Cloverleaf Advocacy

Privacy Notice

Cloverleaf Advocacy is a charity which provides advocacy support to people who are vulnerable, training, and support to carers.

Our core values are based on principles of trust, transparency and honesty. In order to fulfil these, people need to be confident that Cloverleaf holds the lawful and correct treatment of personal information as vital to our service delivery.

Our company name is Cloverleaf Advocacy 2000ltd

Our registered charity number is 1097608 Our company number is 3790911

Our registered address is 9 Wellington Road, Dewsbury, West Yorkshire, WF13 1HF.

We are registered with the Information Commissioner’s Office under reference Z6546174

Our contact details can be found at the bottom of this notice.

This Privacy Notice tells you what to expect when Cloverleaf Advocacy collects personal and/or sensitive information. It applies to information we collect about:

• People who receive support from Cloverleaf Advocacy
• People who refer others into Cloverleaf Advocacy services
• People who attend training provided by Cloverleaf Advocacy or who complete qualifications with Cloverleaf Advocacy
• Current and former employees, and people who apply for jobs.
• Current volunteers, and people who apply for volunteer roles.
• Visitors to our website
• People who provide feedback about our services including complaints.
• People who subscribe to our newsletters or information about our services or projects.

People who receive support from Cloverleaf Advocacy and people who refer others into Cloverleaf Advocacy services;

The main reason we ask for your information is to help you with your issue or problem. If you are referred for, or have support from Cloverleaf Advocacy, we will need to keep information. If you make a referral to our service we will also need to keep some information about you. This is called ‘legitimate  interests’ so we can provide support to you.

We will only ask you for information that we need, and we will explain why we need it. We will ask for information that is relevant to the issue or problem.

This may include;

• Your name and contact details – so we can keep in touch with you
• Information like your gender, ethnicity, age
• Details about the issue you want support with.
• Your views on what is best for a friend or relative we are supporting If you don’t want to give us certain information, you don’t have to.

Where do you store my information?

Information is stored on our secure case management system. Some information might also be kept in our secure email system or IT system. Our systems are hosted in the European Economic Area and where possible in the UK.

All our staff are trained on how to keep your information safe.

How we use your information;

The main way we use your information is to help you with your issue or problem.

We might also use your information to;

• Get feedback from you about our service while we are working with you (we will not pass your details to anyone else for this reason without your permission)
• Create anonymous case studies to raise awareness of our services
• Prepare statistical reports for our funders about the work we do – this would not be able to identify you.
• Help us improve our services by looking at our statistics
• Investigate a complaint

How long will you keep my information?

When your file is closed the information will be safely stored by us for 7 years. We will not view or make changes to your information unless you get back in touch with us.

Can I see the information you have about me?

Yes. You have the right to access any information we have about you. We may need to remove any ‘third party’ information (about other people) which may be in your file. If you would like to have a copy of your file, please get in touch with us using the contact details below. We will send your information within 30 days and there is no charge for this.

What if I think the information is wrong?

We will consider the reasons why you think information is wrong. We will either change the information we hold, or make a note that you think information is wrong on your file, and what you think should be written down instead. We will let you know what we have done and the reason why. You have the right to ask us not to 'process' or use your information until this is done.

What happens if I want you to delete my information?

You can contact us and ask. There are some circumstances where we may not be able to do this but we will always tell you why. If we cannot delete your information, you can ask us not to 'process' or use your information. We will explain to you how this would affect any support you get from Cloverleaf.

Can you share my information?

Usually we would only share your information if you give us permission. This might be if we cannot help you with an issue and need to refer you to another service – for example if we contact a debt advice agency for you we might need to tell them your contact details and a summary of your problem.

We might also share your information if you have given us consent to speak to another person (for example a social worker or doctor) about your issue.

If our contract to provide services with a local authority ends, you have the right to have your information transferred on active cases to a new provider.

Either the local authority or we would ask for your permission to do this. This is called ‘data portability’

Sharing your information without your permission;

There may be times when we have to share your information without your permission.

• If something you’ve told us makes us think you or someone else are at serious risk of harm we might need to tell the police or social services.
• To comply with the law, called ‘legal obligation’ - for example if a court orders us to share information
• To protects someone’s life, called ‘vital interests’ – for example sharing information with emergency services in an emergency
• To carry out our work as an organisation, called ‘legitimate interests’ – for example anonymous statistics and case studies for funders and raising awareness.
• To defend our legal rights – for example to resolve a serious complaint.

If your information is seen, or told to someone who is not authorised to see it, this is called a ‘data breach’. If this happened to your information we would tell you as soon as possible and let you know what we were going to do about it.

