This privacy notice explains how the Realise Charity will use any personal data you provide to us. Please read this notice carefully and make sure that you understand your rights and responsibilities.

From time to time, as our organisation evolves and develops we may update and make changes to this privacy notice.

Automated individual decision-making is making a decision solely by automated means without any human involvement.

Data controller means a company or person who determines the purposes for which, and the manner in which personal data is processed.  In this context this relates to the Realise Charity as an organisation.

Data subject means an individual who is the subject of personal data.

Data processor, in relation to personal data, means any person (other than an employee of the data controller) who processes the data on behalf of the data controller.

 

Data Protection Officer is the person responsible for overseeing Data Protection within the organisation.

 

Information Commissioners Office (ICO), The Information Commissioner’s Office in the United Kingdom, is a non-departmental public body which reports directly to Parliament. They are responsible for implementing data protection law and carrying out enforcement actions.

 

Lawful Grounds for processing data – Conditions that must apply for organisations to lawfully process personal data.

 

Personal data means any information relating to an identified or identifiable natural person (“data subject”); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person.

Processing means obtaining, recording or holding information or data or carrying out any operation or set of operations on that data.

Profiling is automated processing of personal data to evaluate certain things about an individual.

Sensitive personal data (also referred to as “special categories of personal data” under GDPR) means personal data relating to the data subject which includes information such as:  race, ethnic origin, politics, religion, trade union membership, genetics, biometrics (where used for ID purposes), health, sex life, or sexual orientation.

The data controller is the REALISE FOUNDATION [trading as Realise charity].

The Realise charity provides valuable support to help young people to progress in their personal development, education and gain employment. We help people to overcome barriers to skills, employment and health, and provide targeted support for disadvantaged local communities. The Realise charity is a subsidiary of Aspire Housing.

We are a not-for-profit organisation, recognised as charitable by HMRC for tax purposes. Our Registered Office is Aspire Housing, Kingsley, The Brampton, Newcastle-under-Lyme, ST5 0QW Telephone: 01782 635200

ASPIRE HOUSING LIMITED is the parent company of REALISE FOUNDATION [trading as Realise charity], and PROJECT MANAGEMENT (STAFFORDSHIRE) LIMITED [trading as PM Training]. Each of these organisations have their own privacy notice that can be found on their web sites. ASPIRE HOUSING LIMITED also own the trading name Cerris Homes.

The Data Protection Officer (Tim Pratt) is the person responsible for overseeing Data Protection within the organisation and can be contacted at the above address.

How we collect personal information

We collect information in a variety of ways including, cookies using this website (see more information below); on various forms, membership forms, donations forms, beneficiary forms, sponsorship forms and contracts; through our on- going contact with you; in some cases we collect CCTV images; and calls to and from our telephone lines and online chats are recorded.

 

When you apply to become a beneficiary, we request and hold on file any references necessary to assess your application including as appropriate (but not limited to) references from other organisations, employers and PM Training case workers.

 

If you provide us with personal information relating to members of your family or your associates we will assume that you do so with their knowledge.

 

It is important that you notify us of any changes to your personal information.

 

The information we collect

We collect personal information about:

 

Beneficiaries – This includes current, former and potential beneficiaries, who access our support and other services.

 

Donors and sponsors – This includes anyone who sponsor our activity or who makes a donation to our charity.

 

Colleagues – This includes current, former and potential colleagues, as well as Board and Committee members, apprentices and volunteers.

 

Anyone who makes a complaint or enquiry and visitors to our website and offices

 

Whenever we collect personal information from you we will always issue you with a privacy notice at the point of collection explaining why we are collecting that personal data.

We will collect, process, share and securely store personal information in order to carry out fund raising and effectively distribute funds and grants to our beneficiaries.

All information will be retained in accordance with the requirements of our retention schedule.

Below we will describe the different lawful basis for processing personal (Section 4.1) and special categories of personal data (section 4.2). We will then describe the purposes and lawful basis under which the Realise Charity processes data (section 4.3).

Under GDPR the lawful grounds for processing are set out in Article 6. At least one of these conditions must apply before the Realise charity can process your personal data. The lawful conditions are as follows:

 

(a) Consent: Where the data subject has given clear consent for Realise to process their personal data for a specific purpose. Where the processing is based on consent a data subject can withdraw that consent at any time.

