GIFT Privacy Policy
The privacy and security of your personal information is important to us at Glasgow Initiative of Facilitation & Therapy (‘GIFT’), and we are committed to ensuring that your privacy is protected. Any personal data collected by us will only be processed in accordance with this privacy policy.
POLICY CONTENTS
A. About this Policy
B. Why do we process your data?
C. How we collect your data
D. What data do we collect and process?
E. How do we use your data?
F. Your rights in relation to your personal data
G. Security
H. Web browsing and cookies
I. Links to other websites
J. How to make a complaint
A. ABOUT THIS POLICY
Glasgow Initiative of Facilitation & Therapy (‘GIFT’) is a Community Interest Company (CIC) limited by guarantee (Number SC665710). This privacy policy sets out how GIFT, processes personal data (that is, information by which an individual can be identified) collected by us in the course of our lawful activities, in accordance with the Data Protection Act 2018, the General Data Protection Regulation and any subsequent legislation in force from time to time (‘Data Protections laws’). This policy has been put in place to protect your rights under the Data Protection laws, and it is important that you understand what we will do with your data and are happy with this. We won’t do anything with your information you wouldn’t reasonably expect. If you want to discuss any matter relating to how your data is used, please call us on 07305361362, email us at hello@giftscotland.co.uk or write to our Data Protection Officer at Glasgow Initiative of Facilitation & Therapy, South Block Studios, 60-64 Osborne St, Glasgow, G1 5QH.
References to the processing of information includes the collection, use, storage and protection of data. GIFT is the ‘data controller’ for the purposes of this policy, except where otherwise stated, and the policy extends those working for and on behalf of GIFT and, to the extent set out below, anyone else processing data on our behalf from time to time.
Children of any age have the same rights over the data processed about them as adults, although their ability to understand and to exercise these rights may vary depending on their age and capacity. We therefore ask those legally responsible for the children to whom we provide art therapies to understand that our obligations are to each of those children separately as individual data subjects and to work with us accordingly, and your attention is drawn to our GIFT Child & Young Person Therapy Consent Form in this regard. References in this policy to ‘you’ or ‘your data’ includes reference to children’s data, as the context allows.
This was most recently reviewed on 1 March 2022.
B. WHY DO WE PROCESS YOUR DATA?
We collect information for the following purposes:
To establish how best to support individuals through clear understanding of the situation.
To monitor and report on progress (emotional well-being and academic attainment).
To assess the quality of the services on offer.
To protect the welfare of anyone receiving support through good communication with partner services involved.
To keep anyone receiving support safe (health needs or emergency contact details)
To meet the statutory requirements of the Health & Care Professions Council.
Organisations are permitted to process data if they have a legal basis for doing so. GIFT processes data on the basis that:
Express and informed consent has been given by the person whose data is being processed; and/or
GIFT has a legitimate interest in processing the data; and/or
It is necessary in relation to or in anticipation of a contract, agreement, or ongoing arrangement for the provision of services which someone has entered into with GIFT or because someone has asked for something to be done so they can enter into a contract, agreement or arrangement with us; and/or
There is a legal obligation on GIFT to process data.
If and to the extent that GIFT is relying on solely consent as the basis for processing data, we are required to obtain your explicit consent and you can modify or withdraw this consent at any time by notifying us in writing, although this may affect the extent to which GIFT is able to provide services to or interact with you in future.
Where consent is sought in relation to a child under the age of 16 years of age, we will ask that someone legally responsible for them provides such consent. Where we (in the capacity of a data processor) receive such data from another data controller, such as a school, we do so in reliance on the express or implied assurance that it is being shared with us lawfully and with all due authority. If you're aged 16 or under, you must get your parent/guardian’s permission before you provide any personal information to us.
We may change this policy from time to time and any such changes will be published on our website. Notwithstanding any change to this policy, we will continue to process your personal data in accordance with your rights and our obligations in law.
C. HOW WILL WE COLLECT YOUR DATA?
When you directly give us information
We may collect and store information about you when you interact with us. For example, this could be when you:
get in touch with us via phone, website or other method of communication
support our work through a donation
fundraise on our behalf
register for an event
tell us your story
submit an enquiry
register for or use our services
participate in our workshops
participate in our creative consultations
give us feedback
make a complaint
apply for a job
register for a Therapeutic Placement
enter into a contract with us
When you indirectly give us information
When you interact with us on social media platforms such as Instagram, Facebook, Twitter or LinkedIn we may also obtain some personal information about you. The information we receive will depend on the privacy preferences you have set on each platform and the privacy policies of each platform. To change your settings on these platforms, please refer to their privacy notices. You should be aware that GIFT has no ownership over these websites who may process your data for their own purposes if you choose to use them.
