Privacy Policy The Josephine and Jack Project (Reg Charity Number 1169241) Privacy Policy 2019 To request an easy-read version of our Privacy Policy, please email [email protected] The data controller is The Josephine and Jack Project (JJP) at Good Space, Second Floor, Commercial Union House, Pilgrim St, Newcastle Upon Tyne NE1 6QE. At Trustee level, Claire Murphy-Morgan ([email protected]) is responsible for overseeing the policy and at operational level, it’s Simon James, Chief Executive: [email protected] Please direct any comments or queries to Simon in the first place. Purpose and legal basis When you give us your personal data we will use it in the following ways: to fulfill our contract with you as a user of our services and to keep you safe to send you information you have consented to receive to fulfill our legitimate organisational interests And in particular to send you: the occasional newsletters you have told us you want to receive information about Josephine and Jack courses and from other organisations who we think we will be of interest. for internal record keeping and research purposes and to improve our services JJP will not use your data for automatic profiling; nor will we share your details with any third party, including internationally, without your explicit consent, and then only in line with our safeguarding policy. JJP does not hold any special categories of data for our subscribers, or for any attendees at courses run by us, or that we are hosting with partners. Data Retention Policy We hold data only for as long as it is necessary and useful. We review all of the information we hold every year and destroy anything that is no longer needed or is not up to date. We always destroy data if you have withdrawn your permission for us to hold it. If we need to keep data indefinitely, this will be anonymized so that you cannot be identified. We keep most data for a maximum of 7 years. Special Categories Some categories of data have stricter rules about how we can collect and store them. These are: Racial and ethnic origin Political opinions Religious or philosophicalbeliefs Trade Union membership Data on health, sex life orsexual orientation Genetic or biometric data Occasionally, JJP may collect this data to monitor and research how inclusive our work is. We will only collect this data with your explicit consent, and it will always be anonymous. Your rights Under the Data Protection Act 2018 you have the following rights, the table below explains what they mean and how we will respond: Your right What this means How we will respond Right to beinformed You should be informed of how your data is collected,stored and processed in a clear, accessible way We provide this in our PrivacyStatements and by request Right of access You can request access to a copy of their data in electronic form and details of how it is processed We will provide this, for free, within one month Right torectification You are entitled to have your data corrected if it isinaccurate or incomplete We will do this within one month, two if it is a particularly complex task Right to erasure Also known as ‘the right to be forgotten’, this permits you to request the deletion of your data We will do this within one month, unless we have a strong, valid reason not to Right to restrictprocessing You can request a halt on processing if you object toaccuracy or purpose but we can still hold the data until resolved This should be an immediate, and often temporary, stop Right to dataportability You can request your data in a suitable digital format, sent either directly to you or to a third party We will do this within one month, two if it is a particularly complex task Right to object You can, in certain cases, object to the processing of your data, eg. in direct marketing We will provide reasonable means to object and act on this within one month Rights in relationto automateddecision making and profiling You can object to potentially damaging decisions beingtaken against you based only on automated data processing We will allow you tochallenge and request human intervention You have the right to see what information JJP holds about you (a ‘subject access request’) and to ask for the information to be amended if incorrect. To make this request please email [email protected] Your request will be forwarded to the relevant person in the organisation and will be acknowledged. Your request will be carried out within one month unless there is good reason for this not to be possible. In this event we will contact you and explain why we cannot carry out your request within one month. You have the right to withdraw your consent for us to use your personal data at any time. If you wish to withdraw your consent, please email [email protected] Your request will be forwarded to the relevant person in the organisation and will be acknowledged. All of our regular emails will include an opt-out or unsubscribe link. Your request will be carried out within one month unless there is good reason for this not to be possible. In this event we will contact you and explain why we cannot carry out your request. When making a ‘Subject Access Request’ or withdrawing consent, we may need to ask you to identify yourself to ensure the personal data you are contacting us about belongs to you. You have the right to complain to the Information Commissioner’s Office (ICO). Find out how to report a concern to the ICO. Security We are committed to ensuring that your information is secure. In order to prevent unauthorised access or disclosure, we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the information we collect online. In the unlikely event of a data breach, we will report this to the ICO within 72 hours in accordance with their guidelines. Links to other websites Our website may contain links to other websites of interest. However, once you have used these links to leave our site, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting other sites and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question. Your data may also be available to our website provider to enable us and them to deliver their service to us, carry out analysis and research on demographics, interests and behavior of our users and supporters to help us gain a better understanding of them to enable us to improve our services. This may include connecting data we receive from you on the website to data available from other sources. Your personally identifiable data will only be used where it is necessary for the analysis required, and where your interests for privacy are not deemed to outweigh their legitimate interests in developing new services for us. In the case of this activity the following will apply: Your data will be made available to our website provider The data that may be available to them include any of the data we collect as described in this policy. Our website provider will not transfer your data to any other third party, or transfer your data outside of the EEA. They will store your data for a maximum of 7 years. This processing does not affect your rights as detailed in this privacy policy.