Introduction 

At Care Rights UK we are committed to protecting and respecting your privacy. This policy outlines how we collect, use, and safeguard your personal data when you interact with us. 

What personal data does Care Rights UK collect? 

We may collect and store the following types of personal data from people who interact with us, e.g. people using our advice service, members, staff, volunteers, donors, newsletter subscribers. People contacting our advice service can withhold personal information if they wish.

• Name: To identify you in our interactions. Note this may be a pseudonym if preferred by people using our advice service. 

• Contact details: Such as postal address, email address and phone number, to communicate with you. 

• Details of your involvement with us: Records of your membership, volunteering, campaigning, interests in our work.  

• Details of our interactions: Notes and records of your communications with us, including advice calls and emails.  

• Information about the person you are contacting us about: Details that you provide regarding the person you are seeking advice about, necessary to offer appropriate support. 

• Special category data: Special category data about yourself or the person you are contacting us about, such as ethnicity and health information, may be collected as part of providing appropriate support via the advice service and for the purposes of monitoring our reach and impact. This is done with the consent of the person seeking advice, who is in complete control of how much they share with us and can withdraw consent for this information to be processed at any time.

• Donation information: If you choose to make a donation or make a membership payment, we will collect necessary payment and transaction details and information about your Gift Aid status. 

What is the legal basis for collecting and storing this data? 

Care Rights UK collects personal data from individuals it interacts with to pursue its legitimate interests as a voluntary organisation. These interests include providing advice, raising awareness, and campaigning to improve the care system. Personal data is also used to engage with supporters, raise funds, and advance our charitable aims.

Information about employed staff is held as part of their contractual arrangements and in line with legal obligations. 

Information about volunteers is held with their consent. 

Personal data relating to financial matters is retained to comply with legal obligations. 

What is this personal data used for? 

We use information provided by people using our advice service to understand and try to resolve the issues they are raising, and to contact them to provide updates and support. 

We use information from members and volunteers to administer their involvement with us. 

We use information from people who have given consent for marketing by email to send our regular newsletter and other news about Care Rights UK and its work. You can withdraw consent at any time, and all our communications will include an easy way to unsubscribe if you no longer want to hear from us in this way. 

We use information from and about all stakeholders and their interactions with us to monitor and report on our impact, identify trends and issues to inform campaigns and the work of the organisation. 

How is data stored? 

Most of our data is stored securely in digital form and we use various cloud services that comply with the GDPR, such as Mailchimp. Mailchimp has its own Privacy Notice which you can read here.

The remaining information is stored securely as written documents in our office. 

Who has access to my personal data? 

Members of staff have access to your record on our database which includes your contact details, dates of interactions with us and some information about those interactions such as the type of support offered in the case of the advice service. 

Only our advice team and senior management have access to the detailed notes of your advice interactions with them and to the name of the person you are contacting us about. The name of the person you are contacting us about will be anonymised after 5 years to protect their privacy. 

Trustees of Care Rights UK may be given access to the data to undertake their roles as officers of the organisation. 

Who is data shared with? 

We do not share personal information provided by people contacting our advice service outside of the organisation without their knowledge and consent. There may be rare occasions when there appears to be a need to safeguard them or another individual, when it would be necessary for us to contact the relevant statutory authorities. 

Personal information about any of our contacts would only be shared outside of the organisation with the explicit consent of that individual. 

How long does Care Rights UK keep personal data and why?  

We will retain your personal data and structured information about your interactions with us for the duration that your record is in our database, ensuring we maintain a comprehensive record of your involvement with us. 

This enables Care Rights UK to report on our impact, identify trends and issues to inform campaigns and the work of the organisation, but does not allow individuals to be identified outside of the database. 

In the case of people using our advice service, the name of the person you are contacting us about will be anonymised after 5 years.  

The personal data of staff is retained for the legally required period, including information relating to payroll and pensions. The personal data of former employees is kept for 6 years after the end of their employment. 

What are your rights? 

You have the right to: 

• Access the personal data we hold about you. 

• Request the correction of inaccurate or incomplete data. 

• Request the deletion of your personal data, subject to legal obligations. 

• Withdraw consent for marketing communications at any time. 

How can you check what data Care Rights UK holds about you? 

We undertake to provide you with the data we hold about you in response to a written request by letter or email. We may need to take steps to verify the identity of the person making the request to ensure confidentiality. 

Please contact team@carerights.org for assistance if you wish to check the personal data that we hold about you. 

How can you ask for data to be removed, corrected or limited? 

People contacting the advice service can withhold personal information when contacting Care Rights UK. Staff are always willing to provide advice to people who do not wish to be identified, though this may limit the help that can be given and require the person to re-state the matter during future contacts as the record kept will be anonymous. In this case we encourage the use of a pseudonym instead. 

Anybody in contact with Care Rights UK can ask for their details to be corrected at any time, including opting out of marketing communication. In this case your records would remain on our database, but we wouldn’t send you our newsletter or other marketing. 

Members and volunteers can also end this involvement with us at any time. Communications regarding this involvement are not marketing and so don’t require consent, but they will only be sent to relevant individuals. 

Please contact team@carerights.org for assistance if you wish to update your details, change your involvement with us, or remove your details from our database completely. 

Use of Artificial Intelligence in Processing 

We may use Artificial Intelligence (AI) tools to enhance productivity and support tasks such as data management, trend analysis, and process automation.

Our priority remains handling your data responsibly, and we are dedicated to ensuring its security and compliance with all applicable regulations. We will continue to evaluate and adapt our use of AI, maintaining transparency and keeping your privacy and trust at the forefront of our practices.

Who is responsible for ensuring compliance? 

Under the GDPR there is no statutory requirement for Care Rights UK to have a Data Protection Officer. The person who ensures that Care Rights UK meets its obligations under the GDPR is the Director. 

If you have any questions about this privacy policy or how we handle your data, please contact us at team@carerightsuk.org 

Changes to this policy 

We may update this policy from time to time. Any changes will be posted on our website, and where appropriate, notified to you by email.