|
Cwm Taf Morgannwg Mind’s Privacy Policy Information We Collect About You Cwm Taf Morgannwg Mind (“we”, “CTM Mind”) collect certain types of information to ensure we can provide the best possible support and services. The information we collect may include:
Please note that this is not an exhaustive list, but it gives you an overview of the types of information we may collect. We treat all the information we collect with utmost confidentiality and in accordance with applicable data protection laws. If you require more specific details about our data collection practices, please feel free to contact us: Email: info@ctmmind.org.uk Phone: 01685 707480 Post: Cwm Taf Morgannwg Mind, 88 High Street, Merthyr Tydfil, CF47 8UG.
How We Use Your Information We will use the information you provide us with to carry out our work, which will include, amongst others, the following purposes:
Sharing of Information We will share information with other organisations only where we have informed you we will do so (for example with a partner organisation), where we are legally obliged to do so (such as HMRC), or where we have gained your consent to do so (such as your GP). In certain circumstances, there may be occasions where it is necessary to share information without your consent with other organisations in accordance with CTM Mind policies, common law and the Data Protection Act 2018 as appropriate. For example, in circumstances where disclosure is felt to be justified in the public interest e.g., to protect you or someone else from harm. In these circumstances, the information shared will always be kept to the minimum necessary. If we do this, you will be informed about who we have shared information with and why.
Legal Basis for Processing Your Data: Compliance with General Data Protection Regulations (GDPR) We are committed to protecting your privacy and handling your personal data in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR). When processing sensitive personal data, we must meet specific conditions outlined by the GDPR. These conditions include obtaining explicit consent, processing data to protect vital interests, providing health or social care services, fulfilling legal obligations, and processing data as a non-profit organisation for legitimate activities. We will obtain explicit consent when necessary, ensuring it is freely given, specific, informed, and unambiguous. You have the right to withdraw your consent at any time. In certain situations, we may process sensitive personal data to protect someone’s life or vital interests, provide health or social care services, fulfil legal obligations, or carry out legitimate activities as a non-profit organisation. Your privacy and the legal basis for processing your data are important to us. Please contact us if you have any questions or concerns.
How We Store Your Personal Information Lamplight CMS Personal information entered onto our Database, Lamplight CMS, is securely stored on servers hosted by Amazon Web Services (AWS), located in the London region. AWS data centres are accredited to ISO27001 and comply with numerous security and Information Governance standards. For more details on compliance, you can visit (https://aws.amazon.com/compliance/).
SharePoint Online We store and manage personal data on SharePoint Online within secure Microsoft data centres located in the European Economic Area (EEA). As the controllers of your personal data, we are responsible for determining how it is processed. Our trusted third-party IT service provider acts as the processor, supplying and managing the SharePoint Online environment while adhering to strict confidentiality and data protection obligations. They only access your personal data when necessary for support purposes as authorised by us. Your data may be transferred and stored within the EEA as part of SharePoint Online’s infrastructure. We do not transfer data outside the EEA without your written consent and ensuring appropriate safeguards, compliance with data protection laws, and following our instructions. We prioritise the security, confidentiality, and compliance of your personal data. By using our services, you acknowledge and consent to the transfer and storage of your data. Just Giving JustGiving is a third-party platform that facilitates online fundraising and donations. It is important to note that JustGiving has its own privacy policy governing the collection, use, and protection of personal data. As an external source, anyone utilizing JustGiving’s services should refer to their privacy policy directly to understand how their personal information is handled. We collect and retain all relevant personal data and donation amounts that individuals input into JustGiving when setting up a fundraising page. This information is stored securely in our SharePoint Online for future reference and potential use in mailing lists. Disposal We take data disposal seriously to ensure the secure and responsible handling of your information. We follow established retention periods for different services, initiatives, and projects that you have engaged with. These retention periods are centrally recorded in our data asset register, which helps us keep track of how long we retain your data. The specific retention period may vary depending on the nature of the engagement, legal requirements, and our operational needs. Once the retention period expires, we will securely dispose of your information