Family Support Link is a charity providing specialist support services to individuals and families affected by Substance use.
As part of our work, we collect and process personal data about the people who interact with us in accordance with the Data Protection Act 2018 (DPA) The Data Protection, Privacy and Electronics Communications Regulation 2020 (UK GDPR) and any other relevant data protection laws applicable. The kind of data we collect depends on how people use our services, whether that’s getting support, supporting our work via donations, applying for jobs or volunteering.
We only collect the bare minimum we need to offer our services and do our work. We are completely committed to protecting your data and privacy, and pride ourselves on taking great care to ensure it stays completely safe.
We promise we’ll never share or sell your personal data to a third-party organisation for marketing, fundraising or campaigning purposes.
This notice outlines what data we collect, how we may use it, how we protect your data and your rights, and how you can exercise those rights.
References to ‘we’ or ‘us’ are to:
- Family Support Link registered charity CIO – Charity Number 1196808
We regularly check this notice to make sure we’re giving you the most up-to-date information available about how we’re processing our data. We recommend you re-read this page from time to time to make sure you’re happy with any changes that might be made.
We provide some services under sub-contract to another agency and as part of that arrangement we may be required to use their systems and follow their instructions in relation to data and its protection – we only enter into these arrangements with agencies who meet our standards around data protection. Nonetheless whilst your data is in use or being handled by us and being processed or amended by us, we will scrupulously follow our own protocols as set out here.
If you have any questions about this policy, please contact us at email@example.com
- Why we collect your data
We collect and process personal data about the people who interact with us. The kind of data we collect depends on someone’s needs, and how they’re using our services. For instance, we might collect data to communicate with someone and send requested information to them, to help us administer donations, or to improve our services.
We collect the minimum of data required to provide our services and do our work. We’re completely committed to protecting your data and privacy, and we pride ourselves on taking great care to ensure it stays completely safe.
Some of the reasons we might collect your data include:
- to provide you with the support, you have requested or been referred to us for
- to record personal details shared during conversations with our support workers, to ensure we continue to provide you with the best possible support
- to let you know about ways in which you can utilise your skills and experience to influence, shape and support the organisation
- to let you know about our events and opportunities for co-production
- to administer the services Family Support Link is providing to you
- to communicate with you regarding Family Support Link’s work, fundraising, and campaigning activities
- to process donations and administer Gift Aid information for any donation you make to Family Support Link.
- to provide you with information about and to administer events, including training sessions
- to manage your communication preferences
- to process job applications or volunteer placements
- to conduct surveys, research and gather feedback
- to obtain information to improve our services and user experiences
- to address and resolve complaints about our services
- to comply with applicable laws and regulations, and requests from statutory agencies
- to comply with our contractual obligations to our funders
- Information we collect
Depending on how you use our services, the types of information we collect from you might include:
- your full name and date of birth
- contact details – including your postal address, telephone number(s), and email address
- details of your case when providing you services
- your bank details
- records of your correspondence and engagement with us
- donation history and Gift Aid details
- information you may enter on the Family Support Link website
- photographs, video or audio recordings
- biographical information
- other information you share with us
This information may be collected via:
- any paper forms you complete
- telephone, webchat or email conversations, or face-to-face interactions
- digital forms completed via our website, or online surveys
- third-party companies and websites such as my giving hub or Just giving
- publicly available sources
- communication via social media
We sometimes also collect sensitive, personal data about individuals. This includes information about health, religion, sexuality, ethnicity, political and philosophical beliefs, and criminal records. We will normally only record this data where we have your explicit consent, unless we are permitted to do so in other circumstances under data protection law.
Where we are providing you with support services, we may record your sensitive personal data if this is necessary for the delivery of health, therapeutic and care interventions, or if it is in the substantial public interest because we would not be able to provide our services without doing so.
- Using your personal data
If you are receiving support from us, or if someone else has referred you to us for such a service, we will need to process your data because of your specific relationship with us.
We will keep all your relevant personal information – including notes, letters, emails and information given to us about you – in a confidential record that is specific to you. We use an electronic case management system as well as paper records to support our advice, guidance and support provision. This means that we can keep the information you provide us, so we are able to see the history and relevant details of your case(s). This ensures that we provide appropriate and accurate advice or support. We take information security very seriously. No one is allowed access to our system or files unless they need this to provide the service to you, or for one of the other purposes discussed in this notice.