We would also tell the Information Commissioners Office about it. We would tell you about your right to make a complaint to the Information Commissioners Office.

People who attend training provided by Cloverleaf Advocacy or who complete qualifications with Cloverleaf Advocacy;

The main reason we ask for your information is to keep in contact with you about training or qualifications for which you have registered with Cloverleaf Connect (part of Cloverleaf Advocacy).

We will only ask you for information that we need, and we will explain why we need it. We will ask for information that is relevant to the training or qualification you are doing with is. This may include;

• Your name and contact details – so we can keep in touch with you
• Information like your gender, ethnicity, age (so we can see if there are any specialist needs and so we can monitor equal opportunities)
• National Insurance Number
• Unique learner number
• Previous level of education or training.

If you don’t want to give us certain information, you don’t have to – this may affect our ability to register candidates for certain qualifications but we would let you know this at the time.

Where do you store my information?

If you are attending training with us, we use a booking system called Eventbrite and your information is stored securely there at the time you book. You will be asked to read and agree to Eventbrite’s Privacy Policy when you create an account.

When you attend training we may also ask you for some additional information for equal opportunities monitoring. This will be anonymised and stored on our secure computer system.

If you are undertaking a qualification with us, we use a secure e-portfolio system called Ecordia. You will be asked to read and agree to Ecordia’s Privacy Policy when you first log in to the system. Some information might also be kept in our secure email system or IT system.

All our staff are regularly trained on how to keep your information safe.

How we use your information;

The main way we use your information is to keep in touch with you about training you have registered for, or to support you to complete a qualification you have registered for with us. We might also use your information to;

• Get feedback from you about our service (we will not pass your details to anyone else for this reason without your permission)
• Help us improve our services by looking at our statistics
• Investigate a complaint

How long will you keep my information?

When you have completed training or a qualification with us, we will retain your information for 6 years. We will not view, use, or make changes to your information unless you get back in touch with us.

Can I see the information you have about me?

Yes. You have the right to access any information we have about you. We may need to remove any ‘third party’ information (about other people).  If you would like to have a copy of your information, please get in touch with us using the contact details below. We will send your information within 30 days and there is no charge for this.

What if I think the information is wrong?

We will consider the reasons why you think information is wrong. We will either change the information we hold, or make a note that you think information is wrong on your file, and what you think should be written down instead. We will let you know what we have done and the reason why. You have the right to ask us not to 'process' or use your information until this is done.

What happens if I want you to delete my information?

You can contact us and ask. There are some circumstances where we may not be able to do this but we will always tell you why. If we cannot delete your information, you can ask us not to 'process' or use your information. We will explain to you how this would affect training or assessment you might be receiving from Cloverleaf Connect.

Can you share my information?

We would not usually share your information without your permission. If, for any reason, you chose to complete a qualification you had started with Cloverleaf Connect with another provider, you have the right to have your portfolio transferred to a new provider. This is called ‘data portability’ and you could either do this yourself, or ask us to send it for you.

Sharing your information without your permission;

There may be times when we have to share your information without your permission.

• If something you’ve told us makes us think you or someone else are at serious risk of harm we might need to tell the police or social services.
• To comply with the law, called ‘legal obligation’ - for example if a court orders us to share information
• To protects someone’s life, called ‘vital interests’ – for example sharing information with emergency services in an emergency
• To defend our legal rights – for example to resolve a serious complaint.

If your information is seen, or told to someone who is not authorised to see it, this is called a ‘data breach’. If this happened to your information we would tell you as soon as possible and let you know what we were going to do about it.

We would also tell the Information Commissioners Office about it. We would tell you about your right to make a complaint to the Information Commissioners Office.

Current and former employees, and people who apply for jobs:

Job and volunteer applications;

Cloverleaf Advocacy is the data controller for the information you provide when you apply for a job or volunteer role with us. All of the information you provide during the application process will only be used to progress your application, or to fulfil legal requirements.

The information you provide will be stored securely by us and any recruitment agency we contract with. This includes both electronic and paper format.

We will ask you for;

• Contact details  – so that we can contact you about your application
• Previous experience, education, referees and answers to questions relevant to the role – so we can assess your suitability for the role
• Equal opportunities information – for example your gender, ethnic origin, age etc. This is not compulsory and is not used to assess your application. We ask for this on a separate document, which is not shared with the shortlisting or interviewing team. We ask for this information so that we can analyse equal opportunities data.

