Privacy

POSSABILITY PEOPLE PRIVACY POLICY                           

Written: 09 May 2018                Last revised: 01 August 2023

Possability People is committed to maintaining your confidence and trust and to protecting the privacy of your information. That is why we want to be completely transparent about how we process your personal information.

When we talk about Possability People “we”, ‘’our’’ or ‘’us’’ in this policy, we are referring to Possability People, Registered Charity No. 1114435 and registered company number 05706441, and Possability People Trading Limited 7961915 whose main office is at Montague House, Montague Place, Brighton, BN2 1JE.

We will process and protect your personal information as set out in this Privacy Policy, so please read it carefully.

If you have any questions about this Privacy Policy and how we process and protect your information you can contact us by:

Post:

Data Protection
Montague House
Montague Place
Brighton
BN2 1JE

or

Email: hello@possabilitypeople.org.uk

Phone: 01273 89 40 40

To make this Privacy Policy easy to find, we make a link to it available on our homepage.

Possability People is registered with the UK’s Information Commission as a Data Controller (registration no. Z9038561).

CHANGES TO THIS PRIVACY POLICY

We may modify this Privacy Policy at any time, however, if we make any material changes to it we will revise the date at the top of the policy and provide you with notice either via post or via sending you an email so that you have the opportunity to review the changes before they become effective.

YOUR RESPONSIBILITY TO INFORM US OF CHANGES

It is important that the personal data we hold about you is accurate and current. Please keep us informed should your personal data change during your relationship with us. You can do this at any time by contacting us by post or email or phone (as set out on the first page) if you (i) need to inform us of any personal data changes during your relationship with us or (ii) object to any changes. 

WHAT INFORMATION DO WE COLLECT FROM YOU?

Personal data or personal information, means any information about you from which you can be identified (“Personal Information”). It does not include data where the identity has been removed (anonymous data).

We use different methods to collect data from and about you, including through:

Direct Interactions

This means Personal Information collected directly from you when you use our services or website. For example we will collect:

Advice Centre: contact info (i.e. information such as name, address, telephone number, email address, date of birth, age); medical details (i.e. information relating to health conditions, medication, GP details, consultant letters); benefit details (i.e. information relating to personal budget plans, awards, grants, benefit application forms, HMRC forms, National Insurance, tax credits, council/local authority benefits, Council Tax); care plans; support needs; personal finances (i.e. information relating to your debts such as utility bills); appointee details; key worker details; details of agencies you get help from.

At Home: contact info (i.e. information such as name, address, telephone number, email address, date of birth, age); family and friends contact information; daily living activities (i.e. information relating to your condition, hobbies and interests, how you travel around the city); medical details (including any medication you take); support requirements (i.e. information relating to how you move around the house and other services you use) Support plan from referrer e.g. L.A or CCG, mental capacity assessments/information around DoLs, Information around resuscitation/living wills etc., Letters and info from other professionals involved; Data from solicitors, for example when they hold guardianship, Funding/financial information; Information about hospital admissions past/current.

Community Employment Services: contact info (i.e. information such as name, address, telephone number, email address, date of birth, age); CV details, NI number, skills, access requirements, next steps and action plans, health impairments, work and home relationships.

Get Involved Group: contact info (i.e. information such as name, address, telephone number, email address, date of birth, age).

It’s Local Actually: Contact information (name, phone number, email address) for people running activities or services as well as the email address of person registering with the site.

Hospital Discharge Support Service: contact info (i.e. information such as name, address, telephone number, email address, date of birth, age); family and friends contact information; daily living activities (i.e. information relating to your condition, hobbies and interests, how you travel around the city); medical details (including any medication you take); support requirements (i.e. information relating to how you move around the house and other services you use) Details of other services involved past/present, Possible details relating to hospital admission past/current, Letters from allied health/social care professionals.

Mental Health Lived Experience Advisory Group: contact info (i.e. information such as name, address, telephone number, email address, date of birth, age).

Membership: contact info (i.e. information such as name, address, telephone number, email address, date of birth, age).

PA Noticeboard: 

The PA Noticeboard is for information purposes only to help PAs find work and to help employers find PAs more easily.

For PAs

Your name and preferred method of contact details will only be visible to registered users of the site and will only be used by employers to contact you regarding your suitability for their vacancy.

For Employers

Your name and preferred methods of contact details will only be visible to registered users of the site and will only be used by PAs to contact you regarding your vacancy.

The information on PAs is only to be used for your own purposes and relevant to finding a PA.

You must not divulge personal details of PAs to any other sources.

PA Noticeboard uses Google Analytic to collect information about our visitors and analyse traffic on our site.

Please see cookie policy for further details.

Payroll Service & Supported Bank Account (SBA) Service: contact info (i.e. information such as name, address, telephone number, email address, date of birth, age); National Insurance Number, PAYE details, bank account details, Unique Tax Reference, Personal Assistant’s fit notes and MATB1 certificates.