 

(b) Contract: the processing is necessary for a contract Realise has with a data subject, or because the data subject has asked Realise to take specific steps before entering into a contract.

 

(c) Legal obligation: the processing is necessary for us to comply with the law. Housing Associations are regulated by Homes England. We also have to comply with UK law.

 

(d) Vital interests: the processing is necessary to protect someone’s life.

 

(e) Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.

 

(f) Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests.

Special categories or “sensitive personal data” specifically includes data with regard to race, ethnic origin, politics, religion, trade union membership, genetics, biometrics (where used for ID purposes), health, sex life, or sexual orientation.

 

We must still have a lawful condition for processing sensitive personal data, in exactly the same way as for any other personal data. The difference is that we will also need to satisfy a specific condition under Article 9. There are a number of conditions at article 9 but for Realise typically these are:

 

(a) Explicit Consent: the data subject has given explicit consent.

 

(b) Employment, social security and social protection law  – Processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law.

 

(c) Vital interests – Processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent.

 

(h) Preventative or occupational medicine – processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards.

 

To find out more about the legal basis for processing personal data please visit the Information Commissioners Office (ICO) website: https://ico.org.uk/

The purposes and legal basis for processing data under the GDPR are detailed in the tables below. This has been grouped into personal data about:

  • Beneficiaries
  • Donors and sponsors
  • Colleagues
  • Other individuals who may make a complaint or enquiry

 

Beneficiaries
Purpose of collecting data Lawful condition to process data
Contact our beneficiaries We have a legitimate interest to be able to contact our beneficiaries and ensure they are benefitting from our grants and funding.
Process applications for grants and funding As part of your application for a grant or funding we will ask you to provide us with information to prove your eligibility and suitability to become a beneficiary. It is our legitimate interest to ensure that funds are distributed effectively.

 

You may also provide us with special categories of data, such as data concerning your health in order to support your case as a beneficiary.  Where you provide us with special category data we will only process that data based on your consent, and you have the right to remove that consent at any time.

 

We have a legitimate interest to contact third parties and check the validity of any information provided during the allocation process.

 

We have a legal obligation to keep records of the allocations of our grants and funding.

 

Manage grants and funding We have a legitimate interest to keep information up to date in order to tailor our services to meet your individual needs and awards are utilised in the most effective way possible.

 

We also have a legitimate interest to ask if you would like to be referred to other organisations that may assist in your development, education and seeking employment. In this situation we will only pass on your personal information with your consent. You may remove your consent to this at any time.

 

We have a legal obligation to safeguard young people and refer you on to the relevant services if we believe it to be an issue. It is also in the public interest to address concerns over safeguarding.

Receive grant and funding You are required to supply your bank details in order to receive funding. We have legitimate interest to ask for this information.
Verify that grants and funding are used in the way it was intended We have a legitimate interest to verify that grants and funding have been used as intended. This may require the submission of receipts for services or items purchased with the funding.
Engage with customers and make improvements to our charitable work We have a legitimate interest to contact you and find out how we can make improvements to our charitable work through our market research surveys.

 

We also have a legitimate interest in making our services the best that they can be and promote the success of our organisation.

 

Marketing to encourage uptake of our services We have a legitimate interest to send you information about services that may assist you in your personal development, education, and search for employment.

 

You may ask us to remove you from our email alert lists at any time by unsubscribing within your customer account, or by clicking on any ‘unsubscribe’ link from one of our communications. You can also request to opt out by contacting our delivery team.

 

In the event of us using case studies or photographs of some of our success stories, we will always get the consent of the individuals featured in those photographs or case studies before sharing with other organisations or making public.

Record contact with beneficiaries We have a legitimate interest to record telephone calls for training purposes.

 

We have a legitimate interest to record contact made through online contact forms, social media, email and other methods of contact. We may use this information to monitor the progress of enquiries and keep records of actions and decisions made throughout our relationship with you.

