Policy statement
Sheffield Young Carers Project (SYC) is an independent charity which has existed in Sheffield since 1997. We are dedicated to supporting young carers across the city. When doing this, we process personal data about people who: access our support services; help by supporting young carers within their own settings, e.g. education or health services; or provide us with support through campaigns, donations, booking onto training courses or volunteering.
We regard the protection of individuals’ personal and sensitive data to be of the greatest importance and will comply with the requirements of the current data protection legislation at all times. We are registered with the Information Commissioner as a data controller (registration no. Z2467860) and we have a named Data Protection Officer.
Definition of terms
Within this policy:
‘data controller’ refers to Sheffield Young Carers
‘data processor’ refers to Sheffield Young Carers (or any third party we instruct to process data on our behalf)
‘data subject’ refers to any individual, e.g. young carer or financial supporter, whose data we process.
Throughout this policy, the words ‘you’ and ‘yours’ refer to the data subject and the words ‘we’ and ‘us’ refer to Sheffield Young Carers.
The purpose of this policy
This policy outlines what data we collect, how we may use it, how we protect your data and your rights. This policy should be read in conjunction with SYC’s Confidentiality Policy, to which it is closely related.
This policy includes any data we collect from you during your relationship with Sheffield Young Carers Project. This may be via:
any paper forms you fill out
verbal data collection
forms via our website, or online surveys
communication via social media
photographs, video or audio recordings.
We regularly check this policy to ensure that we are providing you with the most up-to-date information regarding our data processing activities. We strongly advise you to read this page from time to time to ensure you are happy with any changes that might be made.
If you have any questions, please telephone us on 0114 258 4595 or contact us here.
Lawful processing
In accordance with the General Data Protection Regulation (GDPR) we will process all personal data lawfully, fairly and transparently. We will only process personal data if there is lawful basis for us to do so (please see table below) and we will determine and document the lawful basis for processing any personal data before we proceed.
Lawful bases available for processing personal data and special categories of data
General Data Protection Regulation (GDPR)
6(1)(a) Consent of the data subject
6(1)(b) Processing is necessary for the performance of a contract with the data subject or to take steps to enter into a contract
6(1)(c) Processing is necessary for compliance with a legal obligation
6(1)(d) Processing is necessary to protect the vital interests of a data subject or another person
6(1)(e) Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
6(1)(f) Necessary for the purposes of legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests, rights or freedoms of the data subject
Consent
Where our lawful basis for processing personal data is 6(1)(a) Consent of the data subject, we will ensure that consent is ‘freely given, specific, informed and unambiguous’ and, using our consent mechanisms, (e.g. referral form, e-newsletter sign-up form on our website) data subjects will be required to take some form of clear affirmative action, or ‘positive opt-in’. We will ensure that consent is separate from other terms and conditions and we will maintain accurate records pertaining to consent in order to remain transparent and accountable.
Why we collect your data
At Sheffield Young Carers, we communicate with a wide range of individuals and organisations in order to carry out our work, including service users and their families, partner organisations including referrers, and staff and volunteers.
We only collect personal details needed to fulfil the service you expect from Sheffield Young Carers Project (SYC). Depending on your relationship with us and the service you receive, the information we gather and record may differ.
If you are a service user / family member of a service-user:
Personal details required to allow SYC to provide you with advice and support, or to refer you on to other services that you have requested or been recommended. This may cover contact information, employment and financial details, family, lifestyle and social circumstances etc.
Personal details shared during conversations with our support workers.
Personal details shared when participating in surveys and research (although this is voluntary).
Information shared to help improve SYC’s services and service users’ experiences.
If you are a staff member or volunteer:
Personal details for job applications or volunteer placements.
Data to allow us to make any payments due to you, e.g. salary, pension, expenses.
If you are a training delegate:
Personal details needed for the administration of your booked training course.
Data needed to record and contact you regarding any payments you make to SYC, where applicable.
If you are a supporter:
Data needed to record and contact you regarding any payments you make to SYC, e.g. a regular gift.
Data needed to allow us to reclaim any tax on your gifts under the Gift Aid scheme.
Contact details to allow communication with you regarding SYC fundraising and campaigns.
In all cases, we will do our best to ensure that your personal data is accurate and, where necessary, kept up to date. We will ensure that our records are adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
Using your personal data
If you are receiving support from us, we will need to process your data because of your specific relationship with us.
We will keep all of your personal information – including notes, letters and information given to us about you – in a confidential record that is specific to you. We use a customer relationship management system (CRM) called Simply Connect to help us do this accurately and securely. Alongside your paper records, it allows us to keep the information you provide us with so we are able to see the history and relevant details of your case(s). This ensures that we provide appropriate and accurate advice or support. We take information security very seriously. No one is allowed access to our system or files unless they need this in order to provide the service to you or one of the other purpose discussed in this notice.