We may need to disclose and discuss your personal information to third party individuals or organisations if this is necessary to help resolve your issue. Examples include:
- your GP or medical professionals
- legal representatives or advisers
- Local Authority safeguarding teams
- the court
- your landlord
- council housing, social services and Housing Benefits teams
- the DWP/Job Centre or HMRC
We will discuss this with you as we go along, and will only act with your express consent unless one of the other legal bases in data protection legislation applies.
To ensure that our services meet a high standard of quality, client files are Audited by our Management team. Files may also be checked by external auditors if the work we do is funded by another organisation, such as a local authority or NHS trust. All auditors are bound by confidentiality policies.
Where our funders require it as a condition of our contract with them, we may use your data in reports to them. Typically this is so that they can monitor the outcomes of the help we have provided to you, to ensure we are meeting the terms of our contract with them.
We may use your data for general statistical reports. These statistics will not include any information that could be used to identify any individual.
The type of information we need from you will vary depending on our relationship with you. When we ask you for information, we will make it clear why we need it.
- How we collect your information:We collect most of our information directly from you, including when you use one of our services, complete one of our forms, when you write, phone, email or meet with us. We also collect information from other third parties where it is relevant to the service we are providing to you. This includes:
- Local authorities, health and social care professionals, previous care /support providers
- Other housing, care and support service providers, and referral agencies where we are working in partnership with them
- Your family, next of kin and support network when it is directly related to your care and support
- Any other statutory agencies involved in your support where relevant
- How we use your personal information:
- To assess your support needs, determine your eligibility for a service, enter into a support agreement with you and to provide you with personalised support: As a provider of support services, we need information about you to deliver our services and to meet your assessed needs. We need this information to assess your eligibility for a service and offer you an appropriate support service. We use this information to deliver support to you and review your progress at regular intervals.
- To keep individuals safe and make sure no one is at risk of harm: We have a legal duty to do what we can to keep people safe – this includes you, our staff, as well as others that may be involved in supporting you. We use this information to agree a safety and protection plan or other emergency responses with you if this is necessary.
- To contact and communicate with you: We use your contact details (including telephone numbers and email addresses) to get in touch with you about issues relating to the service we have agreed to provide you. We will not share your contact details except with your consent or where it is necessary to provide a service to you. We do not sell, share, or provide contact details for marketing or other purposes.
- To monitor equality, diversity, and inclusion: We ask you to provide us with your diversity data (ethnicity, religion, sexual orientation). This information is not used to inform any decisions we make about you individually but is gathered for statistical purposes to help us understand who is using our services. It helps us ensure fairness and equality in the services we provide. You do not have to provide this information, but it helps us if you choose to do so.
If you believe that you are adversely affected by us processing your data for our ‘legitimate interests’, you may ask us to stop processing it. This may not always be possible though we will explain why, if this is the case.
- Sharing your personal information
If we are working with other organisations or services to support you, we may have to share information with them. We only do this if we have a good reason to and it is necessary for delivering the agreed support. Where we are providing support services as part of a local authority contract, we may share your information with the commissioning local authority. Sometimes we might have to share information with authorities if we think that you or someone else is at serious risk of abuse or harm. We don’t need your consent to do this. Other organisations we may share your information with include:
- Government departments such as the Benefits Agency
- Police and other law enforcement agencies
- Representatives acting on your behalf
- Care Quality Commission
- Fundraising/campaigning/direct marketing
We would love to keep you up to date with our fundraising, marketing and campaigning activity.
We will obtain your consent to contact you by email and text message for marketing purposes.
We will never share or sell your personal data to a third-party organisation for its marketing, fundraising or campaigning purposes.
You can withdraw your consent, unsubscribe from or update your marketing preferences at any point by contacting us at firstname.lastname@example.org
If you make any changes to your consent, we will update your record without undue delay and at the latest within one month of receipt. If you tell us you do not wish to receive marketing, fundraising or campaign communications, you may still receive transactional and service-based communications confirming and servicing other relationships you have with us (as described below).
Where possible, we cleanse and remove out of date data by checking it against publicly available records such as deceased records. This helps us to improve the delivery rate of our mailings and minimise wasted expenditure.
- Fundraising & donations
When donating online, MyGivingHub will confirm authorisation of your payment by an acknowledgement displayed on-screen, followed by an e-mail which will be sent to the e-mail address You provide with your details.
Donations towards Family Support Link will be processed off site by MyGivingHub (https://www.mygivinghub.com).