We may obtain information about your visit to our site, for example the pages you visit and how you navigate the site, by using cookies. Please visit our Cookies Policy for information on this.
D. WHAT DATA DO WE COLLECT AND PROCESS?
We process the data necessary for GIFT to fulfil its therapeutic objectives by providing art therapies in a supportive environment to children aged 5-18 experiencing learning, behavioural, emotional and other difficulties, together with running youth art groups, creative consultations and community events, keeping our service users and supporters informed of our activities, and the effective running of GIFT through those working for and with us, our directors and volunteers.
When you engage with us by phone, mail, in person or online, we may collect information about you (referred to in this Privacy Notice as 'personal information'). This may include:
name
address
email address
telephone number
date of birth
job title and details of your education and career
why you are interested in contacting GIFT
other information relating to you personally which you may choose to provide to us such as diversity information.
Further details of data collected and processed may include, but not be limited to the following:
Self Employed Contractors, Volunteers and Supporters
Information necessary for the engagement of the engagement of volunteers, self-employed contractors providing therapeutic services and creative services, including that necessary to pay fees and all necessary information relating to our obligations for the safeguarding, welfare, and protection of children, such as references and PVG checks
Names and contact information such as telephone numbers, email and postal addresses of staff, volunteers, therapists, supporters or others with whom we have contact
Self-employed contractor and volunteer records and preferences, including, where necessary, bank or payment details and details of tax status in order to process payments and fees.
Such other information that is relevant and necessary for GIFT to carry out its activities, and legal obligations.
Children and Young People accessing Therapeutic support
Childs Name, date of birth, gender, address, email address
Parent/carer(s) Name and contact details including email address, postal address and telephone number
Referrer and reasons for referral
School name, academic year and school record
Anonymised therapy notes from any therapeutic sessions undertaken
Any form of artwork completed by a child or young person during therapeutic sessions.
Anonymised group notes from any workshops undertaken
Any form of artwork completed by a child or young person during workshops
Children and Young People accessing Youth Art Group or Workshops
Childs Name, date of birth, gender, address, email address
Parent/carer(s) Name and contact details including email address, postal address and telephone number
Emergency Contacts Name and contact details including email address, postal address and telephone number
Anonymised workshop notes from any workshops undertaken
Any form of artwork completed by a child or young person during workshops
Children and Young People participating in Creative Consultations
Childs Name, date of birth, gender, address, email address
Parent/carer(s) Name and contact details including email address, postal address and telephone number
Emergency Contacts Name and contact details including email address, postal address and telephone number
Anonymised group notes from any Creative Consultations undertaken
Any form of artwork completed by a child or young person during the Creative Consultations
Adults participating in Creative Consultations
Name, date of birth, gender, address, email address
Emergency Contacts Name and contact details including email address, postal address and telephone number
Anonymised group notes from any Creative Consultations undertaken
Any form of artwork completed by a child or young person during the Creative Consultations
Online
The pages visited
When and how long our website was visited
Each device’s IP (Internet Protocol) address
The type of Internet browser used (e.g. Chrome, Safari or Firefox)
Referring website.
Please note that the above list of categories of personal information we may collect is not exhaustive. Any personal information collected will be processed in accordance with the approach outlined in this Privacy Policy.
E. HOW DO WE USE YOUR DATA?
We process your personal data to operate GIFT as stated above, and in particular for the following purposes:
For internal record keeping, invoicing, communication and administration
To carry out the services provided to service users whilst ensuring the safeguarding, welfare and protection of children to whom we owe a duty of care
To engage, direct and oversee the work of therapists providing services to service users
To work with partner organisations and their staff with whom we liaise to provide our services
To comply with any legal obligations and to protect parties’ interests in cases of dispute
To let you know about GIFT’s activities, events and campaigns or related matters which we think may be of interest to you.
To share such information as is necessary and lawful with therapists working with us to provide art therapies, schools and others, including to safeguard children to whom we provide our services.