In order to make sure that our services meet a high standard of quality, service user files are sometimes checked by our quality assurance staff. Files may also be checked by external auditors if the work we do is funded by another organisation, such as a local authority or the Big Lottery Fund. All auditors are bound by confidentiality policies.
We may use your data for statistical reports. These statistics will not include any information that could be used to identify any individual.
We will only process your data for the following purposes, with your consent:
informing you about services provided by SYC
informing you about any changes to our services
communications about our charitable purpose, campaigns and fundraising
marketing purposes
SYC service questionnaires
in house research questionnaires.
Retention of your data
Whatever your relationship with us, we will only store your information for a specific amount of time. This may depend on the law or regulations that the information falls under such as financial regulations, Limitations Act, Health and Safety regulation etc., or any contractual obligation we might have – such as with government contracts or if we have a business case, such as with research data. For business case data, we will anonymize the data so no individual is identifiable. Once the retention period has expired, the information will be confidentially disposed of or permanently deleted.
Disclosure of your personal data
We will not, without your consent, supply any of your personal data to any third party – except where:
The transfer is to a secure data processor, which carries out data processing operations on our behalf.
We are required to do so by law enforcement or regulatory bodies where this is required or allowed under the relevant legislation.
If there is a situation where we are asked to share your data with other support services, funders or third-party survey providers, we will make sure you are informed and we will obtain your consent to share your data at the time of data collection. We will make sure your details are safe, secure and only used for the limited purpose you have provided them to us.
We will never share or sell your personal data to a third-party organization for marketing, fundraising or campaigning purposes.
Security of your personal data
We use appropriate technical and organisational precautions to protect your personal data against any unauthorised or unlawful processing or any accidental loss, destruction or damage.
In the event of a data breach
We will notify the Information Commissioner without unnecessary delay and, where possible, within 72 hours of the data breach.
Where the data breach is likely to lead to risks for rights and freedoms of our data subjects (not just in the scope of the GDPR but beyond) we will notify the data subjects as soon as practicably possible.
Use of data processors
Website
The platform used to build our website is www.squarespace.com
When someone visits www.sheffieldyoungcarers.org.uk we use Squarespace Analytics to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site. This information is only processed in a way which does not identify anyone. We do not make any attempt to find out the identities of those visiting our website. If we do want to collect personally identifiable information through our website, we will be up front about this. We will make it clear when we collect personal information and will explain what we intend to do with it.
Please note that this privacy policy does not cover links within our site which link to other websites. We encourage you to read the privacy statements on the other websites you visit.
Cookies
A cookie is a small data file that is downloaded from a website to your computer, to make the site easier to use in a number of ways. For example, it may store details that you submit on the site, such as your personal settings, your location, or what you have in a shopping cart etc., so you don’t need to enter information more than once.
Using cookies does not allow us to identify users personally; we will only store information that you've specifically given us permission for.
Our website uses a small number of cookies to give us a better overall picture of how people interact with the site, and how we can improve our services to our service users and supporters. The information we gather through this process is completely anonymous, and visitors to the site cannot be identified.
We use some tools on our pages from social networks, such as Twitter and Facebook. Any information used via these tools is not shown to us, and we don't store any information from them. Please refer to each site's own privacy policies for more information.
Controlling and deleting cookies on your computer
All browsers allow you to manage which cookies you accept, reject and delete. You can usually find these controls under the ‘Preferences’ or ‘Tools’ menu. You can find more detail about individual browser settings at http://www.aboutcookies.org
Please note that, if you choose not to accept cookies from our website, some sections may not work properly.
E-newsletter
We use a third party provider, Mailchimp, to deliver our quarterly e-newsletters. We gather statistics around email opening and clicks using industry standard technologies including clear gifs to help us monitor and improve our e-newsletter. For more information, please see MailChimp’s privacy policy.
Online surveys
We collect information volunteered by members of the public about our services using three third party online survey tools: Typeform, SurveyMonkey and Smart Survey. These companies are data processors for SYC and only process personal information in line with our instructions. For more information, please see Typeform's terms, conditions & policies SurveyMonkey’s privacy policy and Smart Survey’s privacy policy.
People who contact us via social media
We use a third party provider, Hootsuite to manage our social media interactions. If you send us a private or direct message via social media the message will be stored by Hootsuite for three months. It will not be shared with any other organisations.
People who email us
We encrypt and protect email traffic in line with government guidance. We also monitor any emails sent to us, including file attachments, for viruses or malicious software. Please be aware that you have a responsibility to ensure that any email you send is within the bounds of the law.
Fundraising and campaigning
We would love to keep you up to date with our fundraising and campaign activity. We will obtain your consent to contact you by email, post, phone or text. We may supplement or add to the data we hold about you with information that is either from publicly available sources, geodemographic data or from organisations you have permitted to disclose such information. This allows us to assess the accuracy and improve upon the data we hold, in order to send you the information and fundraising appeals we believe you may be interested in.
