nap privacy policy
Privacy Policy
Who we are
The Norfolk Advocacy Partnership (NAP) is managed by Equal Lives. Equal Lives used to be called Norfolk Coalition of Disabled people (NCODP) and in Suffolk they are called Suffolk Independent Living. Their partners are Opening Doors, The Bridge Plus+, Age UK Norfolk, Age UK Norwich, The Mancroft Advice Project (MAP), Deaf Connexions and West Norfolk Deaf Association (WNDA). The Norfolk Advocacy Partnership understands that we have a responsibility to protect and respect your personal data and privacy. This Privacy Notice explains what personal data we collect, how it’s used, stored and the reasons it may need to be disclosed to others. This Privacy Notice takes effect from the 30/09/2020. This Privacy Notice is subject to change, so please check our website on a regular basis for any further changes.
​
Our role
The Norfolk Advocacy Partnership is both data controller and data processor depending on circumstances.
​
What personal data we collect
The Norfolk Advocacy Partnership may collect, store, and use the following types of personal information:
-
First name
-
Email address
-
Job title, employer/organisation, registered business/charity number
-
Age
-
Approximate location i.e. postcode
-
Your reasons for seeking advocacy as they are explained to us.
​
We may also collect, store and use the following "special categories" of more sensitive personal data which require a higher level of protection:
-
Race, ethnicity, sexual orientation
-
Information about your health, including medical conditions.
​
Information is provided to us when you contact us via phone, email, post, website enquiry, social media enquiry, face to face meetings or when you complete a survey or application form.
​
How we use your personal data
We will only use your personal data for the purposes it was collected for. Your personal data may be shared with any Norfolk Advocacy Partnership employee or volunteer as is reasonable and necessary for the purposes identified in this document.
The Norfolk Advocacy Partnership will use data to:
-
Respond to enquiries and complaints
-
Provide support to other people, e.g. advice to parents/carers and professionals
-
Make and confirm appointments
-
Promote services and activities – in line with marketing regulations.
-
Contact you with relevant information, such as news, events and activities
-
Collate information about health and wellbeing, issues, and the impact of our services
-
Carry out equal opportunities monitoring
​
On rare occasions, we may need to use your data for other reasons. In this case, we will notify you, explain why we are doing this, and tell you the legal basis which allows us to do so.
We may need to use your data to:
-
Fulfil a legal obligation
-
Complete activities of legitimate interests of The Norfolk Advocacy Partnership or a third party, where your interests and fundamental rights do not override those interests
-
Protect your, someone else's, or public interests
​
Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, GDPR, and where this is required and permitted by law.
Wherever possible and practical we will anonymise personal data, for example survey results. In this case, it can no longer be associated with, or used to identify, an individual.
​
Third parties
The Norfolk Advocacy Partnership uses some third-party services to assist in our operations.
We have no control over, and are not responsible for, the privacy policies and practices of third parties. As such, when using these services, you will be prompted to agree to their Privacy Policy.
The Norfolk Advocacy Partnership will act as a Data Controller for the personal data that third-party services share with us.
These third-party services include:
-
Microsoft
​
Data Sharing
Some of The Norfolk Advocacy Partnership services rely on the sharing of data between different organisations.
We may on occasion need to share your data with third parties. This will only be done where necessary, and you will be notified.
As with The Norfolk Advocacy Partnership, third parties are required to respect the security of your data. We only permit them to process your data for specified purposes and treat it in accordance with GDPR, the law, and The Norfolk Advocacy Partnership policies.
Examples of third parties The Norfolk Advocacy Partnership works with in partnership with or hold contracts with:
​
The Norfolk Advocacy Partnership may share statistical data with third parties, but no information from which individuals can be identified.
We will not, without your consent, supply your personal information to third parties for direct marketing.
​
Data Security
The Norfolk Advocacy Partnership uses a range of measures to protect the security of your data and prevent unauthorised access, loss, misuse or inappropriate alteration of your data.
We have put in place reasonable physical, electronic and managerial procedures to safeguard and secure personal data. For example, we use:
-
Encryption – including portable devices and encrypted emails
-
Locked cabinets and locked data storage rooms
-
Strong passwords
-
Password protected servers, accounts/log-ins, databases, documents, and programs (e.g. Sage 50)
-
Restricted areas of server accessible only by authorised personnel
-
Up-to-date virus protection, hardware as well as software including; firewalls, and malware software
​
We have procedures to deal with a suspected data security breach, which may include notifying you and the Information Commissioner’s Office where we are legally required to do so.
