1. Introduction

This Privacy Notice sets out information in relation to the processing of data and how privacy of data is protected. The privacy and security of your personal information is extremely important to us. We want to make sure you are informed and can be confident about giving us your information.

We, Eating Distress North East (EDNE), are the ‘controllers’ of the information which we collect about you (‘personal data’). Being controllers of your personal data, we are responsible for how your data is processed. The word ‘process’ covers most things that can be done with personal data, including collection, storage, use and destruction of that data.

This notice explains why and how we process your data, and explains the rights you have around your data, including the right to access it, and to object to the way it is processed. Please see the section on ‘Your rights as a data subject’ for more information.

We are a registered charity and company limited by guarantee and our contact details are:

Our Data Protection Lead is Ann Dymyd, the Chief Executive, whom you can contact above.

2. Scope

This policy applies if you use our services or are a parent, carer, donor, volunteer, trustee, visit our website, email, call or write to us. In certain circumstances we may also provide an extra privacy notice, which we will always inform you about.

3. Responsibility for Implementation

All staff, volunteers and trustees are responsible for the implementation of this policy, with overall responsibility resting with the Chief Executive.

4. EDNE disseminates policies and procedures to relevant staff, volunteers and Trustees by:

• Hard and/or electronic copies of current policies and procedures provided during induction.
• All policies and procedures available to staff on the shared drive, and to volunteers and Trustees on request and/or as appropriate.
• Updated/new policies and procedures circulated by email, and discussed in staff meetings and/or Trustee meetings as appropriate.
• Policies and Procedures being a standing item on staff and Trustee meeting agendas.

5. What do we mean by personal data?

‘Personal data’ is any information that can be used to identify a living person. This data can include your name, contact details, and other information we gather as part of our relationship with you.

It can also include ‘special categories’ of data, which is information about a person’s race or ethnic origin, religious, political or other beliefs, physical or mental health, trade union membership, genetic or biometric data, sex life or sexual orientation. The collection and use of these types of data is subject to strict controls. Similarly, information about criminal
convictions and offences is also limited in the way it can be processed. We keep special category data in accordance with Article 9, section d of the General Data Protection Regulations, which details the legal requirements for charities to hold this type of information.

We are committed to protecting your personal data, whether it is ‘special categories’ or not, and we only process data if we need to for a specific purpose, as explained below.

6. How we collect your personal data

a. Information provided by you
We collect your personal data mostly through our contact with you, and the data is usually provided by you when you: enquire about our services, register as a service user with EDNE, tell us about your experience of eating distress, access services and attend events, donate or fundraise on our behalf or other things that we do in the course of our work.

b. Information provided by other people
In some instances we may receive data about you from other people/organisations e.g. when they refer you to us for support.

c. Personal data created by your involvement with us
Your activities and involvement with us will result in personal data being created. This could include details of the events and activities sessions you’ve attended, records of the support we’ve provided, how you’ve helped us by volunteering etc. If you decide to donate to us we will keep records of when and how much you give.

7. How we use your information

Any information we hold about you will be stored securely and treated in accordance with the relevant legislation (currently the General Data Protection Regulations (GDPR).

In general terms, we process your data in order to manage our relationship with you. We will use the information that you give to us:

• To send you information that you have asked for
• To understand your situation so we can offer you individually tailored support to meet your needs
• To contact you about other services which may help you
• To inform you about events, fundraising, campaigning and our other work
• To administer your donation or support your fundraising, including processing Gift Aid
• To keep a record of your relationship with us
• To ensure we know how you prefer to be contacted

More detailed information on how we use your personal information, including how long
we keep it for can be found below.

At times, we may further process data which we have already collected. We will only do this if the new purpose for processing it further is compatible with the original purpose that the data was collected for. We will tell you about any further processing before carrying it out.

To provide some of our services, we need to collect and process additional information about you. We will always make it clear when we are doing this. This could include, but is not limited, to the following:

Training
If you attend our training, we will need to take more detailed information about your role and workplace. This information is kept with your record in our secure database (see above for retention details).

Counselling Service
If you are referred to our counselling service, your counsellor will keep records about your counselling sessions. These are separate and confidential, with only your counsellor and our Counselling and Therapy Services Manager having access. They are confidentially disposed of after seven years.

Volunteering, being an employee or a Trustee
If you choose to volunteer or work with us, then we may collect extra information about you (e.g. references, criminal records checks, details of emergency contacts, medical conditions etc.). This information will be retained for legal or contractual reasons, to protect us (including in the event of an insurance or legal claim) and for safeguarding purposes.

8. Who we share your data with

We will not pass your personal contact details to other people or organisations, or discuss details of your role as a parent or carer or the services you receive from us, without first obtaining your consent, e.g. we will ask your permission to refer you to another organisation for additional support or to discuss something with another professional.

However, where there appears to be a clear risk to your or someone else’s safety we have a legal duty to contact relevant authorities to address this. Where appropriate, we will inform you before we do so. You can find out more about this in our Safeguarding Policies and Procedures which are available on request.

For some processing purposes we use third party software and systems, which means we need to pass on some of your data to external recipients. The type of information we may share, and for what purpose, includes but is not limited to:

• Financial information e.g. if you make a donation, we will need to share some of your information for Gift Aid purposes so that we can make a claim.
  
• Contact and monitoring information: We use third parties to help us process some of our data. This includes but is not limited to: Mailchimp to send newsletters and updates by email; Give as You Live, Just Giving and BT Donate to collect and process donations; Google Analytics for website statistics; and Survey Monkey to collect feedback on our services. Every third party we use is GDPR-compliant.

9. How we store your data

Your personal data is held in both hard copy and electronic formats.

Electronic data, including emails, is stored on our servers, which are located in the UK and on our software suppliers’ servers. In addition our secure database provider securely backs up our electronic data and ensures it is disposed of securely when it is no longer needed. Our software and IT providers are GDPR-compliant.

Hard copy data is stored securely in locked offices and storage spaces within EDNE’s premises. We confidentially and securely dispose of all hard copy data.

10. Cookies on our website

Are covered by a separate policy.

11. Your rights as a data subject

As a data subject, you have the following rights in relation to your personal data processed by us:

• To be informed about how your data is handled;
• To gain access to your personal data;
• To have errors or inaccuracies in your data changed;
• To have your personal data erased, in limited circumstances;
• To object to the processing of your personal data for marketing purposes or when the processing is based on the public interest or other legitimate interests;
• To restrict the processing of your personal data, in limited circumstances;
• To obtain a copy of some of your data in a commonly used electronic form, in limited circumstances;
• Rights around how you are affected by any profiling or automated decisions

a. Withdrawing consent
If we are relying on your consent to process your data, you have the right to withdraw your consent at any time.

b. Exercising your rights, queries and complaintsFor more information on your rights, if you wish to exercise any right or for any queries you may have or if you wish to make a complaint, please contact our Data Protection Lead Ann Dymyd at EDNE.

c. Complaints to the Information Commissioner
You have a right to complain to the Information Commissioner’s Office (ICO) about the way in which we process your personal data. You can make a complaint on the ICO’s website https://ico.org.uk/.

October 2021