Privacy Policy
Community Action Suffolk Privacy Notice
Who are we
We are Community Action Suffolk. Community Action Suffolk is a Registered Charity (No 1150501). A company limited by guarantee and registered 08316345 residing at Brightspace, 160 Hadleigh Road, Ipswich, Suffolk, IP2 0HH, 01473 345400, [email protected]
Community Action Suffolk’s other subsidiary companies include Business Services at CAS Ltd (03332778), DBS At CAS Ltd (02919237) and IT Services At CAS Ltd (04281770), also residing at Brightspace, 160 Hadleigh Road, Ipswich, Suffolk, IP2 0HH.
The Privacy Notice
This notice sets out the broad information for CAS as a whole. Some services have their own notices that provide more detail and these can all be found on their respective websites.
Community Action Suffolk is committed to ensuring that your privacy is protected. Should we ask you to provide certain information by which you can be identified when using this website, then you can be assured that it will only be used in accordance with this privacy statement.
Community Action Suffolk may change this policy from time to time by updating this page. When any changes are made to this policy we will notify you via email. This policy is effective from 01/05/2018.
“We” is defined as Community Action Suffolk throughout this policy.
“Partners” are defined as all Community Action Suffolk staff and our subsidiaries listed above in the “Who We Are” section.
- Data We Collect
Registration/Orders
On registration to become a member of Community Action Suffolk or a user of Community Action Suffolk services, depending whether you are an individual or organisation, we will collect various information to allow us to setup your membership or to deliver the other services you have requested. We will only collect the information we require to deliver the service you have requested.
This data includes all your contact information such as name, address, telephone number, email address etc plus any newsletter receiving preferences (if you are becoming a CAS member). Specific information relating to the exact types of data we collect will be detailed on our membership signup form or on other service request forms (such as training forms, event registration forms etc) and can be found online in the appropriate section on the website.
Service Use
We log usage data when you visit our website via Google Analytics. Google Analytics is an application that allows us to track how many times you visit the site, where you go when you are on our site and where you leave our site. It also tracks technical information like what Internet Browsers you use and what device you are using to visit our site.
Cookies
As further described in our Cookie Policy, we use cookies to recognise you and/or your device(s) on, off and across different Services and devices. We also allow some others to use cookies as described in our Cookie Policy. You can control cookies through your browser settings and other tools.
Device and Location
When you visit or leave our Services (including our plugins or cookies or similar technology on the sites of others), we receive the URL of both the site you came from and the one you go to next. We also get information about your IP address, proxy server, operating system, web browser and add-ons, device identifier and features, and/or ISP or your mobile carrier.
- How We Use Your Data
Communications
We may contact you via email, telephone and post, we will send you messages about the availability of our Services, security, or other service-related issues. We also send messages about how to use the Services, network updates, reminders, and promotional messages from us and our partners. You may change your communication preferences at any time by contacting us or by visiting one of our emails and using the unsubscribe or change my preferences function at any time.
Support
We use the data (which can include your communications) to investigate, respond to and resolve complaints and Service issues (e.g., bugs).
Security
We use your data (including your communications) if we think it’s necessary for security purposes or to investigate possible fraud or other violations of our Terms and Conditions or this Privacy Policy and/or attempts to harm our Members or Visitors.
Service Development
We use data collected from Google Analytics for the further development of our Services in order to provide you and others with a better, more intuitive and personalised experience, drive membership growth and engagement of our Services.
Sensitive Personal Data
In certain circumstances we may be required to collect and hold sensitive personal data relating to a individual’s physical or mental health to enable us to meet contractual requirements.
We may collect sensitive personal data relating to individual’s age, ethnicity, employment status, ability status and gender for the above reasons.
- How We Share Information
Third Parties
We do not disclose your data or information to any third parties, other than the suppliers who we work with to provide you the services you are requesting access to or that enable Community Action Suffolk to operate on a daily basis. They will have access to your information as reasonably necessary to perform these tasks on our behalf and are obligated not to disclose or use it for other purposes.