Shortlisted applicants;

If your application is shortlisted, we might ask you to attend an interview, which may involve some tests or presentations. We will also carry out some pre-employment checks at this stage. You will be asked to bring to your interview;

• Proof of identity and your right to work in the UK – you will be asked to bring original documents and we will take copies (for example your passport)
• Proof of any qualifications required for the role

The interviewing team will take notes during the interview so that they can score your answers to the interview questions. We ask all interviewees the same questions. After the interview, these notes are stored securely by our HR team.

Unsuccessful Employment Applicants;

If you are not successful in your application for the role you have applied for, we might ask you if you would like us to retain your details securely for 6 months so that we could contact you with any suitable vacancies during this period.

If you are not successful, and you do not want us to contact you with suitable vacancies, we will keep your application and notes from your interview for 6 months from the date of your interview. They will then be securely destroyed. We will destroy any copies of identification and qualification documents within 5 working days of informing you that you have been unsuccessful.

Successful Employment Applicants;

If we make an offer of employment, we will ask for information to carry out further pre-employment checks. These must be completed before you can start employment with Cloverleaf Advocacy. We will ask for:

• All employees who have unsupervised contact with vulnerable adults, or anyone under the age of 18 must hold a valid enhanced Disclosure and Barring Service (DBS) check. We will support you to obtain this by processing your application for a DBS check. You will be asked to provide your address history, and details of any criminal convictions. Once your application has been completed and submitted, we will destroy the application form.
• We will contact your referees directly, using information you provide in your volunteer application, to obtain references
• Your bank details to enable us to process salary payments and to reimburse expenses incurred on company business.
• Emergency contact details –so we know who to contact in case of an emergency whilst you are at work.

Volunteer Applications;

If your application is shortlisted, we might ask you to attend an interview, or informal discussion.

The interviewing person or team will take notes during the interview so that they can assess your answers to the interview questions.

Unsuccessful applications;

If you are not offered a volunteer role, we will keep your application and interview notes securely for 3 months.

Successful volunteer applications;

If you are offered a volunteer role, we will ask you for further information. This will be:

• Proof of your identity. You will be asked to provide original documents and we will take copies.
• All volunteers who have unsupervised contact with vulnerable adults, or anyone under the age of 18 must hold a valid enhanced Disclosure and Barring Service (DBS) check. We will support you to obtain this by processing your application for a DBS check. You will be asked to provide your address history, and details of any criminal convictions. Once your application has been completed and submitted, we will destroy the application form.
• We will contact your referees directly, using information you provide in your volunteer application, to obtain references
• Your bank details to enable us to reimburse any out of pocket expenses you may incur whilst carrying out your volunteering role.
• Emergency contact details –so we know who to contact in case of an emergency whilst you are volunteering with us.

Sharing information about employees;

We may use recruitment agencies, payroll providers, and workplace pension providers to provide services associated with recruitment and employment.

These are data processors. We have contracts in place with them and they cannot do anything with your personal information unless we have instructed them to do it. They will not share your personal information with any organisation apart from us. They will hold it securely and retain it for the period we instruct.

There are times when we might have to share your information without your permission. If we do, we will always make sure there is a legal basis for us to do that. For example, if we receive a court order, we have to produce information demanded in that order.

When a contract with a local authority is coming towards the end of its term, we are required to provide certain details to the local authority, which shares those details with other potential providers of the service. These details are required under TUPE legislation and will include length of service and role but no other identifying personal information.

Sharing information about volunteers;

There are times when we might have to share your information without your permission. If we do, we will always make sure there is a legal basis for us to do that. For example, if we receive a court order, we have to produce information demanded in that order.

Storing and Retaining Information about Employees;

The information employees provide during the application process will be retained by us as part of your personnel file throughout the duration of your employment, plus 6 years following the end of your employment. This will include criminal records declaration, references, DBS check results and updates. During the course of your employment we may collect further personal or sensitive information (for example driving licence details, results of occupational health assessments).  This information will also be retained for the duration of your employment plus 6 years following the end of your employment.

Storing and Retaining Information about Volunteers;

If you volunteer for us, the information you provide during the application process will be retained by us as part of your volunteer file for the duration of your volunteering, plus 6 years following the end of your role with us. This will include your criminal records declaration, DBS check results (and updates) and references.  This information will also be retained by us for the duration of your volunteering plus 6 years following the end of your role with us.

Accessing the information we hold about current and former staff or volunteers, and people who apply for these roles;

Under data protection laws, you have a right to access the personal information we hold about you. For current staff and volunteers, this information is fully accessible via our self-service systems.