 

 

Donors and sponsors
Purpose of collecting data Legal basis to process data
Maintain a list of charity members We have a legitimate interest to be able to contact our charity members and inform them of our work, events, how they can make further donations and make the most of their membership.
Process donations and sponsorship We have a legal obligation to keep records of the donations and sponsorship we receive. In order to make a donation we will ask you to complete donation and sponsorship forms as a record of your donation.

 

Where donors request donations to be deducted from bank accounts we will ask donors to submit their bank details. We will process your bank details based on your consent and you may remove your consent to process your bank details at any time.

 

We will seek your consent to receive gift aid and will process personal information accordingly.

Engage with donors and sponsors and make improvements to our charitable work We have a legitimate interest to contact you and find out how we can make improvements to our charitable work through our market research surveys.

 

We also have a legitimate interest in making our services the best that they can be and promote the success of our organisation.

 

Marketing to encourage donations and sponsorship We have a legitimate interest to encourage donations and sponsorship so that we can support more individuals in their development, education, and finding employment.

 

You may ask us to remove you from our email alert lists at any time by unsubscribing within your customer account, or by clicking on any ‘unsubscribe’ link from one of our communications. You can also request to opt out by contacting our customer services team.

 

In the event of us using case studies or photographs of some of our success stories, we will always get the consent of the individuals featured in those photographs or case studies before sharing with other organisations or making public.

Record contact with donors and sponsors We have a legitimate interest to record telephone calls for training purposes.

 

We have a legitimate interest to record contact made through online contact forms, social media, email and other methods of contact. We may use this information to monitor the progress of enquiries and keep records of actions and decisions made throughout our relationship with you.

 

 

 

Colleagues
Purpose of collecting data Legal basis to process data
Keep and maintain up to date information about Directors to maintain statutory registers We have a legal obligation to maintain statutory registers.
Maintain personnel files for all staff We have a legal obligation to maintain certain records in relation to employees and a legitimate interest in keeping personnel files for all staff (namely as a record of the employment relationship).

 

This will include details of any training or other qualifications that may be required to be refreshed and updated after a certain amount of time.

 

For some job roles we may carry out regular Disclosure and Barring Service (DBS) checks where we have a legal obligation to safeguard our customers under the Safeguarding Vulnerable Groups Act 2006

as amended by the Protection of Freedoms Act 2012.

 

We have a legal obligation to ensure that all staff have the right to work in the UK under the Immigration, Asylum and Nationality Act 2006.

Giving or receiving of employee references Where we receive employee references, it is because we have a legitimate interest in verifying your employment history and in order to assess your suitability for employment with us.
Process salary and expense payments We have a legal obligation to keep records of expenses and salary payments. We need to process staff members bank details in order to pay salaries and expenses in accordance with the contract of employment.
Process pensions and other benefits We have a legal obligation to keep records of pensions and any other benefits that a staff member may be receiving.
Maintain records of sickness and absence We need to understand whether we should be paying sick pay.  We have a legal obligation to pay statutory sick pay where an individual is entitled to, and it is necessary for the purposes of the contract of employment to assess entitlement to occupational sick pay.

 

We have a legitimate interest to keep levels of absence to a minimum.

Ensure staff are healthy and fit for work We have a legal obligation to ensure that staff and apprentices are fit to work and/or remain in work. Typically this would involve a referral to an occupational health specialist to understand what support we can put in place, including a phased return to work and/or any reasonable adjustments and this report then being shared with Realise.  Processing of this information is necessary for the purposes of assessing the working capacity of an employee and/or to obtain a medical diagnosis.
Ensure staff are compliant with relevant laws We have a legal obligation to ensure that staff are operating within the law and any qualifications or licences required to carry out their roles are kept up to date (e.g. driving licence).
Maintain a register of accidents We have a legal obligation to keep a record of accidents that occur within the organisation. This information may be used to understand patterns of behaviour and avoid future accidents. It may also be used to assist with the processing of future insurance claims.
Promote equal opportunities and fair treatment for all colleagues We have a legal obligation to treat people fairly under the Equality Act 2010.

 

In order to do this Realise hold information on age, disability, gender, marriage and civil partnership, pregnancy and maternity, race, religion and belief and sexual orientation to ensure people are treated fairly and equally.