in a manner that ensures its confidentiality and prevents unauthorised access or disclosure. Our disposal methods may include secure deletion, shredding of physical documents, or anonymisation of data to remove any personally identifiable information. We regularly review and update our data disposal practices to align with best practices and applicable data protection laws. Security Keeping your personal information safe is very important to us. We have implemented appropriate physical, technical and organisational measures to protect the information we hold from improper access, use, alteration, destruction and loss. Right to Access You have a right, under the Data Protection Act, to request a copy of the information that is held about you. This is known as a subject access request. Subject Access Requests must be made in writing (email requests are acceptable) and there may be a fee involved. We are required to provide the information within one month, unless it is particularly complicated or we receive a number of requests from you, in which case we can extend the time by a further two months. Third party requests, i.e. from insurers or solicitors, must be accompanied by a consent form signed within the last 6 months. Right to Request Rectification and Erasure (Right to be Forgotten) We respect your rights and understand the importance of maintaining accurate and up-to-date personal information. You have the right to request rectification of any inaccurate or incomplete data we hold about you. If you believe that any information we have is incorrect, please let us know, and we will promptly update it. Additionally, you have the right to request the erasure of your personal information, also known as the right to be forgotten. If you no longer wish for us to retain your data and there is no legitimate reason for us to continue processing it, you can request its deletion. However, please note that this right is not absolute and may be subject to legal obligations or other legitimate grounds for retaining your information. To exercise your right to rectification or erasure, please contact us using the details provided at the end of this Privacy Policy. We will review and respond to your request in accordance with applicable data protection laws and regulations. Our Website This section of the policy explains how we secure and use data relating to the website, what information https://ctmmind.org.uk/ (referred to as ‘this website’) collects and how the organisation, Cwm Taf Morgannwg Mind (referred to as ‘we’, ‘us’ and ‘our’) uses that information. Securing your connection to our website This website uses a SSL (Secure Sockets Layer) security certificate to encrypt and protect connections to and traffic on the website. When you are on this website, in the address bar of your web browser, you should see at least one of the following to confirm the secure connection to this website:
It is up to the visitor to this website to ensure their computing devices and software are updated to the latest versions to maximise security. Cookies This website uses cookies to:
You can block these cookies using the appropriate desktop and mobile apps for your software and system.
How Visitors Use this Website We use Google Analytics and page tagging techniques to understand how this website is used by visitors. Find out more what information Google collects, how it uses and protects this information here. The link also provides information as to how you can opt-out of Google Analytics. Google Analytics and this website can collect information such as:
This information helps us:
Contacting Us Via the Website When you contact us through our website by leaving a comment, submitting a form, or clicking an email link, we may collect personally identifiable information, such as your name, IP address, email address, and telephone number. We are committed to collecting only the necessary information needed to address your feedback, messages, comments, or queries. Rest assured that we handle your personal information with utmost care and confidentiality. The collected information is used solely for the purpose of responding to your inquiries. We value your privacy and adhere to applicable data protection laws and regulations. If you have any concerns, please refer to our privacy policy or contact us using the provided contact details.
Contact Us If you would like to know more, or have any concerns about how your information is being processed, or would like to make a subject access request, please contact: Data Controller 88 High Street, Merthyr Tydfil, CF47 8UG Phone: 01685 707480 Email: info@ctmmind.org.uk
Right to Lodge a Complaint If at any time you think there is a problem with the way that we are handling your data you have a right to complain to us through our normal complaints procedure, details of which can be found on our website https://ctmmind.org.uk/contact-us , or by email to info@ctmmind.org.uk You can also complain to the ICO if you are unhappy with how we have used your data. The ICO’s address: Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF
Helpline number: 0303 123 1113 ICO website: https://www.ico.org.uk
|
Download our Privacy Policy here: CTM Mind Privacy Policy
Download our Data Protection Policy here: CTM Mind Data Protection Policy
If you have any questions or concerns about anything contained within these policies, please contact us on 01685 707480 or email info@ctmmind.org.uk.