By using a credit or debit card to donate, You confirm that the card being used is yours. All credit and debit cardholders are subject to validation checks and authorisation by the card issuer. If the issuer of your card refuses to authorise payment, we will not accept your payment and we will not be liable for any payment delay or consequences of overdue payment and we are not obliged to inform You of the reason for the refusal. We are not responsible for your card issuer or bank charging You as a result of our processing of your credit or debit card payment in accordance with your payment request.
- Gift Aid For UK Taxpayers
To qualify for Gift Aid, you must have:
- Paid UK Income or Capital Gains Tax in that financial year.
- Paid the equivalent amount in tax of the Gift Aid the Charity will reclaim on your donation.
- Notify your supported Charity if you stop paying enough tax, for example, you stop working or your tax rate changes.
MyGivingHub will capture your declaration that You are a UK Taxpayer and have declared that You wish for the Charity or Cause to reclaim Gift Aid. MyGivingHub will mark donations as eligible for the Charity or Cause to make the Gift Aid reclaim. Gift Aid declarations must be renewed annually.
- Your Right To Claim A Refund
Refunds will only be made where a donation has been processed in error or through unauthorised use of your card and only with the prior approval of the Charity or Cause.
Where you have donated to a particular appeal or campaign we may contact you again about similar appeals or campaigns. We will always give you the opportunity to opt out of receiving further communications of this nature.
- Applying for Family Support Link job
When you apply for a job with us, your personal data will be collated to monitor the progression of your application, and the effectiveness of the recruitment process through the statistics collected. Where we need to share your data – such as for gathering references, obtaining a Disclosure and Barring Services/Disclosure Scotland check (depends on the role), or a prison clearance (depends on the role) – you will be informed beforehand, unless the disclosure is required by law.
These checks are only done after a position has been offered only to the successful candidate. On the application form, you are asked to complete the referee details, and can tick permission to contact referee. If you tick yes, once offered a role, we will automatically send out reference requests. If you tick no, we will contact successful candidates for permission first.
Personal data about unsuccessful applicants are held for 6 months after the recruitment exercise is complete for that vacancy. You, as an applicant, can ask us to remove your data before this time if you do not want us to hold it. If we feel there is another suitable vacancy available, we will contact the applicant prior to sharing your application details with the relevant manager.
Once you have taken up employment with Family Support Link we will compile a file relating to your employment. The information contained in this will be kept secure and will only be used for purposes directly relevant to your employment. Once your employment with us has ended, we will retain the file in accordance with the requirements of our retention schedule and then delete it from our files.
- Professional contacts
We may collect data about professional contacts and partners with whom we work, or to whom we provide professional services – such as training and awareness sessions. Personal data collected in this way will be processed in accordance with data protection legislation and this policy.
We may send our professional partners information and updates about our work (primarily by email). Such contacts can opt out of receiving this information at any time.
- Our legal basis for processing personal data
The law requires us to tell you the basis on which we process your data. These include:
- To provide support services: We process your information so that we can provide the service we have been commissioned to provide.
- For the performance of a contract: Some of our processing is carried out to fulfil a contract or an agreement we have with you. Where we require information because it is necessary in the performance of a contract you will not be able to opt out of providing this information. This is because without it we would be unable to do what you have asked us to do. We consider a contract to include a client contract/agreement signed by you.
- To fulfil our legal and regulatory obligations (substantial public interest): Some of our processing is carried out to ensure we fulfil our legal and regulatory obligations in providing support services, for example under the:
- Companies Acts
- Charities Acts
- Care Act 2014
- Health and Social Care Act 2008
- Mental Capacity Act 2005
- Mental Health Act 1983
- Health & Safety Legislation
Consent: In some instances, we may ask for your consent to process your information where there is no other legal basis to do so. This applies to special categories of data such as your health information.
Where it is necessary for our legitimate interests: In all other cases, we rely on a condition called “legitimate interests”. The law allows us to process your data if it is in our legitimate interests to do so. But we can only do this if:
- it does not disproportionately affect your rights
- it doesn’t cause you any harm
- it isn’t overly intrusive
The law also says we must let you know what we consider our legitimate interests to be, in holding relevant personal data in relation to your support.
Our legitimate interests are to ensure that:
- we are meeting our objectives as a charity
- our services can meet peoples’ needs now and in the future
- our services are accessible
- we make the most efficient use of our resources
- we understand how we are performing
- we provide a safe service
- we understand people’s experiences and views so we can make our services better
In all such circumstances where we may process the data in our Legitimate Interests, you may have the right to object to such processing.
- Disclosure of your personal data
We will not share any of your personal data with any third party – except where:
- the transfer is to a secure data processor, which carries out data processing operations on our behalf.