Manage employment and colleague development We have a legitimate interest to use information to develop staff and apprentices to realise their potential and maximise their contributions to the organisation.

 

Staff and apprentices are encouraged to talk about their development needs in one-to-one meetings with their line managers.

Ensure compliance with policies and procedures and employee rules We have a legitimate interest in ensuring that the policies and procedures which we implement for the benefit of the organisation are followed and that breach of them is addressed appropriately
Ensure effectiveness of systems and  compliance with user policies We have a legitimate interest to keep system logs of users to ensure compliance with the information Security and Systems usage policy.

 

We also have a legitimate interest to keep records of IT issues to help find resolutions to problems and maintain effective systems.

Record contact with Realise We have a legitimate interest to record telephone calls for training purposes.

 

We have a legitimate interest to record contact made through online contact forms, social media, email and other methods of contact. We may use this information to monitor the progress of enquiries and keep records of actions and decisions made.

 

 

 

Other individuals who may make a complaint or enquiry
Purpose of collecting data Legal basis to process data
Processing of job applications Data received within job applications is processed on the basis of consent. An individual can withdraw that consent at any time.

 

For some job roles we may carry out regular Disclosure and Barring Service (DBS) checks where we have a legal obligation to safeguard our customers under the Safeguarding Vulnerable Groups Act 2006

as amended by the Protection of Freedoms Act 2012. It is also in our legitimate interests.

 

Where we receive employee references, it is because we have a legitimate interest in verifying your employment history and in order to assess your suitability for employment with us.

 

We have a legitimate interest to contact third parties and check the validity of any information provided during the recruitment process.

 

Failure to provide personal data

A failure to provide personal data may result in us being unable to assess the suitability of the candidate for the role.

Processing of complaints It is our legitimate interest to process complaints data and understand how we can improve our services.
Keep staff and premises secure The Realise Charity has a legitimate interest to keep premises and staff safe and secure with the use of CCTV.
Process beneficiary applications As part of your application for a grant or funding we will ask you to provide us with information to prove your eligibility and suitability to become a beneficiary. It is our legitimate interest to ensure that funds are distributed effectively, and is also part of your beneficiary contract with the Realise Charity.

 

You may also provide us with special categories of data, such as data concerning your health in order to support your case as a beneficiary.  Where you provide us with special category data we will only process that data based on your consent, and you have the right to remove that consent at any time.

 

We have a legitimate interest to contact third parties and check the validity of any information provided during the allocation process.

 

We have a legal obligation to keep records of the allocations of our grants and funding.

Contact suppliers, contractors, and maintain relationships with any other external organisations It is our legitimate interest to hold contact details of individuals from the organisations we work in order for us to carry out our work as a charity.
Record contact with enquirers We have a legitimate interest to record telephone calls for training purposes.

 

We have a legitimate interest to record contact made through online contact forms, social media, email and other methods of contact. We may use this information to monitor the progress of enquiries and keep records of actions and decisions made off the back of an enquiry.

 

Automated decision making and profiling

The GDPR has provisions on:

  • Automated individual decision-making (making a decision solely by automated means without any human involvement).
  • Profiling (automated processing of personal data to evaluate certain things about an individual). Profiling can be part of an automated decision-making process.

 

The Realise Charity may use automated decision making and profiling for recruitment and selection purposes.

The Realise Charity is committed to respecting and protecting your personal data. In certain circumstances we may need to share your personal data with other organisations. When we share personal data to complete a task we will only share the minimum personal data required to complete that task. We will never sell, rent or trade your personal data.

 

We will also pass your information on to third parties whom you may ask us to, for example if you ask us to put you in contact with professional advisors.

 

Who we share data with

We may share your data with the following organisations.