​
Data Retention
We will retain your personal information (including printed and electronic documents) for only as long as necessary to fulfill the purposes for which we collected it, and to fulfill legal, accounting, employment, and reporting requirements.
Different types of data may be retained for different periods, as outlined in the The Norfolk Advocacy Partnership Retention Policy.
Your personal data stored by The Norfolk Advocacy Partnership will be anonymised or deleted at the point retention expires.
​
Updating Information
The Norfolk Advocacy Partnership has a duty to keep all the information we hold about you up-to-date in line with any amendments you tell us of.
As such, please keep us informed of any changes to your personal information by contacting us.
​
Your Rights
GDPR gives you greater control over your data held by The Norfolk Advocacy Partnership.
​
Privacy Information
The Norfolk Advocacy Partnership will always inform you about the collection and use of your personal information, outlining the purpose for which we obtain and use your data, the retention periods and who it will be shared with.
Subject Access
You have the right to request access to your personal information. If you do this, The Norfolk Advocacy Partnership will provide you with a copy of the personal information we hold about you to check that:
-
we are processing it lawfully
-
it is up-to-date
​
Correction
If you consider the personal information we hold about you to be inaccurate or incomplete, you can request for us to correct it.
​
Restriction
If you have any concerns about the way The Norfolk Advocacy Partnership may be using your data, you may request for us to suspend its use while these are investigated. This is known as ‘restriction’. Concerns you may have could include:
-
Inaccuracies in the data
-
Our reason(s) for processing the data
-
Preventing erasure of your information, so that it may be available beyond the time frame established in the The Norfolk Advocacy Partnership Retention Policy (available upon request)
​
You should note that restricted data remains stored (but not erased) and may be restricted only for a limited time period.
​
Objection
You have the right to prevent The Norfolk Advocacy Partnership using your personal data where your particular situation means you object to it being processed. In this case, we may require specific reasons.
We cannot request reasons for your objection to direct marketing.
This data may still be stored, and not erased.
​
Erasure
As part of your ‘right to be forgotten’, you may ask The Norfolk Advocacy Partnership to delete or remove your personal information where:
-
there is no acceptable reason for us to continue processing or to store it
-
you have exercised your right to object (see above).
​
Transfer (or Data Portability)
This right allows you to request us to move, copy, or transfer your personal data easily from the The Norfolk Advocacy Partnership IT network to yourself or another network, service, business, etc. We will do so without compromising security or the data usability.
This excludes information stored on paper-based files.
​
You may express your rights, in writing or verbally, by addressing your request to the us, by:
-
Emailing info@norfolkadvocacy.org.uk
-
Writing to The Norfolk Advocacy Partnership, Ground Floor, St Vedast House, St Vedast Street, Norwich, NR1 1BT.
-
Calling 01508 491222
​
Providing an additional, appropriate security measure, we may need identification or other information to confirm who you are. This will clarify your right to access the data and exercise your rights and avoid incorrect disclosures.
​
Valid forms of identification may include a passport, driving licence or birth certificate.
​
The Norfolk Advocacy Partnership will respond to your request within one calendar month. Normally, no fee will be charged unless the request is excessive.
​
If we are unable to fulfill your request (for example, a legal obligation), or need to take longer to process your request, we will explain why.
Right to Withdraw Consent.
​
Occasionally, we may obtain your consent to collect and process your personal data for a specific purpose.
​
You have the right to withdraw your consent at any time by contacting us (see Changes to the Notice, below).
​
After The Norfolk Advocacy Partnership receives notification that you have withdrawn consent, we will no longer process your information for the stated purpose(s). There may be exceptions where we have another legitimate, lawful basis for doing so, which we will inform you of.
Report a Concern
If you have a concern about the way your personal information has been handled, complaints can be reported directly to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues, at:
-
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
-
0303 123 1113
​
Further information, including live chat help, is available online at https://ico.org.uk/concerns
​
Changes to this Notice
The Norfolk Advocacy Partnership reserves the right to update and amend this privacy notice at any time.
The current version will be accessible on the The Norfolk Advocacy Partnership website at any time.