Privacy Policy

1. Introduction

This policy summarises how Harbour collects and uses personal information about the people who visit our websites or give us their data over the telephone, face to face in person, and in writing, as well as how we store data, how we use it, and how those who give us their details can request that their data is used by Harbour.
We take the privacy of those who access our service, supporters, staff, partners and volunteers very seriously and are committed to protecting your privacy. Harbour’s privacy statement is outlined in section 2 of this policy.

Harbour is registered with the Information Commissioner’s Office, registration no: Z5395116. If you have any queries about this policy, please contact our Governance Team – contact details given at the end of this document. The terms of this policy may change, so please check it from time to time.

2. Harbour’s Privacy Statement

The General Data Protection Regulations (GDPR) provides the legal framework that defines how personal information can be used. Harbour is fully committed to complying with GDPR and has a legal duty to protect any information we collect from you. We ensure;

Your personal information is only used for the purpose for which we collect it
Only information that we actually need is collected
Your personal information is only seen by those who need it to do their jobs
We will not pass your personal information on to any other organisation without your consent unless we are required to do so by law (see “How do we use this Information?” below)
Personal information is retained only for as long as it is required for the purpose collected
We will, where necessary, keep your information up to date
Your information will be protected from unauthorised or accidental disclosure
We will provide you with a copy of your personal information on request (please see below for information on access rights and requests)
Inaccurate or misleading data will be corrected as soon as possible
These principles will apply whether we hold your information on paper or in electronic form.

3. How do we collect information?

We obtain personal information from you when you enquire about our activities, make a referral to our services, send or receive an e-mail, donate to us, ask a question, meet and or receive support from us, provide feedback on our or other organisations’ services or otherwise provide us with personal information. We may also receive information about you from third parties; for example, from another organisation who wants to make a referral on your behalf or a relative who asks for information to be provided.

Where you ask us to provide a specific service, and there is no other lawful basis for collecting the info, you may be asked to give consent to your data being collected. This may be verbally, online or by signed consent form, and this particularly relates to sensitive information you may not want shared. However, even if you have not formally given consent, we may still collect personal information as outlined in the next section.

What information do we collect?

The personal information we collect might include name, e-mail address, postal address, and date of birth, next of kin, telephone number and the nature of your enquiry. We may also collect sensitive personal information such as equality and diversity information required to allow us to review whether our services reach all sections of the community (which may be due to a contractual obligation under any funding we receive for providing the service), and information about your support needs which may include details of a personal nature, such as your current or background health and offender information if this is required for the purpose you are involved with Harbour.

We also gather general information about the use of our website and social media platforms, such as which pages users visit most often, and which are of most interest. We may also track which pages users visit when they click on links sent in e-mails.

We may use this information to personalise the way our website is presented when users visit it, to make improvements to our website and to ensure we provide the best service for users. We will only use aggregated or anonymous information which does not identify individual visitors to our website. Please see the section below on Cookies.
We may also take photographs from time to time; these will only be taken and used with your consent.

5. How do we use this information?

For people who have contacted us for support directly, or been referred to us by another person or organisation, or because they are involved with one of our services, we will only use the information provided to facilitate our work with you and to record information required by the organisation that funds us for the work (such as a local authority), as well as for internal administrative purposes such as monitoring the quality of our service.

We may, however, contact you to ask for your assessment of how we helped you and your satisfaction with the service provided, or other market research. We will not publish any information that could identify you personally without your consent.

If you are kind enough to give a donation or indicate your support for us such as by giving a compliment, then we may contact you to thank you, or to obtain your permission to publicise details of your particular case or feedback; but not any details that identify you without your consent.

We will not contact you otherwise unless with your express permission.

We will not share your information with other parties other than for the purposes of providing a service, although we may be required to share information with the council or other organisation that is funding us to provide the service. In addition, we may have a legal responsibility to share information in connection with your welfare or the welfare of people around you – see our Confidentiality Policy.

Finally, we will share information regarding any crime committed against us, our staff or anyone else acting officially on our behalf.