Reception: contact info (i.e. information such as name, address, telephone number, email address, date of birth, age).

MSK Social Prescribing Service: contact info (i.e. information such as name, address, telephone number, email address, date of birth, age); family and friends contact information; daily living activities (i.e. information relating to your MSK condition, hobbies and interests, how you travel around the city); medical details (including any medication you take); support requirements (i.e. information relating to how you move around the house and other services you use).

Shopmobility: contact info; (i.e. information such as name, address, telephone number, email address, date of birth, age) payment card details (which are not saved).

Website & Newsletter Registration: contact info; (i.e. information such as name, address, telephone number, email address); card payment details (when using our online donation service).

Special categories of Personal Data

We do not actively process any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data, however in some cases we are obliged to provide Equal Opportunities information. This is not directly linked to your Personal Information.   To the extent that we process any data concerning your health we will only do so with your consent.

Automated technologies or interactions

If you visit our website we may automatically collect Personal Information about your equipment, browsing actions and patterns. For example, we collect information which may include your IP address, the browser type, your location, language preferences, device information and access times. We collect this personal data by using cookies, pixel tags and other similar tracking technologies. The sole purpose of passively collecting your information is to improve your experience when using our services.

Cookies

We may also receive Personal Information about you if you visit other websites employing our cookies. Please see our cookie policy for further details

Third Parties

Brighton & Hove County Council: Care plans which contains personal information about you name and address date of birth, Information about your circumstances and your direct payment budget.  You will be asked for consent for this information to be passed to us.

Just Giving: contact info; (i.e. information such as name, address, telephone number, email address, date of birth, age) payment card details(which are not saved).

Care Unbound (HERE): Contact info; the reason for making the referral e.g.  Information about your condition.  You will be asked for consent for this information to be passed to us.

DWP: We will ask for written prior consent; Information about awards, back payments upcoming medical assessments and any relevant appointments.

HMRC: We receive an authorisation code from HMRC as your agent. This enables us to share information with HMRC such as; contact info, financial info (e.g. overpayments, underpayments), PAYE reference and accounts office reference, bank account details (for SBA holders), Statutory Maternity Pay, Tax and NI information.

Money Works: contact info; information about current circumstances such as current benefits and housing situation.  You will be asked for consent for this information to be passed to us.

MS Society: contact details, name address telephone number and email address.

Royal Sussex County Hospital: contact info including the details of your next of kin contact info.   Housing information such as do you live alone and any risks.  You will be asked for prior consent before they pass the information to us.

Tribunal Service: We will have access to your tribunal bundle only with your prior written consent.

Your GP: We will have access to your medical information only with your prior written consent.

Warmth for Wellbeing: Your contact details and information about your housing tenure.  You will be as for prior consent.

Stripe Inc.: contact info; (i.e. information such as name, address, telephone number, email address, date of birth, age) payment card details(which are not saved).

For details of how third parties process your Personal Information please see the section below.

Links to other websites

The website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you.  Linked websites are responsible for their own privacy practices and you should check those websites for their respective privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.

When we receive personal data about you from third parties and public sources we will comply with all necessary data protection obligations.

WHAT HAPPENS IF YOU DON’T PROVIDE US WITH YOUR PERSONAL DATA 

If you don’t provide us with Personal Information when required it may mean that we cannot provide you with our services.  For example, if you don’t provide us with contact information, medical details, benefit details we may not be able to provide you with the correct advice regarding benefits, independent living support such as payroll and supported bank account facilities, or events in the community.

If someone lacks capacity to make decisions on giving consent and does not have a person appointed to make decisions on their behalf – a Lasting Power of Attorney (England and Wales) or Power of Attorney and Welfare Guardianship (Scotland), we will make a decision to process the personal data under legitimate interests.

HOW DO WE USE YOUR PERSONAL INFORMATION?

We will only use your information where we have a legal right to do so and will always respect your rights.  We have set out below a table setting out the different ways we process your Personal Information and the legal basis for this.

Please contact us by using any of the methods set out on the first pageif you need details about the specific legal basis we are relying on to process your personal data.

Purpose/Activity/Service	Legal Basis
Advice Centre	Consent
At Home	Consent
Community Employment Service	Consent
Hospital Discharge Support Service	Consent
Membership	Consent
Reception	Consent
MSK Social Prescribing Service	Consent
Payroll Service & Supported Bank Accounts	Necessary for the compliance with a legal obligation to which we are subject.
Supported Bank Accounts	Necessary for the performance of a contract
Shopmobility	Legitimate Interests
To maintain and retain records in connection with legal claims and regulatory investigations; and for governance & compliance purposes.	Necessary for the compliance with a legal obligation to which we are subject.
If required to do so by any applicable law, search warrant, subpoena or court order, or by any regulation, treaty or other legally binding obligation with which we (or any company or trust within Possability People) is required to comply.	Necessary for the compliance with a legal obligation to which we are subject.
To send you information we think may be of interest to you, promotional messages, marketing, advertising and other such information.	Consent
For the purposes of administering the website	Consent

 

CONSENT

By agreeing to this Privacy Policy you are consenting to us processing and protecting your Personal Information in accordance with this Privacy Policy.