  • Auditors
  • Business associates and professional advisers
  • Charities and voluntary organisations
  • Current, past or prospective employers
  • Customers and clients
  • Data Processors
  • Debt collection and tracing agencies
  • Educators and examining bodies
  • Employee benefit providers
  • Employees
  • Employment and recruitment agencies
  • Enquirers and complainants
  • Family, associates and representatives of the person whose personal data we are processing
  • Financial organisations
  • Grant funders
  • Health Authorities
  • Healthcare, social and welfare organisations
  • HMRC
  • Local and central government
  • Members
  • Other companies in the same group as the data controller (PM Training, Aspire Housing)
  • Other voluntary and charitable organisations
  • Pension providers
  • Police forces
  • Press and the media
  • Probation services
  • Professional advisers and consultants
  • Providers of goods and services
  • Security organisations
  • Suppliers and service providers
  • Survey and research organisations
  • Trade unions and associations
  • Trade, employer associations and professional bodies

Under the GDPR you have the following main rights:

 

  1. The right to be informed about how and why we gather your personal information, how we keep it and what we do with it.
  2. The right to access the personal data we hold about you. This is known as a ‘subject access request (SAR). SARs need to be made in writing and we have one calendar month to provide you with the information you have asked for. The period of compliance may be extended to two months where requests are complex or numerous.
  3. The right to have the information rectified if it is inaccurate or incomplete.
  4. The right to have your information erased from our records. You can do this where:

 

  • the information is no longer necessary in relation to the purpose for which we originally collected/processed it
  • where you withdraw consent
  • where you object to the processing and there is no overriding legitimate interest for us continuing the processing
  • where we unlawfully processed the information
  • the personal information has to be erased in order to comply with a legal obligation

 

We can refuse to erase your personal information where the personal information is processed for the following reasons:

 

  • to exercise the right of freedom of expression and information;
  • to enable functions designed to protect the public to be achieved e.g. government or regulatory functions
  • to comply with a legal obligation or for the performance of a public interest task or exercise of official authority;
  • for public health purposes in the public interest;
  • archiving purposes in the public interest, scientific research historical research or statistical purposes;
  • the exercise or defense of legal claims; or
  • where we have an overriding legitimate interest for continuing with the processing

 

  1. The right to object to processing where we say it is in our legitimate interests. We must stop using the information unless we can show there is a compelling legitimate reason for the processing, which override your interests and rights or the processing is necessary for us or someone else to bring or defend legal claims.
  2. You have the right to require us to stop processing your personal information. When processing is restricted, we are allowed to store the information, but not do anything with it. You can do this where:
  • You challenge the accuracy of the information (we must restrict processing until we have verified its accuracy)
  • You challenge whether we have a legitimate interest in using the information
  • If the processing is a breach of the GDPR or otherwise unlawful
  • If we no longer need the personal data but you need the information to establish, exercise or defend a legal claim.

If we have disclosed your personal information to third parties, we must inform them about the restriction on processing, unless it is impossible or involves disproportionate effort to do so.

 

 

  1. The right to request that your data be copied or transferred to another organisation in certain circumstances.
  2. The right to complain to us and/or to the Information Commissioner’s Office if your information is being used unlawfully (contact details are below).
  3. The right to challenge any automated decision making or profiling that may be carried out using your information.

 

If you would like to contact us about your data protection rights please contact the Data Protection Officer (Tim Pratt): Data Protection Officer, Aspire Housing, Kingsley, The Brampton, Newcastle-under-Lyme, ST5 0QW. Telephone: 01782 635200. Email: governance@aspiregroup.org.uk.

 

If you would like to complain to the Information Commissioners Office the contact details are as follows: Information Commissioners Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. https://ico.org.uk

Where we transfer data outside of the EU we will only transfer data in compliance with the GDPR transfer rules. We have GDPR data processing agreements in place where data is hosted outside of the EU.

Cookies are small text files placed on your computer by the websites you visit. They are used to help make websites work efficiently. You can control cookies through the settings of your web browser. To find out more, visit www.aboutcookies.org or www.allaboutcookies.org.

These are the cookies we use when you visit our website:

  • Google Analytics – to monitor website use and the type of browser that is accessing the website.
  • Google Translate – to remember a visitors language preferences.
  • Hotjar – to monitor website use and the type of browser that is accessing the website.

You can find out more information on the GDPR on the Information Commissioners web site: https://ico.org.uk

 

You can also contact our data protection officer whose contact details are below:

 

The Data Protection Officer, Aspire Housing, Kingsley, The Brampton, Newcastle-under-Lyme, ST5 0QW. Telephone: 01782 635200. Email: governance@aspiregroup.org.uk.