If you or someone acting on your behalf provides information about another person, such as a service user, you warrant that you have the legal authority to share such data with us and have informed such person(s) (or in the case of someone under the age of 16, a person legally responsible for them) that their data is being shared with us and about our Privacy Policy.
Data processed will be retained only for as long as the purpose for which it was collected continues and for as long as is reasonable and permissible in law. Accordingly, the periods for which we retain data will vary depending on the purposes for which it was collected and relevant statutory or other requirements.
In addition to those circumstances mentioned above, we will only share data with trusted third parties (including those outside the European Economic Area) to the extent and where necessary for us to provide services to service users and support GIFT’s activities through promoting our work (such as online platforms for secure data storage or for email communications), and only once we are satisfied that any such use of data will accord with our privacy policy. We will never sell your personal information and will not share it without your explicit consent, except as stated above.
F. YOUR RIGHTS IN RELATION TO YOUR PERSONAL DATA
You, as the data subject, may request deletion of your data at any time in writing, subject to any overriding legal requirement for its retention, such as the need, where appropriate, to comply with legal or safeguarding obligations or the requirements of regulatory authorities such as Her Majesty’s Revenue and Customs, or to prevent the commission of or to assist in the investigation of an actual or suspected criminal offence. We may keep certain data on a ‘suppression list’ so we know, if requested, not to contact you or process your data in future until further notice.
You may request details of personal information which we hold about you. Those legally responsible for a child may request such details about the child. Any such request must be submitted in writing, and we reserve the right to seek verification of the identity of persons making such requests before we respond. A small fee may be payable if an information request is particularly onerous.
You may choose to restrict the collection or use of your personal information, but this may impact or limit the way in which we are able to interact with you. You may, at any time, change your mind about what information we hold about you, or if we continue to hold it at all, subject to any legal obligation on us to retain data, and as stated above.
You are responsible for the accuracy of data you have provided to GIFT. If you believe that any information, we are holding on you is incorrect or incomplete, please write to us as soon as possible. We will promptly correct any information found to be incorrect.
Where your data has been supplied to us by another party, such as a school, meaning that GIFT is processing it on behalf of that other party and is acting as a data processor, please note that in order to exercise your rights over your data you should submit any request relating to it to the party that supplied the data to us.
In the unlikely event that there is any kind of a breach of our duties and obligations under this policy or the Data Protections laws, we will take immediate steps to isolate and rectify the problem. Should the breach be serious one (where there is a risk of, for example, discrimination, damage to reputation, financial loss or loss of confidential information) we have a duty to report that matter to the individuals affected and to the Office of the Information Commissioner.
You can obtain further information about Data Protection and privacy laws and your rights by visiting the Information Commissioner’s website at: https://ico.org.uk/your-data-matters/.
G. SECURITY
We are committed to ensuring that your information is secure. To prevent unauthorised access or disclosure, we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the data we process. Persons processing data on behalf of GIFT do so in accordance with this policy and on the basis that GIFT is satisfied that they can and will adhere to our high standards for data protection and security.
The transmission of information over the internet is inherently insecure, and we cannot guarantee the security of data sent over the internet. Please note that, unless encrypted, email messages sent via the internet may not be secure and could be intercepted and read by someone else. Please bear this in mind when deciding whether to include personal or sensitive information in any email messages you send to us.
H. WEB BROWSING AND COOKIES
A cookie is a small file which asks permission to be placed on your computer’s hard drive. Once you agree, the file is added and the cookie helps analyse web traffic or lets you know when you visit a particular site. Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences.
We may use traffic log cookies to identify which pages are being used. This helps us analyse data about web page traffic and improve our website to tailor it to customer needs. We only use this information for statistical analysis purposes and then the data is removed from the system.
Overall, cookies help us provide you with a better website, by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us.
You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of the website.
We may also collect and store information about your browsing device, including, where available, your IP address, operating system and browser type, together with certain anonymous statistical data about your browsing activities and patterns which does not contain any personal data.
I. LINKS TO OTHER WEBSITES
Our website may contain links to other websites of interest. However, once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy policy. You should exercise caution and look at the privacy policy applicable to the website in question.
J. HOW TO COMPLAIN
If you have any concerns about our use of your personal information, you can make a complaint to us by emailing our Data Protection Officer at write to our Data Protection Officer at Glasgow Initiative of Facilitation & Therapy, South Block Studios, 60-64 Osborne St, Glasgow, G1 5QH.
You can also complain to the ICO if you are unhappy with how we have used your data.
The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk