- Who we are
- What information we will collect
- When we will require personal information from you
- Where your information is stored
- How we use your information
- How we protect your information
- Sharing your information
- Legal basis for using your information
- SARI’s website “Cookie” use
- Links to other websites
- How you can access information SARI keeps about you
- Sharing you information
- How long your information will be kept
1. Who we are
SARI (Stand Against Racism & Inequality) are committed to protecting your personal information and making every effort to ensure that your personal information is processed in a fair, open and transparent manner.
SARI is a “data controller” for the purposes of the Data Protection Act 1998 and (from 25 May 2018) the EU General Data Protection Regulation. This means that we are responsible for, and control the processing of, your personal information.
2. What information do we collect from you?
Making a case referral
When making a case referral through SARI as a third party we will ask you for your name, address, referral agency and telephone number, details of the incident(s), as well as other necessary information. No case referral can be completed without this information. In addition, or in the case of a direct referral, we will ask you for details, such as your name, postal address, telephone number, email contact, age, ethnicity, sexuality, gender, language and access requirements, as well any details of the incident(s) you are reporting or have been involved in.
Making a donation
If you are making an online donation we will ask you for your full name and email address. As the only donation method currently offered by SARI is online via PayPal, no payment details will be collected by SARI. Emails are securely stored and are never divulged to third parties.
3. When will we collect personal information from you?
When we receive your referral and during the course of your case, information (whether collected over the phone, in person or writing) is processed from you for service delivery purposes. For this reason the information processed may include name, contact details and family details. Your information is contained in documents SARI uses to deliver its service i.e. in incident updates, referrals risk assessments and other safety checks and may be shared with our partners to deliver specialised services. Your caseworker will explain how your data in detail is used when it comes to signing the consent form.
When you browse the SARI website and have not registered for any of our online services, you browse anonymously and no personal information is collected from you. We will only collect personal information from you in the event that you use our online services, such as making an online referral to SARI or when making a donation to the organisation.
4. Where your information is stored
Storage of physical records (i.e. non-electronic records) are stored in such a way that they are both sufficiently accessible and safeguarded against environmental damage and unauthorized access in SARI’s premises.
Management of electronic (i.e. digital) records requires a computer, server, or other digital storage equipment. With electronic records:
- Data is accessed by those on a strict need to know basis.
- Strong passwords are used to protect sensitive data.
- Emails containing information up to an equivalent of ‘OFFICIAL’, including ‘OFFICIAL SENSITIVE’ will be sent via CJSM secure email.
Unauthorised access to information about individuals will be prevented by the protection and encryption of computerised data and the secure storage of paper records. These are dealt with under specific policies and procedures which are reviewed periodically to ensure continued effectiveness.
5. How do we use this information?
SARI will only use the personal information collected in support of the services you have requested.
6. How do we protect personal information?
SARI takes the protection of personal information very seriously. When you provide your personal information through our website, this will be via a non-secure internet connection which is the responsibility of the Internet browser you use, however, an SSL certificate is installed, which encrypts connections for the sending of this data. Unfortunately the transmission of information using the internet is not completely secure. Although we do our best to protect your personal information sent to us this way, we cannot guarantee the security of data transmitted to our site and this will be provided at your own risk. Once, however, the information has been received by SARI it will be filed and stored securely by us in accordance with the Data Protection Act 1998 and GDPR.
7. Will we share the information we collect with other parties?
SARI will not share any personal information with third parties, except where other 3rd party agencies are believed to be of assistance in resolution of cases referred to SARI. In these instances, SARI will seek explicit permission from the individual concerned before passing across any personal information, however, if required to do so by law, personal information may need to be disclosed without prior permission from the individual concerned (please refer to section 4 of the Information Sharing and Confidentiality Policy for further information).
8. Legal basis for using your information
In some cases, we will only use your personal information where we have your consent or because we need to use it in order to fulfil a service with you
However, there are other lawful reasons that allow us to process your personal information and one of those is called ‘legitimate interests’. This means that the reason that we are processing information is because there is a legitimate interest for SARI to process your information.
10. Links to other websites
The SARI website includes links to other websites, not owned or managed by SARI. SARI shall not be held responsible for the privacy of data collected by websites not owned or managed by SARI.
11. Can I access the information you collect from me?
Under data protection legislation you can request a copy of any of your personal information that SARI is in receipt of – this is called a Subject Access Request (SAR) and can be done verbally over the phone, in person or electronically via email. The requested information will be given to you within 30 days. A Subject Access Request is free of charge. Details on how to do this are in the following paragraph.
You can either call 0117 9420060, email firstname.lastname@example.org or write to us at PO Box 2454, Bristol, BS2 2WX if you would like to open a Subject Access Request. As previously mentioned, we will not make a charge for supplying this information; however, it will ease the administration burden and reduce waiting times if you are able to tell us how and when the information may have been supplied to us. You can also request a copy of your file for your own needs, or to share with another agency.
12. Sharing your information
The personal information we collect about you will mainly be used by our staff (and volunteers) at SARI so that they can support you.
We will never sell or share your personal information with organisations so that they can contact you for any marketing activities. Nor do we sell any information about your web browsing activity.
13. How long your information is kept
Up to 5 years after the case is closed as per SARI’s document management and retention policy.
Your rights and how you can use them (regarding your personal information)
Right to be informed: We must provide you with a privacy notice to tell you how we are using your personal data, why we are using it and how long we are likely to use it for.
Right of access: You can ask us for access to any of the information we hold on you at any time by filling out a ‘subject access request form’ (available upon request by emailing email@example.com or phoning 0117 9420060). Information will be given to you within one month of your request being received.
Right to rectification: You can change your personal data if it is inaccurate or incomplete. Please contact us if any of your personal information changes.
Right to erasure: You can ask us to delete or remove your personal data where there is no reason for us to keep it. Contact firstname.lastname@example.org to request this.
Right to restrict data processing: Under certain circumstances, you can ‘block’ us from using your personal data. We are then allowed to store your personal data, but nothing more.
Right to complain: You have the right to complain to a supervisory body (ICO) if you feel we have failed to meet our duties to you in any way in relation to your personal data.
You maintain the right to withdraw consent at any time: Contact email@example.com at any time to do so.
The information you have provided will be kept in accordance with our Confidentiality and Data Protection Policy and will be used by SARI to provide you with the service you have requested.
Contacting us: Please contact us to make any requests in relation to your rights, or if you have any other queries about the Data Protection Act, GDPR or SARI’s Data Protection Policy please contact our data protection officer using the following details:
Phone: 0117 942 0060