with a basis in law).
Further legal controls apply to data relating to criminal convictions and allegations of criminal activity. We may process such data on the same grounds as those identified for “special categories” referred to above. Confidential information relating to specific safeguarding issues will be kept securely by the Centre Manager whilst the issue is being investigated. On completion, a final report will be stored in a secure central place. This will be kept for as long as deemed necessary, in line with Data Protection and Confidentiality policies.
Why we have your personal information and why we use it
We process your data for a variety of purposes, including but not limited to the following:
• Making decisions about your admission to Root and Branch and maintaining a waiting list;
• Supporting therapeutic care, and providing you with learning opportunities and facilities and support;
• Organisational management, planning and forecasting, including accounting and auditing;
• Operational reporting, the production of management information, and for other relevant purposes relating to the governance of Root and Branch;
• Monitoring and reporting on service-user progress;
• Providing appropriate therapeutic care;
• Assessing the quality of our services;
• Protecting the welfare of service-users and others at Root and Branch;
• Ensuring the safe and orderly running of the Root and Branch;
• Promoting the Root and Branch, its aims and ideals;
• Informing you of fundraising or volunteering opportunities;
• Complying with our legal requirements and responding to law enforcement authorities; and
• Equal opportunities monitoring.
We may share this information with:
-
Emergency Services
-
Healthcare Providers (including but not limited to GP or psychiatric care).
Under the General Data Protection Regulation (GDPR), the lawful bases we rely on for processing this information are:
(a) Where we have your consent. You are able to remove your consent at any time. You can do this by contacting us at our offices:
E: rootandbranch@btconnect.com
Address:
Westmill Farm
Watchfield
OXON SN6 8TH
(b) Where we have a contractual obligation.
(c) Where we have a legal obligation.
(d) Where we have a vital interest.
(e) Where we need it to perform a public task.
(f) Where we have a legitimate interest – see the Information Commissioner’s Office website for further information, at https://ico.org.uk/for -organisations/guide-to-data-protection/
How we store your personal information
Your information is securely stored on Root and Branch premises.
We keep general data for six months, our Data Management Policy (no.12) defines our rules more precisely. We keep ongoing case notes for one year after the case has been closed. We will then securely dispose of your confidential information.
Whenever we collect or process your personal data, we will only keep it for as long as is necessary for the purpose(s) for which it was collected and for the purposes of satisfying any legal, accounting, regulatory or reporting requirements.
There may be some circumstances where we will keep data indefinitely, for example where we are holding it for archiving purposes in the public interest, scientific or historical research purposes or for statistical purposes.
To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means. We also give careful consideration to the applicable legal requirements.
In some circumstances, we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.
Your data protection rights
Under data protection law, you have rights including:
-
Your right of access
You have the right to ask us for copies of your personal information.
-
Your right to rectification
You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
-
Your right to erasure
You have the right to ask us to erase your personal information in certain circumstances.
Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances.
-
Your right to object to processing
You have the right to object to the processing of your personal information in certain circumstances.
-
Your right to data portability
You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.
You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.
If you wish to make a request, please contact us at:
E: rootandbranch@btconnect.com
Tel: 01793 780380
How to complain
If you have any concerns about our use of your personal information, you can make a complaint to us at:
E: rootandbranch@btconnect.com
Tel: 01793 780380
You can also complain to the ICO if you are unhappy with how we have used your data.
The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
https://ico.org.uk/make-a-complaint/data-protection-complaints/personal-information-complaint/