If we do share your information outside of these circumstances, we will ensure you have provided consent to enable us to do this, for example when a service transfers to another provider, or if you have agreed specific information can be used for a particular purpose.

5.1 Consent to PHE NDTMS

What NDTMS is and does: NDTMS is the National Drug and alcohol Treatment Monitoring System (NDTMS). It is used by PHE to collect information about drug and alcohol treatment in England. If you consent, your treatment service will share some of your treatment information with NDTMS.

What information NDTMS uses and why: PHE collects some personal information about people in treatment including your initials, date of birth, gender, a clinic or national prison ID number unique to you, the local authority area in which you live and the first part of their postcode. This reduces the risk of you being counted twice. This information is only shared with PHE if you agree. PHE never contacts service users.

your full name and address are NOT passed on to PHE
no identifiable information held on NDTMS is passed on to the police or criminal justice agencies
your information is held on NDTMS for at least 8 years and in some cases longer where required for a purpose

¹¹ https://www.gov.uk/government/publications/confidentiality-guidance-for-drug-and-alcohol-treatment-providers-and-clients

The information is used to understand how many people are using these treatment services, how good they are at helping people with substance misuse issues, to help improve them and produce statistics and research about drug and alcohol use and treatment.

How NDTMS will protect your information: the security of the data you provide to NDTMS is of utmost importance and PHE staff are bound by law to protect the confidentiality of the information they collect and use. The personal information held is kept to a minimum and PHE makes sure that staff can only see the information that is required to do their job.

Sharing and linkage of NDTMS information: some information from NDTMS is cross referenced with data from other government departments and reports are sent back to them so that they can monitor the effectiveness of the national drug and alcohol strategies. Any data matching with other government departments is undertaken by PHE and at no point is your personal information, shared with other government bodies. In addition, sometimes you may be seen by more than one agency and to assist with treatment outcomes profiles (TOP), NDTMS may share TOP information about you between the agencies from which you may have received treatment.

If you do not want information about you to be passed on to NDTMS then you have the right to say this or ask for your treatment information at your current treatment provider to be removed. This will not have any impact on the treatment you receive. You will be provided with a copy of the NDTMS Patient Information Leaflet at referral or can ask your keyworker for a copy of the leaflet for more information.

5.2 For volunteers and members

We will use your personal information:

Complying with our legal obligations
Providing relevant information about our work,
Contacting you to promote our events, products and services.
Providing and personalising our services to beneficiaries
Conducting market research
For administrative purposes such as to record information on your volunteering activity

We may need to share your information with our service providers, associated organisations and agents for the purposes described above.

5.3 For employees

Please refer to our separate Employee Privacy Statement

5.4 For Job Applicants

We will use your personal information in order to process your application and if applicable invite you for interview. If you are not successful in your application, your information will be kept for a maximum of 6 months after the application in case of query, then it will be deleted from all records. If you are successful the paperwork will form part of your employment records see separate Employee Privacy Statement.

6. Your choices on receiving information

You have a choice about whether you want to receive information about our work and fundraising activities. We will not use your personal information for marketing purposes if you have indicated that you do not wish to be contacted. You can change your communication preferences (such as e-mail or post at any time), by contacting the relevant service contact.

7. Access Rights and Requests

You have the right to see what personal data we hold about you. Subject access requests must be submitted in writing. Please use our Subject Access Request Form to ensure you supply all the information we need to process your request. You can also use this form if you are requesting information on behalf of somebody else.

You may also request a right to be forgotten by requesting your identifying information is deleted.

If you are receiving a service from us, we may have a business need to retain some personal information to continue to offer you the service. If this is the case you will be informed of the information we will be keeping and our grounds for keeping it in the response to your request to be forgotten.

You also have the right to rectification, if any of the information we hold about you is incorrect. To obtain a copy of the personal information we hold about you, or request your information is deleted please write to us or submit your form to the Data Protection Officer – contact details at the end of this document.

8. Transfer of Information

We confirm that any information we hold about you is stored and transmitted within the United Kingdom and the European Economic Area and will not be transferred outside these areas, unless stated in our specific privacy statements.

