We want you to be fully informed about your rights, how The Forward Trust uses your data, and how we protect your privacy. We promise to respect any of your personal information which is under our control and to keep it safe. We aim to be clear when we collect your information about what we will do with it.
We hope the following sections will answer any questions you have but if not, please do get in touch with us.
Who we are
- The Forward Trust (Registered Company (2560474) and Registered charity in England and Wales (1001701)
- Vision Housing
- Blue Sky Services
- The Bridges
- More Than My Past
How we collect your personal information
Depending on your interactions with us we collect information from a variety of sources such as:
- When you use our services
- When you visit our websites
- When you provide information to us directly such as through a contact from or when making a donation
- When you provide it to us indirectly via a third party – such as via professional referrals or professional fundraising agencies, where you’ve given them permission to share the information they hold about you with us
- Other sources (such as social media or information available in the public domain)
- When you choose to complete surveys
- When you contact us by any means with queries, complaints etc.
Legal bases for processing your data
Data protection laws mean that each use we make of personal information must have a “legal basis”. The relevant legal bases are set out in the UK General Data Protection Regulation (Retained Regulation (EU) 2016/679) and the Data Protection Act 2018.
Consent is where we ask you if we can use your information in a certain way, and you agree to this (for example when you engage with our services). Where we use your information for a purpose based on consent, you have the right to withdraw consent for any future use of your information for this purpose at any time. You can do so by either talking to the advisor or, if it is after the conversation, by emailing firstname.lastname@example.org
To record or use your personal information we must ask for your consent. However we have a duty to share information with or without your permission under certain circumstances. Wherever possible, we will discuss this with you first. We have a duty to share information:
- If the safety/security of other service users, staff or the community is compromised by not revealing information
- If Forward believes you may be at risk of self-harm or risk of harm to any person
- If Forward has concerns for the welfare of any children
We have a basis to use your personal information where we need to do so to comply with one of our legal or regulatory obligations. For example, a court order may require us to process personal data for a particular purpose and this also qualifies as a legal obligation.
Performance of a contract / take steps at your request to prepare for entry into a contract
We have a basis to use your personal information where we are entering into a contract with you or performing our obligations under that contract. Examples of this would be if you are applying to work/volunteer with us, or being funded to undertake research.
We have a basis to use your personal information where it is necessary for us to protect life or health. For instance if there were to be an emergency impacting one of our service users / clients which required us to contact people unexpectedly or share their information with emergency services.
We have a basis to use your personal information if it is reasonably necessary for us (or others) to do so and in our/their “legitimate interests” (provided that what the information is used for is fair and does not unduly impact your rights).
An example not mentioned under the other bases above where we are relying on legitimate interests is analysis and profiling of our supporters using personal information we already hold.
In cases where we are processing your personal data on the basis of our legitimate interest, you can ask us to stop for reasons connected to your individual situation. We must then do so unless we believe we have a legitimate overriding reason to continue processing your personal data.
Special Category Data / Criminal Convictions or Offences
In some circumstances we will need to process information around Special Category Data. These could include race, ethnic origin, politics, religion, trade union membership, genetics, biometrics (where used for ID purposes), health, sex life or sexual orientation. In order the process this data we will have one of the lawful basis mentioned above as well as one of the following:
- Article 9(2)(a) where the data subject has given explicit consent
- Article 9(2)(b) which relates to carrying out our obligations and exercising our rights in employment and the safeguarding of your fundamental rights.
- Article 9(2)(c) to protect your vital interests or those of another person where you are incapable of giving your consent.
- Article 9(2)(f) for the establishment, exercise or defence of legal claims.
- Article 9(2)(g) “processing is necessary for reasons of public interest in the area of public health, such as …. or ensuring high standards of quality and safety of health care”
- Article 9(2)(h) for the purposes of preventative or occupational medicine and assessing your working capacity as an employee.
In addition we rely on processing conditions at Schedule 1 part 1 paragraph 1 and Schedule 1 part 1 paragraph 2(2)(a) and (b) of the DPA 2018. These relate to the processing of special category data for employment purposes, preventative or occupational medicine and the assessment of your working capacity as an employee.
In relation to criminal convictions or offences we have a lawful basis as well as be processing the data in an official capacity; or we will meet a specific condition contained in the Data Protection Act 2018.
How we protect your data
We know how much data security matters and we treat your data with the utmost care and take all appropriate steps to protect it. We ensure that there are appropriate technical and organisational controls (including physical, electronic and managerial measures) in place to protect your personal details.
How long we keep for information for
Forward has specific criteria to determine how long we will retain your information for, which are determined by legal and operational considerations. Whenever we collect or process your personal data, we’ll only keep it for as long as is necessary for the purpose for which it was collected.
At the end of that retention period, your data will either be deleted completely or anonymised, for example by aggregation with other data so that it can be used in a non-identifiable way for statistical analysis and planning.
However have a duty to share information with or without your permission under certain circumstances. Wherever possible, we will discuss this with you first. We have a duty to share information:
- If the safety/security of other service users, staff or the community is compromised by not revealing information
- If your Forward team believes you may be at risk of self-harm or risk of harm to any person
- If your Forward team has concerns for the welfare of any child or children
We ask for your consent to share information with other services or professionals who are important to your care or who hold important information about you.
