Darlington Association on Disability

Darlington Association on Disability (DAD) is a user-led disability organisation which is a registered charity and a company limited by guarantee. We provide a range of support and services for disabled people and carers in Darlington, Teesside and surrounding areas.

This is our privacy notice for people.

We are committed to being transparent about why we need your personal data and what we do with it. This information is set out in this privacy notice. It also explains your rights when it comes to your data.

Our head office is at 1P, Enterprise House, Valley St N, Darlington DL1 1GY

Registered Charity number 1125848

Registered Company number 6688735

The Data Protection Officer for DAD is Catherine Hunt

You can find out more about us at https://www.darlingtondisability.org/

If you have any specific questions or want more details about how we use your personal data, please let us know. See the 'how to contact us' section below for all the different ways you can get in touch.

Data controller

DAD is the data controller where we are responsible for deciding what is done with your personal information.

When we are contracted to do work for another organisation

When DAD acts under instruction from another organisation we are what is called the ‘data processor’ and the other organisation is the data controller. There will be a contract in place which will tell us what to do with your information.

If any of your personal data is being used for a purpose that is not controlled by us, you will be given a different privacy notice by the data controller which will tell you all about it.

Your rights are unlikely to be affected if your information is used in this way.

Why we collect information about you

If anyone can be identified by any information that we collect, this information is called ‘personal data’. Data protection law says that DAD must have a reason or ‘purpose’ for collecting and using personal data.

Our purposes are to:

Deliver our services
Manage our relationship with you
Develop new ways to meet the needs of people we support
Improve our service delivery
Keep internal records
Keep you informed about our activities

What personal information might we collect?

Your name and contact details
Name and contact details of carers, next of kin and emergency contacts
Information about your needs
Your financial details e.g. details of direct payments
What we learn about you from letters, email, and recorded conversations between us and other relevant parties.
Data about how you use our services and the support we have provided you with
Opinions and other comments you may post on social media sites
Information about you from referring organisations or medical practitioners including Government and law enforcement agencies, Local Authorities, and the National Health Service. We will tell you what we have received and who gave it to us if it happens.

How we ensure that the processing we do is lawful

DAD cannot use your personal data for any reason unless we have a lawful basis to do so. A data subject is a person whose data is processed by us.

Those that we use are:

Deliver our services

The data subject has given consent to the processing.
The processing is necessary- for the performance of a contract to which the data subject is a party, or for the taking of steps at the request of the data subject with a view to entering into a contract
The processing is necessary for compliance with any legal obligations to which the data controller is subject, other than an obligation imposed by contract
The processing is necessary in order to protect the vital interests of the data subject

Manage our relationship with you

We have a legitimate interest in using your information. This information allows us to process queries effectively and tailor the ways in which we communicate with you.

Develop new ways to meet the needs of the people we support

We have a legitimate interest in using your information. For example, we may develop new methods of service delivery.

Improve our service delivery

We have a legitimate interest in using your information. We may use feedback given to us.

Keep internal records

The processing is necessary for compliance with any legal obligations to which the data controller is subject, other than an obligation imposed by contract

Keep you informed about our activities

The data subject has given consent to the processing
We have a legitimate interest in using your information. If we already have a relationship with you, we may not ask for your consent to send you a newsletter or informative email – we may just send it

In the case we discover that a child under 16 has provided us with consent for marketing, we will immediately remove this consent. If you are a parent or guardian and you are aware that your child has provided us with personal data, please contact us using one of the methods in the 'how to contact us' section so that we will be able to take the necessary actions.

Special category and sensitive types of data

Data protection law considers some types of personal data as special category. This includes information about race, ethnic origin, religion, health, sex life and sexual orientation. These types of personal data require additional protection. This is because use of this data could create significant risks to the individual’s fundamental rights and freedoms. The presumption is that this type of data needs to be treated with greater care because collecting and using it is more likely to interfere with these fundamental rights or open someone up to discrimination.

Where we process special category data we do so because:

the data subject has given explicit consent to the processing of the personal data for one or more specified purposes.
processing is necessary to protect the vital interests of the data subject or another natural person where the data subject is physically or legally incapable of giving consent.
processing is necessary for the purpose of preventative or occupational medicine, the provision of health or social care or treatment or the management of health or social care systems and services.

If we ask for your consent and you give it, you have the right to withdraw this at any time by contacting us in writing using the address or contact details given in this privacy notice. If withdrawal of consent is going to affect the service that we give you, we will tell you about this at the time.

We may need to send you service messages. These are different from marketing emails as they contain information, we need to give you to ensure we can provide our services effectively. Examples of these include:

Changes to terms and conditions and our privacy notice
Information about service changes

You cannot withdraw consent to receive service emails.