Related Services
We will share your information with other employees within Community Action Suffolk to process any payment information, develop the service and to provide the service on a day to day basis. We may also share it within Community Action Suffolk’s subsidiary companies (as detailed at the top of this policy) for marketing purposes.
Legal Disclosures
It is possible that we will need to disclose information about you when required by law.
- Rights to Access and Control Your Data
Data Retention
We retain your personal data while your account is in existence or as needed to provide you Services. We only keep information for as long as it is needed. This will be based on either a contractual or legal requirement (where a law says we have to keep information for a specific period of time) or accepted business practice. This is set out in our retention schedule.
Rights to Access and Control Your Personal Data
For personal data that we have about you:
Delete Data: You can ask us to erase or delete all or some of your personal data (e.g., if it is no longer necessary to provide Services to you).
Change or Correct Data: You can ask us to change, update or fix your data in certain cases, particularly if it’s inaccurate.
Object to, or Limit or Restrict, Use of Data: You can ask us to stop using all or some of your personal data (e.g., if we have no legal right to keep using it) or to limit our use of it (e.g., if your personal data is inaccurate or unlawfully held).
Right to Access and/or Take Your Data: You can ask us for a copy of your personal data and can ask for a copy of personal data you provided in machine readable form.
If you want to remove yourself from our mailing list which will stop ALL communications from Community Action Suffolk then from one of our emails, simply click on the “Unsubscribe” link at the bottom and follow any on screen instructions. Alternatively you can also contact us via email at [email protected] or by telephone on 01473 345400 and we will process your request for changes, deletions or requests of data within 1 calendar month.
- How we protect your data
We implement security safeguards designed to protect your data, such as HTTPS on our websites, hardware and software firewalls, username and password based permission systems as well as a variety of physical security methods on buildings that host your data. We regularly monitor our systems for possible vulnerabilities and attacks. More information on specific measures enforced can be seen below.
Physical Security
All Community Action Suffolk IT Services are provided in a locked, secured and alarmed building which is monitored by an external security company outside office hours. Servers hosted in the building are also stored in an airconditioned, locked room within the building to provide additional protection.
Server Locations
Wherever possible we will store your data in the UK, the European Economic Area (EEA) or a jurisdiction that complies with the GDPR. The data we collect from you may be transferred to, and stored at, a destination outside of these areas. When this is the case we will take steps to ensure that appropriate security measures are taken with the aim of ensuring that your privacy rights are protected as outlined in this notice.
If you use our services while you are outside the EEA, your information may be transferred outside the EEA to provide these services.
Software Security
Community Action Suffolk has a hardware firewall over it’s router to protect users against online threats. All computers within the Community Action Suffolk network are protected with business class Internet Security Software.
Any sensitive client data that Community Action Suffolk stores i.e. login passwords to systems are stored in password and credential based systems which only the IT team has access to.
Wifi Security
Community Action Suffolk enforces WPA2 password security methods to protect it’s wireless networks against threats.
Website Security
This website and all websites owned by Community Action Suffolk are protected with a “SSL” encrypted certificate.
However, we cannot warrant the security of any information that you send us. There is no guarantee that data may not be accessed, disclosed, altered, or destroyed by breach of any of our physical, technical, or managerial safeguards.
6. Who can you contact if you wish to make a complaint?
In the event that you wish to make a complaint about how your personal data is processed by Community Action Suffolk (or the third parties we work with), or how your complaint has been handled, you have the right to lodge a complaint directly with Gateway Qualifications’ data protection representative.
The details for each of these are:
Community Action Suffolk
Chris Abraham
Chief Executive
Brightspace
160 Hadleigh Road
Ipswich
IP2 0HH
[email protected]
01473 345400
The supervisory authority in the UK is the Information Commissioner’s Office (ICO) and guidance on how to contact them is available online at https://ico.org.uk/concerns/. Alternatively, they can be contacted as follows:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Tel: 0303 123 1113 (local rate) or 01625 545 745 if you prefer to use a national rate number
Fax: 01625 524 510
