This privacy notice explains how Handcrafted collects, stores and processes your personal data.

This notice will be reviewed as required and at least annually by the group or individual responsible for review and authorised by the Trustees as below:

Group or individual responsible for review	The Ethos and Values Steering Group
Last review and approval	01/07/2023

What is your personal data?

Personal data is any information that identifies you. Whether you come into contact with us as a supporter, volunteer, trainee, or for any other reason, you will be giving us data about yourself. It might not be just obvious things like your name and address, but it can be any piece of information that can be identified as referring to you rather than anyone else. How we treat this information is governed by The Data Protection Act 2018, the UK’s implementation of the General Data Protection Regulation (GDPR).

Who are we?

The charity, Handcrafted Projects, is committed to protecting your privacy and letting you know why we have it and what we are doing with it. Under The Data Protection Act 2018, we are known as a 'Data Controller' because we decide what personal data to collect and what we do with it.

How do we collect your personal data?

Whenever you make contact with us:

If you ask us about our activities, make a donation to us, buy a product, apply for a vacancy, access training, or get support from us, you are likely to be giving us your personal information.

When others tell us about you:

If you are referred to us for support by another organisation, or if a third party passes your details to us for any reason, we will get some personal data.

If we are giving you support:

If you are referred to us for support, we will collect and store the referral form, which includes information such as your name and date of birth and the reasons for the referral. We will then keep an ongoing record of our contact with you, the activities you do with us, our assessments, and reviews of your needs and how we are meeting them.

How do we use your personal data?

We use your personal data in ways that are adequate, relevant and limited to only what is necessary, so that we can

provide the services that we have been set up to provide as specified in our stated aims and activities (See Handcrafted's Charitable Objects)
keep up-to-date records of staff, trainees, residents and volunteers
pay our staff
comply with the law (for example, the Charities (Protection and Social Investment) Act 2016. We must at all times be able to identify supporters who make major gifts)
fundraise and promote the interests of the charity (for example, we need to keep your email address so that we can update you on opportunities to support our work)
communicate between members of the staff, volunteer teams and referring organisations (for example, to let a referrer know that you have been coming along to our training)
manage risk and ensure safety (for example, contact and next-of-kin details in case of an emergency)

We are careful to only collect and keep the information that we need to do our job. We keep the information we have about you up-to-date and correct it as soon as we find out if there are any errors in it. We are also committed to making sure your personal data is secure and does not fall into the wrong hands.

When your data is stored electronically, we ensure that it can only be accessed by members of the staff team, protected according to our strict passwords and devices policy and stored in systems that are compliant with The Data Protection Act.

What about sensitive personal information?

From time to time, you might tell us about a personal experience or give us information about your health, race, ethnic origin, political opinions, sex life or orientation, or religious beliefs. This is Sensitive Personal Information that is recognised under Data Protection Law as needing particular care.

We will only use this information:

to tailor our support for you personally
to internally monitor or evaluate the services we provide

We will not pass these details to anyone else without your permission except in exceptional circumstances where, for example, there is a risk of serious self-harm or a threat to others.

If you give us details of your personal life for inclusion in a blog post or other media, we will make sure that you are happy for us to share this before we publish it. You can change your mind about this at any time and let us know by contacting us.

What is the legal basis for using your personal data?

We are legally allowed to use your personal data if you have given us consent to do so for a specific purpose.

Additionally, we are permitted to keep and process your personal data so that we can fulfil a contract you have with us. This can happen when you ask us to do something for you; it doesn't require a signed piece of paper, but you may be applying for a job, buying a product or getting help from us.

Unusually, we may also have to disclose some of your personal data to protect your “vital interests”. This only applies in cases of life or death, such as where your medical history is disclosed to a hospital’s A&E department after a serious accident.

Do we ever share your personal data with others?

Your personal data will be treated as strictly confidential and will only be shared with other members of the staff team and volunteers in order to provide our services, or if we are legally required to disclose information.

We will never pass your personal data to others so that they can contact you for marketing purposes.

We will only share personally identifiable data with third parties outside of the charity with your consent, as part of a contract, or if it is of vital interest. If we need to do this we will also make sure that any third parties have similar measures in place to protect your privacy according to the Law.

For how long do we keep your personal data?

In accordance with the guidance set out by the Information Commissioner's Office (ICO), we do not keep data for longer than we need to. In some cases, this will be limited because the contact is brief, and we are unlikely to need the information to process a complaint or claim in the future. We audit and delete or archive information annually. However, because we work with vulnerable adults, our policy is that we will keep most data forever.

Documentation obtained for the purpose of contracts we have with third parties (e.g. delivering training courses) will be kept for the appropriate amount of time as specified in the contract.

Do I have any rights over my personal data?

You have the right to request a copy of the personal data which Handcrafted Projects holds about you. You can do this by writing to us. We will respond to all requests within 30 days of receiving a written request.

You have the right to request that Handcrafted Projects correct any details in your data if they are inaccurate or out of date.

Where you have given consent for us to use your personal data for a specific purpose, you have the right to withdraw this consent at any time by telling us.

You can lodge a complaint with the Information Commissioner's Office (ICO).

Updates to this notice

We will regularly review this notice as any of our activities, processes or national regulations change. If there is any significant change to the way we intend to handle your personal information then we will inform you of this.

Contact details

Contact us

Handcrafted, Unit 21, Skillion Business Park, Littleburn Road, Durham, DH7 8HG

Call 0191 3781562 or email info@handcrafted.org.uk

Contact the Information Commissioner's Office

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Call: 0303 123 1113 or email via: https://ico.org.uk/global/contact-us/email/