If you are no longer employed by Cloverleaf or have stopped volunteering with us, you can request a copy of the information we hold about you and we will provide that to you as quickly as we can but certainly within one month of us receiving the request. This is called a Subject Access Request.

If we hold inaccurate or incomplete information about you, please tell us and we will correct or complete the data. If we have shared that information with anyone else, in the circumstances we have outlined above, we will, where possible, inform them of any corrections and tell you where this has happened. This is called your right to rectification.

In some circumstances, you have a right to erasure. We have already explained how long we keep your personal information. At the end of that period, when we no longer have any reason to keep or process it, we will delete it from our systems.

You have a right to restrict processing in some circumstances. This means that in those circumstances, we would still store your information but not process, or use it. These are the situations where you can ask us to restrict processing your information:

• Where you believe that the information we hold is not accurate, we would restrict processing until we have verified the accuracy of the personal information;
• If we have used your information unlawfully, and you don’t want us to erase the information, you can ask us to simply hold it instead;
• If we no longer need the personal information and before we automatically delete the information from our system, you request us to hold it to make or defend a legal claim.

If your information is seen, or told to someone who is not authorised to see it, this is called a ‘data breach’. If this happened to your information we would tell you as soon as possible and let you know what we were going to do about it.

We would also tell the Information Commissioners Office about it. We would tell you about your right to make a complaint to the Information Commissioners Office.

Visitors to our website;

When someone visits www.cloverleaf-advocacy.co.uk we use a third party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site. This information is only processed in a way that does not identify anyone. We do not make, and do not allow Google to make, any attempt to find out the identities of those visiting our website.

Our website also uses ‘Cookies’. These are small text files  that are stored by the internet browser (for example Google Chrome or Safari) on your computer, laptop, mobile phone or tablet. They allow websites to store things like user preferences. You can find our Cookie Policy here https://www.cloverleaf- advocacy.co.uk/content/cloverleaf-advocacy-cookie-policy

If you use the ‘contact us’ form on the website, the information you provide is stored securely and used to work out the reason for your enquiry. If your enquiry means that you need further contact from us, for example you need advocacy support, or want to give us some feedback, your information will be used, stored and retained as we describe in the relevant sections of this Privacy Notice.

If you make a referral using our online form, the information you provide will be used, stored and retained as we describe in the ‘People who receive support from Cloverleaf Advocacy and people who refer others into Cloverleaf Advocacy services’ section of this Privacy Notice.

People who provide feedback about our services including making complaints;

When you provide feedback to Cloverleaf Advocacy, or if you make a complaint about our services, we ask you for your contact details so that we can get in touch about the feedback that you have left. We will only get in touch with you if you ask us to, or give consent.

Where do you store my information?

Information is stored on our secure case management system. Some information might also be kept in our secure email system or IT system. Our systems are hosted in the European Economic Area and where possible in the UK.

All our staff are trained on how to keep your information safe.

How we use your information;

The main way we use your information is to help investigate and resolve your complaint, and use your feedback to think about how we can improve our services.

We also feedback to our funders and commissioners about complaints and feedback we have received, but this would not be able to identify you.

How long will you keep my information?

The information will be safely stored by us for 6 years. We will not view or make changes to your information unless you get back in touch with us.

Can I see the information you have about me?

Yes. You have the right to access any information we have about you. We may need to remove any ‘third party’ information (about other people). If you would like to have a copy of your information, please get in touch with us using the contact details below. We will send your information within 30 days and there is no charge for this.

What if I think the information is wrong?

We will consider the reasons why you think information is wrong. We will either change the information we hold, or make a note that you think

What happens if I want you to delete my information?

You can contact us and ask. There are some circumstances where we may not be able to do this but we will always tell you why.

Can you share my information?

We might share your information if you have given us consent to speak to another person about your complaint or feedback.

Sharing your information without your permission;

There may be times when we have to share your information without your permission.

• If something you’ve told us makes us think you or someone else are at serious risk of harm we might need to tell the police or social services.
• To comply with the law, called ‘legal obligation’ - for example if a court orders us to share information
• To protects someone’s life, called ‘vital interests’ – for example sharing information with emergency services in an emergency
• To carry out our work as an organisation, called ‘legitimate interests’ – for example anonymous statistics and case studies for funders and raising awareness.
• To defend our legal rights – for example to resolve a serious complaint.

If your information is seen, or told to someone who is not authorised to see it, this is called a ‘data breach’. If this happened to your information we would tell you as soon as possible and let you know what we were going to do about it.

We would also tell the Information Commissioners Office about it. We would tell you about your right to make a complaint to the Information Commissioners Office.