nap privacy policy

Privacy Policy

Who we are

The Norfolk Advocacy Partnership (NAP) is managed by Equal Lives. Equal Lives used to be called Norfolk Coalition of Disabled people (NCODP) and in Suffolk they are called Suffolk Independent Living. Their partners are Opening Doors, The Bridge Plus+, Age UK Norfolk, Age UK Norwich, The Mancroft Advice Project (MAP), Deaf Connexions and West Norfolk Deaf Association (WNDA). The Norfolk Advocacy Partnership understands that we have a responsibility to protect and respect your personal data and privacy. This Privacy Notice explains what personal data we collect, how it’s used, stored and the reasons it may need to be disclosed to others. This Privacy Notice takes effect from the 30/09/2020. This Privacy Notice is subject to change, so please check our website on a regular basis for any further changes.

Our role

The Norfolk Advocacy Partnership is both data controller and data processor depending on circumstances.

What personal data we collect

The Norfolk Advocacy Partnership may collect, store, and use the following types of personal information:

First name
Email address
Job title, employer/organisation, registered business/charity number
Age
Approximate location i.e. postcode
Your reasons for seeking advocacy as they are explained to us.

We may also collect, store and use the following "special categories" of more sensitive personal data which require a higher level of protection:

Race, ethnicity, sexual orientation
Information about your health, including medical conditions.

Information is provided to us when you contact us via phone, email, post, website enquiry, social media enquiry, face to face meetings or when you complete a survey or application form.

How we use your personal data

We will only use your personal data for the purposes it was collected for. Your personal data may be shared with any Norfolk Advocacy Partnership employee or volunteer as is reasonable and necessary for the purposes identified in this document.

The Norfolk Advocacy Partnership will use data to:

Respond to enquiries and complaints
Provide support to other people, e.g. advice to parents/carers and professionals
Make and confirm appointments
Promote services and activities – in line with marketing regulations.
Contact you with relevant information, such as news, events and activities
Collate information about health and wellbeing, issues, and the impact of our services
Carry out equal opportunities monitoring

On rare occasions, we may need to use your data for other reasons. In this case, we will notify you, explain why we are doing this, and tell you the legal basis which allows us to do so.

We may need to use your data to:

Fulfil a legal obligation
Complete activities of legitimate interests of The Norfolk Advocacy Partnership or a third party, where your interests and fundamental rights do not override those interests
Protect your, someone else's, or public interests

Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, GDPR, and where this is required and permitted by law.

Wherever possible and practical we will anonymise personal data, for example survey results. In this case, it can no longer be associated with, or used to identify, an individual.

Third parties

The Norfolk Advocacy Partnership uses some third-party services to assist in our operations.

We have no control over, and are not responsible for, the privacy policies and practices of third parties. As such, when using these services, you will be prompted to agree to their Privacy Policy.

The Norfolk Advocacy Partnership will act as a Data Controller for the personal data that third-party services share with us.

These third-party services include:

Data Sharing

Some of The Norfolk Advocacy Partnership services rely on the sharing of data between different organisations.

We may on occasion need to share your data with third parties. This will only be done where necessary, and you will be notified.

As with The Norfolk Advocacy Partnership, third parties are required to respect the security of your data. We only permit them to process your data for specified purposes and treat it in accordance with GDPR, the law, and The Norfolk Advocacy Partnership policies.

Examples of third parties The Norfolk Advocacy Partnership works with in partnership with or hold contracts with:

The Norfolk Advocacy Partnership may share statistical data with third parties, but no information from which individuals can be identified.

We will not, without your consent, supply your personal information to third parties for direct marketing.

Data Security

The Norfolk Advocacy Partnership uses a range of measures to protect the security of your data and prevent unauthorised access, loss, misuse or inappropriate alteration of your data.

We have put in place reasonable physical, electronic and managerial procedures to safeguard and secure personal data. For example, we use:

Encryption – including portable devices and encrypted emails
Locked cabinets and locked data storage rooms
Strong passwords
Password protected servers, accounts/log-ins, databases, documents, and programs (e.g. Sage 50)
Restricted areas of server accessible only by authorised personnel
Up-to-date virus protection, hardware as well as software including; firewalls, and malware software

We have procedures to deal with a suspected data security breach, which may include notifying you and the Information Commissioner’s Office where we are legally required to do so.