9. Right to prevent processing of your personal data

If you believe we are processing incorrect data or have any other data related query, you can request a temporary stop on us processing your data until it is satisfactorily restored.

10. Under 16s

Where appropriate, we will seek consent from a parent or guardian before collecting personal information about a child aged under 16. However, where we are supporting a young person directly, any information will only be shared with their consent.

11. How do we protect personal information?

We take appropriate measures to ensure that the personal information disclosed to us is kept secure, accurate, and up to date. We will ensure that your personal
Page 6 of 8 Harbour Privacy Policy v1 November 2019 information is kept only for so long as is necessary for the purposes for which it was collected and is securely destroyed in accordance with our Data Retention Policy.

Personal information is stored online using secure hosted servers. Our online contact process is protected by digital encryption. We also use a secure server when you make a donation or payment via our website.

12. Will we disclose the information we collect to outside parties?

We do not sell any personal details to any other third parties.

We will only disclose data when obliged to disclose personal data by law, or the disclosure is ‘necessary’ for purposes of national security, taxation, legal compliance and criminal investigation, or we have your consent.

We will not sell any information about your web browsing activity.

13. Deleting personal data

Our standard retention periods for personal information can be found in our Data Retention Policy.

By personal information we mean any information that could identify you as an individual or could be used to inform any decision about you. When we no longer need to keep your personal information, we will delete or securely destroy your contact details, any associated documents, and any other information that could identify you personally. We may keep other information about your case where this cannot identify you personally but is required for contractual or operational reasons. By deletion we mean put “beyond use” as defined by the Data Protection Information Commissioner’s Office guidelines.

14. Cookie Usage

Harbour website uses cookies, tracking pixels and related technologies. Cookies are small data files that are served by our platform and stored on your device. Our site uses cookies dropped by us or third parties for a variety of purposes including to operate and personalise the website. Cookies help us to provide you with a better experience by allowing us to understand what areas of the website are of interest to our visitors (e.g. via Google analytics https://policies.google.com/privacy?hl=en).

Our cookies aren’t used to identify you personally. They collect anonymous information on the pages visited and we do not use advertising cookies. Most browsers will allow you to turn off cookies. Please note however that turning off cookies will restrict your use of our website. To learn more about cookies and how to manage them, visit AboutCookies.org

15. Trademarks and copyright

Harbour’s website contains material which is protected by copyright and/or other intellectual property rights. All copyright and intellectual property rights including the names, images and logos are owned by Harbour unless otherwise stated. All rights are reserved.

You are responsible for complying with all applicable copyright laws. We permit you to make copies of information on Harbour website as necessary incidental acts during your viewing. You may take a print, for your personal use, of as much of the site as is reasonable for private purposes. All other uses are prohibited. Nothing in these terms shall be construed as conferring any right to use any trademark, logo, patent right or copyright of Harbour.

16. Your consent

By providing us with your personal information, including sensitive information such as medical details, you consent to the collection and use of this information in accordance with the purposes described in this policy.

Harbour may be funded to provide local services which have specific contractual requirements on how data is used. Reference to these may be made on the individual Privacy Statement you are asked to sign when you first join us as a client, member, hirer, service user, volunteer or staff member.

If you complete a referral form, or contact us about a third party, we expect you to have the consent of the person concerned and, unless they lack capacity, we will need their consent to proceed further.

17. Links

Our website may include links to websites run by other organisations. Harbour is not responsible for the privacy practices of these other websites so you should read their privacy policies carefully.

18. Changes

If your personal details change, please help us to keep your information up to date by notifying your contact or other relevant staff member.

We may change the terms of this privacy policy from time to time. If we do so, we will publish the revised policy on Harbours website so please check from time to time. By continuing to use our websites you will be deemed to have accepted such changes.

19. Data Protection Regulator

Further information and advice about data protection is available from:
The Office of the Information Commissioner Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF
Tel: 0303 123 1113
Website: www.ico.org.uk

20. Further information or specific requests

For further information or specific requests relating to this statement please contact:
Governance Team Harbour
Hyde Park House
Mutley
Plymouth
PL4 6LF
Tel: 01752 434343
E-mail: thcpltd.dpo@nhs.net