We will never share or sell your personal data to a third-party organisation for their marketing, fundraising or campaigning purposes.
We may use a third-party company to manage mailings for fundraising appeals, campaigns or research surveys. We actively screen these companies to maximise the protection of your privacy and security. They are only permitted to use the data in accordance with the latest data protection legislation, under strict instructions from SYC.
If you would like to change your consent, update your details or unsubscribe from our communications at any point, you can do this by using one of the following methods:
By email: information@sheffieldyoungcarers.org.uk
By post: Sheffield Young Carers, Unit R7b, Sheaf Bank Business Park, 20 Prospect Road, Sheffield S2 3EN
By telephone: 0114 258 4595
Any electronic communication will have a link to unsubscribe from future electronic communications, so you can manage your own consent.
If you make any changes to your consent, we will update your record as soon as we possibly can. If you tell us you do not wish to receive marketing, fundraising or campaign communications, you may still receive transactional and service-based communications confirming and servicing other relationships you have with us.
Applying for a job at Sheffield Young Carers (SYC)
When you apply for a job with SYC, your personal data will be collated in order to monitor the progression of your application, and monitor the effectiveness of the recruitment process through the statistics collected. Where we need to share your data – such as gathering references or obtaining a Disclosure and Barring Services – you will be informed beforehand, unless the disclosure is required by law. These checks are only done after a position has been offered and only to the successful candidate. On the application form, you are asked to complete the referee details and can tick permission to contact referee. If you tick yes, once offered a role we will automatically send out reference requests. If you tick no, we will contact the successful candidate for permission first.
Personal data about unsuccessful applicants is held for 12 months after the recruitment exercise is complete for that particular vacancy. Applicants can ask us to remove their data before this time if you do not want us to hold it. If we feel there is another suitable vacancy available, we will contact the applicant prior to sharing your application details with the relevant manager.
Once you have taken up employment with SYC, we will compile a file relating to your employment. The information contained in this will be kept secure and will only be used for purposes directly relevant to your employment, for example:
Bank details – to process salary payments
Emergency contact details – so we know who to contact in case you have an emergency at work
Pension provider details – to process pension payments
Once your employment with SYC has ended, we will retain the file in accordance with the requirements of our retention schedule and then delete it from our files.
Your rights
You have the right under current data protection legislation to know what information we hold about you and to ask, in writing, to see your records.
We will supply any information you ask for that we hold about you as soon as possible within the statutory time limit of 40 days. We will not charge you for this. You will be asked for proof of identity as the person dealing with your request may not be the staff member you have met before. We need to be sure we are only releasing your personal data to you. This is called a data subject access and can be done:
By email: information@sheffieldyoungcarers.org.uk
By post: Data Protection Officer, Sheffield Young Carers, Unit R7b, Sheaf Bank Business Park, 20 Prospect Road, Sheffield S2 3EN
If we do hold information about you we will:
give you a description of it;
tell you why we are holding it;
tell you who it could be disclosed to; and
let you have a copy of the information in an intelligible form.
Updating your information
If you believe that any of the personal information held or processed by us is incorrect then please contact us:
By telephone: 0114 258 4595
By email: information@sheffieldyoungcarers.org.uk
By post: Sheffield Young Carers, Unit R7b, Sheaf Bank Business Park, 20 Prospect Road, Sheffield S2 3EN
We will correct it as soon as we possibly can.
Making a complaint to SYC
When we receive a complaint from a person we make up a file containing the details of the complaint. This normally contains the identity of the complainant and any other individuals involved in the complaint.
We will only use the personal information we collect to process the complaint and to check on the level of service we provide. We do compile and publish statistics showing information like the number of complaints we receive, but not in a form which identifies anyone.
We usually have to disclose the complainant’s identity to whoever the complaint is about. This is inevitable where, for example, the accuracy of a person’s record is in dispute. If a complainant doesn’t want information identifying him or her to be disclosed, we will try to respect that. However, it may not be possible to handle a complaint on an anonymous basis.
We will keep personal information contained in complaint files in line with our retention policy. This means that information relating to a complaint will be retained for two years from closure. It will be retained in a secure environment and access to it will be restricted according to the ‘need to know’ principle.
Similarly, where enquiries are submitted to us we will only use the information supplied to us to deal with the enquiry and any subsequent issues and to check on the level of service we provide.
When we take enforcement action against someone, we may publish the identity of the defendant in our Annual Report or elsewhere. Usually we do not identify any complainants unless the details have already been made public.
Changes to this privacy policy
We keep our privacy policy under regular review.
How to contact us
If you want to request information about our privacy policy, email information@sheffieldyoungcarers.org.uk or write to us at:
Data Protection Officer
Sheffield Young Carers
Unit R7b, Sheaf Bank Business Park
20 Prospect Road
Sheffield
S2 3EN
This privacy policy was last updated in May 2022.