Your Emotional Support Service Privacy Notice
This Privacy Notice explains how your data is processed by Your Emotional Support Service (YESS), and our legal basis for doing so. This notice also covers the types of personal data we may collect and how we keep it safe.
We are responsible for the information we hold and we ensure that the information is used and stored in line with the legal requirements set out by the General Data Protection Regulations (GDPR).
As an organisation we collect and process some personal information as a Data Controller. In order to enable us to carry out our service we may need to instruct other organisations to act as a Data Processor for some functions. In these situations, any other agencies who work with us will be under a legal duty to comply with GDPR.
The law on data protection sets out a number of different reasons for which an organisation may collect and process your personal data. YESS have identified that the information we hold is done lawfully under the following lawful reasons:
· Legal compliance
· Legitimate interest
· Special Category Data
When do we collect your personal data?
· When you are referred to us for therapy
· When you join our Youth Participation scheme
· If you commission our services
· If you are employed by YESS
· When you contact us by any means with queries, complaints etc.
· When you’ve given a third party permission to share with us the information they hold about you.
What sort of personal data do we collect?
· If you have been referred into our service: your name, gender, date of birth, home address, email and telephone number, overview of mental health issues.
· Details of your interactions with us through client contact records and clinical notes
· Copies of documents you provide to prove your age or identity where the law requires this. (Including your passport and driver’s licence). This will include details of your full name, address, date of birth and facial image. If you provide a passport, the data will also include your place of birth, gender and nationality.
How and why do we use your personal data?
· Deliver services and understand your needs
· Maintain and update your records or contact details
· Contact you where necessary
· Obtain your opinion and feedback about the services we provide
· Ensure that we fulfil our legal obligations
Managing personal data
· We are responsible for managing the information we hold. We take our responsibilities seriously and aim to use personal information fairly, correctly and safely in line with the legal requirements set out by the General Data Protection Regulations (GDPR).
· Any organisations that process personal information on behalf of YESS, or with whom we share information, also have the same legal obligation to comply with GDPR and will have a set of data protection clauses included in their contract or other form of agreement.
· The amount of time data is kept before being disposed of will vary depending on why it was collected, how it is used, and in line with any applicable UK laws. Our retention policies give details of how long we will keep data for.
How we share your data
There may be occasions where we identify a need to share information with other agencies. In these instances we will only share with other organisations if we have obtained your consent, or unless we are legally required or enabled to share it.
At no time will your information be passed to organisations external to YESS for marketing or sales purposes or for any commercial use without your prior explicit consent.
What are your rights?
Under the GDPR you, as the Data Subject, you have the right to:
· Be informed about our collection and use of personal data and our legal basis for doing so.
· Access the information we hold about you. This information is usually provided free of charge but we may make a charge in circumstances specified in the regulations.
· Request that we rectify inaccurate or out of date factual information about you.
· Request that records we hold about you are erased.
· Restrict processing of the information we hold about you if you have an objection to that processing, whilst your objection is investigated.
· Request information you have supplied to us to be provided to you in machine-readable format so that it can be transferred to a third party
· Object to processing of your personal information including automated decision making and profiling.
· Make a complaint or raise a concern to a supervisory authority if you are not satisfied with how the information held about you, or an information request, has been handled.
How to contact us