Data Retention

We will retain your personal information (including printed and electronic documents) for only as long as necessary to fulfill the purposes for which we collected it, and to fulfill legal, accounting, employment, and reporting requirements.

Different types of data may be retained for different periods, as outlined in the The Norfolk Advocacy Partnership Retention Policy.

Your personal data stored by The Norfolk Advocacy Partnership will be anonymised or deleted at the point retention expires.

Updating Information

The Norfolk Advocacy Partnership has a duty to keep all the information we hold about you up-to-date in line with any amendments you tell us of.

As such, please keep us informed of any changes to your personal information by contacting us.

Your Rights

GDPR gives you greater control over your data held by The Norfolk Advocacy Partnership.

Privacy Information

The Norfolk Advocacy Partnership will always inform you about the collection and use of your personal information, outlining the purpose for which we obtain and use your data, the retention periods and who it will be shared with.

Subject Access

You have the right to request access to your personal information. If you do this, The Norfolk Advocacy Partnership will provide you with a copy of the personal information we hold about you to check that:

we are processing it lawfully
it is up-to-date

Correction

If you consider the personal information we hold about you to be inaccurate or incomplete, you can request for us to correct it.

Restriction

If you have any concerns about the way The Norfolk Advocacy Partnership may be using your data, you may request for us to suspend its use while these are investigated. This is known as ‘restriction’. Concerns you may have could include:

Inaccuracies in the data
Our reason(s) for processing the data
Preventing erasure of your information, so that it may be available beyond the time frame established in the The Norfolk Advocacy Partnership Retention Policy (available upon request)

You should note that restricted data remains stored (but not erased) and may be restricted only for a limited time period.

Objection

You have the right to prevent The Norfolk Advocacy Partnership using your personal data where your particular situation means you object to it being processed. In this case, we may require specific reasons.

We cannot request reasons for your objection to direct marketing.

This data may still be stored, and not erased.

Erasure

As part of your ‘right to be forgotten’, you may ask The Norfolk Advocacy Partnership to delete or remove your personal information where:

there is no acceptable reason for us to continue processing or to store it
you have exercised your right to object (see above).

Transfer (or Data Portability)

This right allows you to request us to move, copy, or transfer your personal data easily from the The Norfolk Advocacy Partnership IT network to yourself or another network, service, business, etc. We will do so without compromising security or the data usability.

This excludes information stored on paper-based files.

You may express your rights, in writing or verbally, by addressing your request to the us, by:

Emailing info@norfolkadvocacy.org.uk
Writing to The Norfolk Advocacy Partnership, Ground Floor, St Vedast House, St Vedast Street, Norwich, NR1 1BT.
Calling 01508 491222

Providing an additional, appropriate security measure, we may need identification or other information to confirm who you are. This will clarify your right to access the data and exercise your rights and avoid incorrect disclosures.

Valid forms of identification may include a passport, driving licence or birth certificate.

The Norfolk Advocacy Partnership will respond to your request within one calendar month. Normally, no fee will be charged unless the request is excessive.

If we are unable to fulfill your request (for example, a legal obligation), or need to take longer to process your request, we will explain why.

Right to Withdraw Consent.

Occasionally, we may obtain your consent to collect and process your personal data for a specific purpose.

You have the right to withdraw your consent at any time by contacting us (see Changes to the Notice, below).

After The Norfolk Advocacy Partnership receives notification that you have withdrawn consent, we will no longer process your information for the stated purpose(s). There may be exceptions where we have another legitimate, lawful basis for doing so, which we will inform you of.

Report a Concern

If you have a concern about the way your personal information has been handled, complaints can be reported directly to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues, at:

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
0303 123 1113

Further information, including live chat help, is available online at https://ico.org.uk/concerns

Changes to this Notice

The Norfolk Advocacy Partnership reserves the right to update and amend this privacy notice at any time.

The current version will be accessible on the The Norfolk Advocacy Partnership website at any time.