Legitimate Interest

For more information about the legitimate interests (i.e. the purpose and need) we have to use and protect your Personal Information (and how we balance this against your rights and freedoms) please see the forms at the end of this Privacy Policy.

For further information please contact us.

 

File retention and destruction

 Any document originally created electronically and maintained in electronic form thereafter (for example, emails), is part of the file. The firm’s computers will be  scanned to ascertain whether a particular file contains such documents. If such documents are found they will be either printed to hard copy and placed in the file or segregated to an electronic file and maintained for the retention time period determined for that client’s file generally.

 

 

Statutory retention periods are as follows:

Client records

6 years after last contact plus current financial year (Payroll) 6 years after the last contact (Advice Centre) 3 years after last contact (other services)

 

HOW DO THIRD PARTIES USE YOUR PERSONAL INFORMATION?

In order to provide you with our services, we may need to give your personal data to third parties who will process your data on our behalf, as set out in the table below.

For example, in order to process your payroll and supported bank account payments we need to share your information to Brighton & Hove City Council, DWP and HMRC.

We require all third parties to respect the security of your Personal Information and to process it in accordance with the law. We do not allow our third party service providers to use your Personal Information for their own purposes and only permit them to process your Personal Information for specified purposes and in accordance with our instructions.

Google analytics is used for www.possabilitypeople.org.uk and lt’s Local Actually.

We do not sell or exploit your Personal Information commercially by giving it to third parties and we will not sell, rent, distribute or otherwise make Personal Information available to any third party without your prior permission.

You can request for our full list of third parties who process your data by using any of the methods set out on the first page. For your information the following are some examples of how third parties process your personal data:

Advice Centre		Advice Quality Mark (AQS) http://advicequalitystandard.org.uk/ Tamar House 7 Tavis House 1 Tavistock Square London WC1H 9NA	Consent
Hospital Discharge Support Service	Royal Sussex County Hospital www.bsuh.nhs.uk Eastern Road Brighton BN2 5BE		Consent
Payroll & Supported Bank Accounts	Brighton & Hove City Council www.brighton-hove.gov.uk Hove Town Hall, Norton Road, Hove BN3 3BQ		Necessary for the compliance with a legal obligation to which we are subject. Necessary for the performance of a contract
Payroll & Supported Bank Accounts	HMRC www.gov.uk/government/organisations/hm-revenue-customs/contact Guildbourne House, Chatsworth Rd, Worthing BN11 1LD		Necessary for the compliance with a legal obligation to which we are subject. Necessary for the performance of a contract
Payroll & Supported Bank Accounts	NEST Corporation www.nestpensions.org.uk Riverside House, 2A Southwark Bridge Rd, London SE1 9HA		Necessary for the compliance with a legal obligation to which we are subject. Necessary for the performance of a contract
Payroll & Supported Bank Accounts	Prepaid Financial Services www.prepaidfinancialservices.com Registered Office: Fifth Floor Langham House 302-308 Regent St London W1B 3AT		Necessary for the compliance with a legal obligation to which we are subject. Necessary for the performance of a contract
MSK Social Prescribing Service	Care Unbound www.hereweare.org.uk 177 Preston Road, Brighton BN1 6AG		Consent
Shopmobility	Booking Bug www.bookingbug.co.uk   2nd Floor, 3-7 Herbal Hill Farringdon London EC1R 5EJ		Consent

 

YOUR RIGHTS IN RELATION TO YOUR PERSONAL INFORMATION

You have rights under data protection laws in relation to your personal data, in particular under the General Data Protection Regulation (GDPR) you have the following rights:

