Privacy Policy

Crossroads Care Surrey is committed to respecting your privacy.

This policy explains how we may use personal information we collect about you. This notice explains how we comply with data protection law and what your rights are.

Who we are

References to “we”, “our”, or “us” in this privacy notice are to Crossroads Care Surrey.

We are Crossroad Care Surrey, a registered charity under registration number 1040679. We are what is known as the ‘data controller’ of personal information we collect and use. This means that we are responsible for determining the purpose and the means of processing your personal data Our main offices are at 121 Kingston Road, Leatherhead, KT22 7SU. You can contact us at: enquiries@ccsurrey.org.uk

Our Data Protection Officer (DPO) ensures that we apply the best standards to protecting your personal information and comply with our responsibilities for data protection. If you have any questions about how we handle your personal information or concerns, please contact us using the information provided under the Contacting Us section below.

What Information do we collect from you?

For us to provide our services to you we may need the following information:

Name
Email address and phone number
Date of birth
Address
Information relating to your health
Information relating to criminal convictions

Special Categories of Personal Information

We may also collect, store and use “special categories” of personal information. This involves information which is considered more sensitive. We will only collect this information where you provide this to us for example, when you inform us of your health issues and disabilities.

Where We Collect Your Data

We will collect information about you during the use of our service, this will either be collected directly from you or the client.

If, for any reason, you provide us with details of others, e.g. family members or emergency contacts they have a right to know and to be aware of what personal information we hold about them and how we use it. Please share this policy with those of them whom you feel are sufficiently mature to understand it. They also have the same rights as set out in the “Your rights in relation to personal information” section below.

Uses Made of Your Personal Data

We may use your personal data to do the following:

To refer you to the NHS where necessary
To undertake marketing to improve user experience and provide relevant promotional content
To ensure the safety of clients and carers
To assist the carer in their role

Lawful Basis for Processing Your Data

The UK General Data Protection Regulation (UK GDPR) requires that we must have a lawful basis for all of our processing activities. Our lawful bases are as follows:

The processing activity is carried out with your consent
The processing activity is necessary for the performance of a contract
The processing activity is necessary for compliance with a legal obligation
The processing activity is in our legitimate interests:
- To further our marketing activities to help spread awareness of us and our services
- To ensure that we are providing you with quality services and to allow us to improve our services where possible
- To investigate and respond to general queries

Under the UK GDPR, we can only process special category data about you (such as your health information) where we can apply one of the following lawful bases:

The processing activity is carried out with your explicit consent; or
The processing activity is necessary for the purposes of carrying out obligations in the field of employment, social security and social protection law

For some of your personal information you will have a contractual or legal requirement to provide us with your personal information. If you do not provide us with the requested personal information, we may not be able to properly perform our contract with you and may not be able to employ you or continue our contract of employment with you.

Where you have given us your consent to use your personal information, you have the right to withdraw this consent at any time. You can do this by contacting us as described in the “Contacting us” section below.

Please note that the withdrawal of your consent will not affect any use of the data made before you withdrew your consent, and we may still be entitled to hold and process the relevant personal information, to the extent that we are entitled to, on bases other than your consent.

Disclosure of Your Personal Data

We may share your personal data with the following parties:

The NHS or other health providers
The Fulfilment House
Local authorities, specifically Surrey County Council

We do not disclose your personal information to anyone else except as listed above.

Third-Party Services and Fundraising

From time to time, we may also share your personal data with other third-party service providers for purposes such as fundraising, research, or service improvement. Where this is the case, we will make you aware of the specific third party and the purpose of the sharing before your data is disclosed.

You will be informed of your rights in relation to this processing, including your absolute right to opt out of your data being shared or used for fundraising or marketing purposes at any time, by contacting us using the details in the “Contacting Us” section below.

Transferring Your Data Internationally

We do not undertake transfers of your personal data to any countries outside the United Kingdom. If this changes, we will ensure that you are notified of this and that the data will be transferred to a country with an adequacy decision or with appropriate safeguards in place.