- we are required to do so by law, for example to law enforcement or regulatory bodies where this is required or allowed under the relevant legislation
- we are required to do so because it is a condition of our funding or service provision that we share certain information with the funder or with partnership organisations. We will tell you if this is the case.
- it is necessary to protect the vital interests of an individual
- we have obtained your consent
We will never share or sell your personal data to a third-party organisation for marketing, fundraising, or campaigning purposes.
- Security of your personal data
We use appropriate technical and organisational measures and precautions to protect your personal data and to prevent the loss, misuse or alteration of your personal data.
Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our website. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.
We encourage you to review the privacy statements of websites you choose to link to from our websites, so that you can understand how those sites collect, use and share your information. We are not responsible for the privacy statements, security, or other content on sites outside of the website.
- Use of data processors
We may use a third-party supplier to manage mailings, conduct research surveys or storage of your personal information on our behalf, and to provide some of our advice and support services to you. You can find out more about the suppliers that we use by getting in touch with us using the details in the ‘Contact us’ section below.
We actively screen and monitor these companies to maximise the protection of your privacy and security. They are only permitted to use the data in accordance with relevant data protection legislation, under strict instructions from us, and in accordance with a data processing agreement entered into between Family Support Link and the supplier.
- Transfers of data outside of the European Economic Area
We use Microsoft Office 365 which is a multi-tenant cloud service, for our internal office use. This means that internal documents and information generated by us are stored in cloud services hosted within the European Economic Area (EEA).
However, in some limited cases, we may use data processors that process and/or store data outside of the EEA .In these cases, we will take reasonable steps to ensure that we implement appropriate measures to protect your information. These may include, EU Standard Contractual Clauses or UK Data Protection Transfer Agreements. In all such cases and where it is deemed appropriate, we will conduct risk assessments.
- Record Retention & Accuracy
Whatever your relationship with us, we will only store your information for a specified amount of time, as set out in our Data protection & Subject access policy. All records paper or electronic will be regularly reviewed to ensure accuracy as far as is practicable. Record retention will be in line with Article 5 of the UK GDPR principles and with exception of the data held by the Northamptonshire treatment system (7years) not kept in a form which permits identification of data subjects for longer than is necessary for the purposes for which the personal data is processed.
Personal data about unsuccessful Job applicants are held for 6 months after the recruitment for that vacancy is completed.
If you request to receive no further contact from us, we will keep some basic information about you on our suppression list to avoid sending you unwanted materials in the future.
- Individual Rights
The UK GDPR provides the following rights for individuals:
- The right to be informed
- The right of access
- The right to rectification
- The right to erasure
- The right to restrict processing
- The right to data portability
- The right to object
- Rights in relation to automated decision making and profiling.
- The Right To Be Informed
We will ensure through our Client Contract we provide individuals with clear and concise information about what we do with their personal data and how this data will be used and stored.
- Subject Access Requests
An individual can make a subject access request verbally or in writing. It can also be made to FSL electronically (including by social media) and does not have to be to a specific person or contact point.
A request does not have to include the phrase 'subject access request' or Article 15 of the UK GDPR, as long as it is clear that the individual is asking for their own personal data.
In most cases we will not charge a fee to comply with a subject access request.
However, where the request is manifestly unfounded or excessive we may charge a “reasonable fee” for the administrative costs of complying with the request.
We may also charge a reasonable fee if an individual requests further copies of their data following a request. This fee will be based on the administrative costs of supplying further copies.
We will act on the subject access request without undue delay and at the latest within 28 Days of receipt.
We will calculate the time limit from the day after we receive the request (whether the day after is a working day or not) until the corresponding calendar date in the next month.
Under the DPA 2018 we have the right to extend our response time by a further two months if the request is complex or we have received a number of requests from the individual. We will ensure that we let the individual know within one month of receiving their request and explain why the extension is necessary. We will ensure that the extension is not manifestly unfounded or excessive.
If necessary, we may ask for proof of identity to the individual making the claim but we will ensure that this is proportional and not excessive.
Email is at email@example.com or write to the Chief Executive, Family Support Link, West End House, 60 Oxford Street, Wellingborough, Northants NN8 4JJ
- Right to Rectification
The Data Protection Act 2018 (DPA 2018) states that personal data is inaccurate if it is incorrect or misleading as to any matter of fact.
Individuals to have inaccurate personal data rectified, or completed if it is incomplete. An individual can make a request for rectification verbally or in writing and this does not have to be a specific person or contact point. We will respond to your request within one calendar month.
