Advice surgery participants privacy notice

In order to achieve our objectives, we will collect one or more of the following categories of your personal data within the work we conduct. The information below is to provide you with a non-exhaustive list of possible personal information we may request from you. 

• Name(s), Email Address, Phone number
• Job Title, occupation, place of work, employer
• Areas of professional interests
• Information captured in emails, surveys, video calls and other communications with you
• Opinions you have expressed to us which are relevant to the advice surgery and objective to provide guidance
• CharacteristicsPersonal information related to the Equality Act 2010 inclusive of data known as ‘Protected Characteristics’  where directly relevant to supporting effective delivery of the surgeries, for example: accessibility needs, first language 
• Publicly available personal information (e.g. from websites and social media platforms)
• Social media handles and publicly expressed content
• Further information that may assist in our activities for the archiving of information ready for future use

We collect your personal information:

• To gather relevant information to inform our tailored 1-2-1 advice session, so that we can understand your context and questions.
• To send you follow up supporting material and resources, where we have agreed with in advance and gained your permission to do so.
• To contact you if we need to cancel or rearranged your booked session.
• To contact you if you are on the waiting list. 
• To gather and use survey answers which you have completed
• Gaining permission from you to use a quote you have provided in communication with us.
• To gather opinion from you on the work and activities we are conducting.
• To monitor and evaluate the impact and effectiveness of the programme for our funders.
• To inform any ongoing or future communications and support we offer you.
• To respond to and identify your personal information when you submit a data subject rights request.

Collection of your personal information will be via one or more of the following:

• When you register your interest or sign up for the Centre’s advice surgeries via the website or contacting us directly.
• When you complete a Centre survey which may be on the Centre website, via a link we have sent you in an email or direct message, a link to a survey that has been sent on our behalf via an email or other industry newsletter or forum, or a link to the survey from an external website or social media platform.
• When we communicate with you to request direct feedback from you which may be via email, direct message, unified communications or social media platform.
• We collect information from publicly available sources and from individuals who have made us aware of you where we have identified you as a relevant sector stakeholder.

We will only keep personal information for as long as it is needed to fulfil the purpose for which it was collected. Where you indicate to us you no longer wish for us to retain your information, we will delete your information.

We take the security of your information very seriously and have put physical, technical, operational, and administrative strategies, controls and measures in place to help protect your personal information from unauthorised access, use or disclosure as required by law and in accordance with accepted good industry practice. We will always keep these under review to make sure that the measures we have implemented remain appropriate.

We use Google Workspace & Google Cloud Platform for the secure storage of personal information processed by us. Through the use of Google services, the organisation is able to provide a high level of security around the storage of highly sensitive personal data which is captured within a high variety of our activities. You can find further security and compliance information in the Google Compliance Resource Centre, Privacy Resource Centre and the Google Cloud & the GDPR pages.

Your personal data may also be stored with specific third-party services for the minimum period necessary to perform activities with your personal information. Each third-party is subject to contractual and security reviews to ensure adequate and comparative levels of security, we’d expect for ourselves, is provided for the data they process on our behalf. 

The types of third-party providers we use include, but are not limited to:

• Transcription services
• Mass email services
• Communications providers
• Survey platform services
• Client Relationship Management services
• Website services and platform providers
• IT services organisations

Where appropriate, we may share your personal information with our professional advisers including our lawyers and auditors, project partners, industry experts, peers (of a group you are involved in as a Sector Stakeholder), and local and central government departments where it is strictly necessary. It is also possible that we may be required to share your data to comply with applicable laws or with valid legal processes, such as in response to a court order.

Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded by implementing at least one of the following safeguards:

• Transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the UK (the UK also recognises the European Commission list of adequate countries. For further details, see European Commission: Adequacy of the protection of Personal Data in non-EU countries)
• Specific contracts/agreements approved by the UK which give personal data the same protection it has in the UK. For further details, see UK International Data Transfer Agreements. We will also assess in-country standards as part of this process.

We may share the information we gather with other organisations in these scenarios (where this has been outlined in the privacy notice). The following list is non-exclusive:

• Evaluators and Delivery Partner organisations and other organisations that are funded by us or collaborating with us on projects or pieces of research.
• Independent contractors or suppliers we hire to work on specific projects or pieces of research we conduct or commission.

Where there is a requirement or desire to archive your data for purposes of public interest which may mean the possibility of a secondary use, we carefully review all organisation’s research project proposals to maintain appropriate safeguarding of data when access is granted.

We process the personal data of research participants in a variety of ways based on the following legal bases:

• Legitimate Interest: We may rely on our legitimate interests to process your personal data, provided that such interests are not overridden by your interests, fundamental rights, or freedoms. In particular, we may process your personal data with reliance on a legitimate interest where we have identified you as a relevant sector stakeholder in the VCSE sector and in the effective and lawful operation of our businesses, maintenance of our relationships with collaborative organisations, and the effective delivery of information and services we may provide to you. We may have other legitimate interests and, if so, we will make clear what those interests are at the relevant point in time.
• Consent: We may rely on the consent that you provide us at the point of collection of your personal data to use such information for the purposes outlined herein. For example, you may have agreed to receive marketing materials such as our electronic newsletters (you are able to opt-out or unsubscribe at any time).
• Public Task: From time-to-time when we carry out communications activities, we may have to process personal data to perform a task that’s in the public interest or in the exercise of a Centre funder’s official authority.
• Legal: We may process your personal data if necessary for us to comply with a legal obligation arising under an applicable law to which we are subject

We would like to make sure you are fully aware of all of your data protection rights. Every user is entitled to the following:

• The right to access – You have the right to request copies of your personal data. We may charge you a small fee for this service.
• The right to rectification – You have the right to request that we correct any information you believe is inaccurate. You also have the right to request we complete any information you believe is incomplete.
• The right to erasure – You have the right to request that we erase your personal data, under certain conditions.
• The right to restrict processing – You have the right to request that we restrict the processing of your personal data, under certain conditions.
• The right to object to processing – You have the right to object to our processing of your personal data, under certain conditions.
• The right to data portability – You have the right to request that we transfer the data that we have collected to another organisation, or directly to you, under certain conditions.

If you make a request, we have one month to respond to you. 

If you would like to exercise any of these rights, please contact us at info@whatworkswellbeing.org.

If you have any questions about our privacy policy, the data we hold on you, or you would like to exercise one of your data protection rights, please do not hesitate to contact us.

We kindly request you allow us the opportunity to address your complaints when they arise.

If you have any concerns about our use of your personal information, you can make a complaint to us by contacting dpo@theevidencequarter.com 

You can also complain to the UK Information Commissioner’s Office (ICO) using the details below if you are unhappy with how we have used your data. We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

The ICO’s address:   

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113

ICO website: https://www.ico.org.uk

Changes to this privacy notice

The What Works Centre for Wellbeing reserves the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.