We will never sell or rent your information to third parties for marketing purposes. However we may disclose your information to third parties in connection with the other purposes:
- Business partners, suppliers and sub-contractors who may process information on our behalf
- Analytics and search engine providers
- IT service providers
When using our services you / we may share your information with third party suppliers / organisations in order to these services to you:
- Online chat service (please see our online chat privacy notice for more information)
- Website feedback
- Using our online Forms
- Using our online donations services
- Signing up for email marketing
- Recording your details – client record management systems
What personal information we collect, how and why we collect it when you use our online services
When you visit one of our websites – www.forwardtrust.org.uk, www.thebridges.org.uk, or www.morethanmypast.org.uk – we collect data about your behaviour, such as pages you have visited and actions you have taken. We do this to monitor the effectiveness of our websites, services and campaigns and identify ways of improving them. When collecting this information we do not gather any data that can be used to identify you, and do not attempt to find out the identities of our visitors. We will not associate any data gathered in this way on our sites with any personally identifying information from any source.
If we want to collect personally identifiable information through our website, we will make sure that you are fully aware of this when we ask for your information and we will explain what we intend to do with it.
Search queries you make using services such as Google, and searches you make on our websites themselves, are logged anonymously to help us improve our websites, services and campaigns. No user-specific data is collected by either Forward or a third party.
Security and performance
Forward uses third party services to help maintain the security and performance of our websites. These process the IP addresses of visitors to our websites.
Online chat service
You can find out more in our policy for our online chat service.
Individuals who contact us
Any message sent to us through a form or directly via an email address shared on our websites, including any attachments, might be monitored and used by us for reasons of security and for monitoring compliance with our policies. Email monitoring or blocking software may also be used. Please be aware that you have a responsibility to ensure that any email you send to us is within the bounds of the law.
Individuals who send complaints / Data Protection enquiries / Freedom of information enquiries
When we receive a complaint we create a file containing the details of the complaint. This normally contains the identity of the complainant and any other individuals involved. We will only use the personal information to investigate the complaint. Under normal circumstances we have to disclose the complainant’s identity to whoever the complaint is about. If a complainant doesn’t want information identifying him or her to be disclosed, we will try to respect that, although it may not be possible to handle a complaint on an anonymous basis.
Individuals who make a donation
In order to process one-off or regular donations, we collect data including your name, address, contact details and bank details. However, we do not store your bank, credit/debit card or financial details such as your card or bank account number.
Individuals who share their stories for More Than My Past
If you get in touch to share your story for our more than my past, we ask you to share an overview of your story as well as your contact details. Information you share in this way is stored securely and treated carefully in order to protect and respect your privacy.
Reporting data protection breaches
We are required to consider reporting serious security breaches to the Information Commissioner’s Office (ICO). We use the ICO process in order to do this. In relation to all breaches we use the information to inform the actions we need to undertake.
In line with our retention policy we retain logs and breach reports for ten years unless there is regulatory actions being taken. All information is stored securely and access is restricted according to the ‘need to know’ principle.
Your rights over your personal data
You have the right to request:
- Access to the personal data we hold about you, free of charge in most cases
- The correction of your personal data when incorrect, out of date or incomplete
- The deletion of the data we hold about you, in specific circumstances; for example, when you withdraw consent or object, and we have no legitimate overriding interest, or once the purpose for which we hold the data has come to an end
- A computer file in a common format (CSV or similar) containing the personal data that you have previously provided to us, and the right to have your information transferred to another entity where this is technically possible
- Restriction of the use of your personal data, in specific circumstances, generally while we are deciding on an objection you have made
- That we stop processing your personal data, in specific circumstances; for example, when you have withdrawn consent, or object for reasons related to your individual circumstances
- That we stop using your personal data for direct marketing (either through specific channels, or all channels)
- That we stop any consent-based processing of your personal data after you withdraw that consent
- Review of any decision made based solely on automatic processing of your data (so where no human has yet reviewed the outcome and criteria for the decision)
You can contact us to request to exercise these rights at any time.
If we choose not to action your request, we will explain the reasons for our refusal.
To protect the confidentiality of your information, we will ask you to verify your identity before proceeding with any request you make under this Privacy Notice.
If you have authorised a third party to submit a request on your behalf, we will ask them to prove they have your permission to act.
Please note that exceptions apply to a number of these rights, and not all rights will be applicable in all circumstances. For more details we recommend you consult the guidance published by the UK’s Information Commissioner’s Office (ICO).
How to contact us about your privacy or data protection
We hope this Privacy Notice has been helpful in setting out the way we handle your personal data and your rights to control it.
If you have any questions that haven’t been covered, please contact our Data Protection Officer who will be pleased to help you, please email us at email@example.com or write to us at:
Data Protection Officer
Governance and Quality Assurance Department
The Forward Trust
170 Kennington Lane
London SE11 5DP
If you are unhappy with any aspect of how we are using your personal information we’d like to hear about it. We appreciate the opportunity this feedback gives us to learn and improve. Please email us at firstname.lastname@example.org or write to us at the address above.
You also have the right to lodge a complaint about any use of your information with the Information Commissioners Office, the UK data protection regulator.
Changes to this policy
- 6 April 2021 Policy updated
- 11 May 2020 Policy updated
- 19 November 2019 Policy updated
- 13 November 2019 Policy updated
- 20 March 2019 Policy updated
- 14 September Policy published