If you disagree with us using your personal data for one or more of our legitimate interests let us know in writing and we will consider whether we will stop using it for that purpose.

How long do we keep your information?

We keep contact details for people we support with whom we have/have had a working relationship and for organisations or individuals who contact us, for five years after the last contact, unless there is a statutory requirement to retain for longer.For more details please contact our Business Support Officer, Judith Gledhill – judith.gledhill@darlingtondisability.org

Who do we share your data with?

DAD does not share your personal information with any third parties, other than those listed below.

When we share your personal data with these third parties who perform services for us, we require them to take appropriate steps to protect your personal information, and only to use the personal information for the purpose of performing those specific services.

We currently use the following organisations, however your data is only shared with those where there is a relevant reason to do so:

Name of company/organisation	The service they perform for us, or their function
FastHost, Microsoft, Transcendit, Charity Log, People First Advocacy, 700 Club, RTC North, SAGE accounts and payroll	IT hosting
Watch 50	IT maintenance
Watch 50	Website maintenance
Sentient, Employers liability insurance (inc employment law helpline), DBS, Nereo, Training providers, Indeed, Find-a-Job*	HR Function
Clive Owen, HMRC, NEST, Aviva, The Pension Regulator*	Accountants/Financial
Unity Bank, HSBC,	Banking
One Com	Telephone (land line)
GiffGaff	Mobiles
Shred IT	Confidential waste disposal
Just Giving*	Fundraising
PrePaid Financial Services	Payment platforms
Facebook*	Social media

*Please be aware that these organisations are data controllers in their own right and we encourage you to read their privacy notices.

We will never sell or distribute your personal information to any other third parties or make it public unless we have a legal obligation to do so. We may have a legal obligation to pass your information to regulators and the local authority. If we provide links to websites of other organisations, this privacy notice does not cover how that organisation processes personal information. We encourage you to read the privacy notices on the other websites you visit.

Transferring personal data outside the European Economic Area

Some of your personal data may be transferred outside the EEA. We make sure that it is protected in the same way as if it was being used in the EEA. To do this we will:

Only transfer it to a non-EEA country with privacy laws that give the same protection as the EEA as specified by the European Commission and which has been determined as adequate by the EEA or the UK;
When transferring to the USA or any other country that has not been assessed as adequate, we will ensure that there is a safeguard in place that is recognised by the representative supervisory authority of the United Kingdom. This is the Information Commissioner's Office (ICO). The safeguard is to use one of the ICO's standard contractual clauses.

National data Opt- Out

As a provider of services for local government and/or the NHS, DAD’s clients or their representatives have the right to opt out of having clients’ personal data being disclosed for anything other than their care or support. The National data opt-out does not currently apply to any personal data which DAD discloses however we need to make you aware of this right. You can find out more information at https://www.nhs.uk/your-nhs-data-matters/.

Your Rights

Under data protection law, you have rights we need to make you aware of. The rights available to you depend on our reason for processing your information.

Your right of access: You have the right to ask us for copies of your personal information. This right always applies.
Your right to rectification: You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies.
Your right to erasure: You have the right to ask us to erase your personal information in certain circumstances.
Your right to restriction of processing: You have the right to ask us to restrict the processing of your information in certain circumstances.
Your right to object to processing: You have the right to object to processing if we are able to process your information because it is in our legitimate interests, for statistical purposes or direct marketing purposes.
Your right to data portability: This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another or give it to you.
Your right in relation to automated decision making and profiling: DAD does not use any of your personal data to make automated decisions. We may create profiles of our clients and supporters in order to ensure that they only receive information that is appropriate for them. You have the right to stop us doing this and can do so by contacting us in writing at the address given.

For more information about your rights you can visit the ICO website https://ico.org.uk

How to contact us

If you have any questions or want more details about how we use your personal data, please let us know. We’ve provided a few different ways for you to do this, so please pick the one you would prefer to use:

Write to: The Data Protection Officer, Darlington Association on Disability, 1P, Enterprise House, Valley St N, Darlington DL1 1GY

Email: mail@darlingtondisability.org for the attention of The Data Protection Officer.

Tel: 01325 489999

Text: 0762 481 8780

How to complain

If you are unhappy about the way we handle your personal information please let us know verbally, in writing or communicated in another way for explained signed or by email by contacting us at the address given below. We will explain how we have processed your personal information and if we have made a mistake will tell you how we will put this right. If you are still dissatisfied, you may report your concern to the Information Commissioner’s Office (ICO) by contacting:

Wycliffe House, Water Lane, Wilmslow SK9 5AF

Tel. 0303 123 1113

https://ico.org.uk/global/contact-us/

This privacy notice was last updated in June 2024