How Long We Keep Your Personal Data

The duration for which we retain your personal data will differ depending on the type of data and the reason why we collected it from you. Typically, we hold data relating to Children for 25 years and information relating to adults for 5 years as per statutory requirements.

It is important to ensure that the personal information we hold about you is accurate and up-to-date, and you should let us know if anything changes, for example if you move home or change your phone number or email address. You may be able to update some of the personal information we hold about you by contacting us using the details in the “Contacting Us” section below.

If you have any questions concerning this section, please get into contact with us.

Your Rights in Relation to Personal Data

You have the following rights concerning your data:

Right of Access: You have the right to obtain confirmation from Crossroads Care Surrey as to whether personal data concerning you are being processed and, where that is the case, access to that data
Right to Rectification: You have the right to oblige Crossroads Care Surrey to rectify inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed by providing a supplementary statement
Right to Erasure: You have the right (under certain circumstances, but not all) to oblige Crossroads Care Surrey to erase personal data concerning you
Right to Restriction of Processing: You have the right (under certain circumstances, but not all) to oblige Crossroads Care Surrey to restrict processing of your personal data. For example, you may request this if you are contesting the accuracy of personal data held about you
Right to Data Portability: You have the right (under certain circumstances, but not all) to oblige Crossroads Care Surrey to provide you with the personal data about you which you have provided to Crossroads Care Surrey in a structured, commonly used and machine-readable format. You also have a right to oblige Crossroads Care Surrey to transmit those data to another controller
Right to Withdraw Consent: If the lawful basis for processing is consent, you have the right to withdraw that consent
Right to Object to Direct Marketing: Where your personal data are processed for direct marketing purposes, you have the right to object at any time to processing of your personal data for marketing, which includes profiling to the extent that it is related to such direct marketing
Rights in Relation to Automated Decision-Making and Profiling: Crossroads Care Surrey does not perform any automated decision-making based on personal data that produces legal effects or similarly affects you.
You should note that some of these rights, for example the right to require us to transfer your data to another service provider or the right to object to automated decision making, may not apply as they have specific requirements and exemptions which apply to them, and they may not apply to personal information recorded and stored by us. For example, we do not use automated decision making in relation to your personal data. However, some have no conditions attached, so your right to withdraw consent or object to processing for direct marketing are absolute rights. If you have any questions regarding this, please refer to our contact detail below
Right to Lodge a Complaint with a Supervisory Authority: If you have a concern about how we have handled your personal data, we would ask that you contact us first so that we have the opportunity to look into and resolve your concern directly. You can make a data protection complaint to us by emailing enquiries@ccsurrey.org.uk (please mark the subject line: Data Protection Complaint), by calling 01372 869970, or by writing to Crossroads Care Surrey, 121 Kingston Road, Leatherhead, Surrey KT22 7SU. We will acknowledge your complaint within 30 days and investigate it in accordance with our Data Protection Complaints Policy. If you remain dissatisfied with our response, you have the right to escalate to the ICO as set out below:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
(t) 0303 123 1113
(e) icocasework@ico.org.uk

While this privacy policy sets out a general summary of your legal rights in respect of personal information, this is a very complex area of law. More information about your legal rights can be found on the Information Commissioner’s website at: https://ico.org.uk/for-the-public/

To exercise any of the above rights, or if you have any questions relating to your rights, please contact us by using the details set out in the “Contacting us” section below.

Changes to This Policy

Crossroads Care Surrey may update this privacy policy from time to time. When we change this policy in a material way, we will update the version date at the bottom of this page. For significant changes to this policy, we will try to give you reasonable notice unless we are prevented from doing so. Where required by law, we will seek your consent to changes in the way we use your personal information.

Contacting Us

In the event of any query or complaint in connection with the information we hold about you, please email enquiries@ccsurrey.org.uk or write to us at: 121 Kingston Road, Leatherhead, Surrey, KT22 7SU.

Our Data Protection Officer, Data Protection People, can be contacted by email dpo@ccsurrey.org.uk or by telephone: 0113 869 1290.