1. To request access to your personal data (commonly known as a “Subject Access Request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
2. To request confirmation as to whether or not your personal data is being processed.
3. To request the correction of your personal data that you consider to be inaccurate. This enables you to have any incomplete or inaccurate data we hold about you corrected. However, we may need to verify your identity and the accuracy of the new data you provide to us.
4. To request erasure of your personal data. This enables you to ask us to delete or remove personal data, for example: (i) where there is no good reason for us continuing to process it; (ii) where you have successfully exercised your right to object to processing (see below); (iii) where we may have processed your information unlawfully; (iv) where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons. These reasons will be notified to you at the time of your request.
5. To object to processing of your personal data. This enables you to object to the processing of your personal data if you feel it impacts on your fundamental rights and freedoms. For example, this
6. can be where we are processing your personal data for direct marketing purposes. In some cases, we may have compelling legitimate grounds to process your information which can override your right to object.
7. To request restriction of processing your personal data. This gives you the option to ask us to suspend the processing of your personal data in the following scenarios: (i) if you want us to establish the data’s accuracy; (ii) where our use of the data is unlawful but you do not want us to erase it; (iii) where you need us to hold the data, even if we no longer require it e.g. to establish or defend legal claims; or (iv) you have objected to our use of your data but we need to verify whether we have overriding legitimate ground to use it.
8. To request transfer of your personal data. If you request us to do so, we will provide to you, or a third party of your choice, your personal data in a commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use, or where we have used the information to perform a contract with you.
9. To withdraw consent to the processing of your data. If you request us to do so, we will no longer process your data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we will not be able to provide the Services for you. Also, we will advise you of this at the time you withdraw your consent.
10. To not have a decision made about you based solely on automated processing

HOW DO I REQUEST INFORMATION?

If you wish to exercise any of the rights set out above you will need to complete the Subject Access Request (SAR) form or if you require it posted or in a different format please contact 01273 894040 or email hello@possabilitypeople.org.uk.

The form helps us respond quickly by indicating what information you think we may hold and why you think we hold Personal Information about you.

We will respond to you within 30 days of receipt of your request. Occasionally it may take us longer than 30 days if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

You will not have to pay a fee to access your personal data (or to exercise Your Rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

HOW DO WE USE YOUR PERSONAL DATA FOR MARKETING?

Marketing by us: We may use your Personal Information to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which services and events may be relevant for you (we call this marketing).

You will receive communications from us if (i) you have requested information from us; or (ii) if you provided us with your details when you sought advice from us; or (iii) registered for an event; and, in each case, you have not opted out of receiving marketing.

MARKETING TO THIRD PARTIES

We do not share your personal data with third parties, however, we do use third parties to provide us with these services.

HOW DO I UNSUBSCRIBE FROM MARKETING AND COMMUNICATIONS?

You can ask us to stop sending you electronic messages (e.g. emails) at any time by (i) clicking the unsubscribe links on any electronic message sent to you; or (ii) contacting us using the methods set out on the first page.

Just to let you know, should you choose to unsubscribe from receiving electronic message we may not be able to provide you with essential information regarding your use of our services. For example, we can’t remind you of changes to our services such as opening times of our Advice Centre, or of meetings which you might want to come to.

HOW DO WE KEEP YOUR PERSONAL INFORMATION SECURE?

We have put in place appropriate security measures to prevent your personal data from being lost, altered or disclosed, used or accessed in an unauthorised way. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know it. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

DOES YOUR PERSONAL INFORMATION GO OUTSIDE OF THE EEA?

The sites hosted for us by Bright Minded (www.possabilitypeople.org.uk, all the PA Noticeboards and It’s Local Actually) are all hosted at data centres in London or Ireland.

Data and emails within Microsoft Cloud are all stored on EEA servers.

If we use third party service providers that are based outside the European Economic Area (EEA) and this will involve the transfer of your personal data outside the EEA. As a result, the transferred data may not be processed and protected in the same way as set out in this Privacy Policy. You need to be aware that if your information is transferred to a country outside the EEA, that country may not have adequate data protection laws or appropriate safeguards.

However, when we transfer your personal data out of the EEA, we endeavour to ensure that a similar degree of protection is afforded to it by implementing at least one of the following safeguards:

• By transferring personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission.
• Where we use certain service providers, we may use specific contracts approved by the European Commission which give personal data the same protection it has in Europe.
• Where we use providers based in the US, we may transfer data to them if they are part of the Privacy Shield which requires them to provide similar protection to personal data shared between the Europe and the US.

Please contact by using one of the methods set out on the first page if you want further information on the specific mechanism used by us when transferring your personal data out of the EEA.

HOW LONG DO WE KEEP YOU PERSONAL INFORMATION?

We will only retain your Personal Information for as long as necessary to fulfil the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for Personal Information, we consider the amount, nature, and sensitivity of the Personal Information, the potential risk of harm from unauthorised use or disclosure of your Personal Information, the purposes for which we process your Personal Information and whether we can achieve those purposes through other means, and the applicable legal requirements.  At the moment we consider this to be 3 years from last contact and 6 years to maintain and retain records in connection with legal claims and regulatory investigations; and for governance & compliance purposes.

In some circumstances we may anonymise your Personal Information (so that it can no longer be associated with you) for compliance, governance, legal and/or regulatory purposes in which case we may use this information indefinitely without further notice to you.

PROCESSING YOUR DATA FOR OTHER PURPOSES

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason, and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us by using one of the methods set out on the first page.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

CAN I MAKE A FORMAL COMPLAINT?

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so, in the first instance, please contact us by using one of the methods on the first page.