- Right to erasure
The UK GDPR introduces a right for individuals to have personal data erased. The right to erasure is also known as ‘the right to be forgotten’. Individuals can make a request for erasure verbally or in writing. We will respond to your request within one calendar month.
The right is not absolute and only applies in certain circumstances.
- The right to restrict processing
Individuals have the right to request the restriction or suppression of their personal data. This is not an absolute right and only applies in certain circumstances. When processing is restricted, Family Support Link are allowed to store the personal data, but not use it. An individual can make a request for restriction verbally or in writing. We will respond to your request within one calendar month.
- The right to data portability
The right to data portability allows individuals to obtain and reuse their personal data for their own purposes across different services. It allows them to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way, without affecting its usability. Doing this enables individuals to take advantage of applications and services that can use this data to find them a better deal or help them understand their spending habits. The right only applies to information an individual has provided to a controller.
- The right to object
The UK GDPR gives individuals the right to object to the processing of their personal data in certain circumstances. Individuals have an absolute right to stop their data being used for direct marketing. In cases where the right to object applies, we will tell service users of their right to object. An objection can be made verbally or in writing, we will respond to your request within one calendar month.
By service users accessing support from Family Support Link and signing and agreeing to a client contract we will collect and hold data about them, the services they receive and the outcomes from them on behalf of the Northamptonshire Treatment System. As these records with the Northamptonshire Treatment System will contain health related information, they will be held for 7 years from the service users last contact with its services.
- Rights in relation to automated decision making and profiling.
The UK GDPR has provisions on:
- automated individual decision-making (making a decision solely by automated means without any human involvement); and
- profiling (automated processing of personal data to evaluate certain things about an individual). Profiling can be part of an automated decision-making process.
The UK GDPR applies to all automated individual decision-making and profiling.
Article 22 of the UK GDPR has additional rules to protect individuals if we are carrying out solely automated decision-making that has legal or similarly significant effects on them.
We can only carry out this type of decision-making where the decision is:
- necessary for the entry into or performance of a contract; or
- authorised by domestic law applicable to the controller; or
- based on the individual’s explicit consent.
We must identify whether any of our processing falls under Article 22 and, if so, make sure that we:
- give individuals information about the processing;
- introduce simple ways for individuals to request human intervention or challenge a decision;
- carry out regular checks to make sure that our systems are working as intended.
For further information about your rights under the DPA 2018 please refer to the government’s guidance on data protection https://www.gov.uk/data-protection
If you are not satisfied with the way that we have managed your personal data, please let us know and we will try and resolve your concerns. Please contact your service in the first instance, or the person who is dealing with the issue. If you are not satisfied with the outcome, you can make a formal complaint by emailing us at firstname.lastname@example.org or calling us 01933 224632 and using our complaints policy. If you are still not happy with our response, you have the right to appeal directly to the regulator: Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF Visit: https://ico.org.uk or telephone: 0303 123 1113
If you have any questions or would like more information about this policy or our data protection and subject access request policy, or want to exercise any of the rights set out in the ‘Your rights’ section above, you can get in touch with us in the following way.
Email us at email@example.com
Call us on 01933 224632
We will only process your personal data in accordance with our policy and the law. We use essential cookies to ensure our website operates properly. Where we use other types of cookies we will ask for your consent.
We do update this policy from time to time so please return and review it regularly.
Information we collect
In operating our website we may collect and process the following data about you:
- Details of your visits to our website and the resources that you access including, but not limited to, traffic data, location data, weblogs, and other communication data.
How we use your information
The information we collect and store relating to the use of this website is exclusively used to enable us to provide our services to you.
We do not reveal this information to third parties.
We may include links on our website to other websites which we do not control or manage. We do not accept any responsibility for how these websites use your information and you should check their own privacy policies.
A cookie is a small file which asks permission to be placed on your computer’s hard drive. Once you agree, the file is added and the cookie helps analyse web traffic or lets you know when you visit a particular site.
There are two main kinds of cookies: “session” cookies and “persistent” cookies. Session cookies only last while you are online and are deleted when you close your internet browser. Persistent cookies outlast user sessions and remain stored on your computer until you delete them or until they reach their expiry date.
Cookies do not contain any information that personally identifies you and a cookie in no way gives us access to your computer or any information about you.
Most browsers allow you to manage cookies and disable them if you want.
If you have any questions or concerns about the use of your personal information, please contact:
or call us 01933 224632