Please read the following information carefully. This privacy notice tells you what information we collect and store about you and why. It also tells you who we share this information with, how long we retain information, how we safeguard information, your rights regarding your information and how to contact us if you want to discuss the information we hold and process about you.

Where you are viewing this policy on our website, it is important that you read this together with our website privacy policy which contains more detailed information about our data processing.

1. Who we are

Leeds Centre for Integrated Living (“Leeds CIL”) is the controller and responsible for your personal data.  We are registered at Companies House with Company Number 07534989 and at the Charity Commission with Charity Number 1147077.  Our Registered Address and main office address is Cartelli House, 2 Arthur Street, Stanningley, Leeds, LS28 6JY.

Our Data Privacy Manager (“DPM”) is Leeds CIL’s CEO, Susan Morrell. If you have any questions about this privacy policy or our data protection practices, please contact the DPM at the above phone number and address or by email: [email protected].

2. The data we collect about you

Leeds CIL will collect information about people who use our services to enable us to provide these services.  We will treat any information given to us in line with our obligations under data protection legislation, including the provisions of Regulation (EU) 2016/679 (the General Data Protection Regulation or GDPR) and the Data Protection Act 2018, and will work on the basis that any information you have provided to us has been provided to us lawfully.  We will collect different types of information about you for different reasons, as described below.

We may collect, use, store and transfer different kinds of personal data about you as follows:

• Identity Data including your name, date of birth, driving licence details, passport details and details of your next of kin
• Contact Data including your address, email, phone number
• Financial Data including bank details, bank statements, details relating to pay in employment;
• Transactional Data including details about payments to and from you and other details of services you have purchased from us;
• Technical Data including internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access our website;
• Profile Data including your username and password , purchases or orders made by you,  your interests, preferences, feedback and survey responses;
• Usage Data including information about how you use our website, products and services;
• Marketing and Communications Data including details recorded during telephone calls with our staff, your preferences in receiving marketing from us and our third parties and your communication preference.

Where your interaction with us relates to potential or actual employment with us or one of our customers we may collect, use, store and transfer employment data including details of your employment, education, training history, completed job application documents including any answers to tests and assessments;

In all instances we may also collect, use, store and transfer special categories of data about you including but not limited to: 

• Health and related information such as care or personal assistance arrangements and independent living support arrangements;
• Racial or ethnic origin; and
• Sexual orientation.

Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with goods or services). In this case, we may have to cancel a product or service you have with us but we will notify you if this is the case at the time.

3. How is your personal data collected?

We use different methods to collect data from and about you including:

• Direct interactions. You may give us your personal information by filling in forms or corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you apply for our services, create an account on our website, subscribe to our service or publications, request information to be sent to you, give us feedback, apply for a job through our recruitment process or contact us; and
• Third parties or publicly available sources.  We will receive personal data about your from various third parties as set out below:
  • Local Authorities and national and local health organisations including those that provide Personal Budgets, Direct Payments and Personal Health Budgets;
  • Members of your family and friends if they assist you and/or you ask us to communicate with them;
  • Employment agencies;
  • Personal Assistants;
  • Suppliers of goods and services such as domiciliary care agencies that you may want to use and banks;
  • Providers of background checks;
  • Professional advisors you have a relationship with such as financial advisers; and
  • Organisations such as HMRC and pension providers.

4. How we use your personal data

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• Where we need to perform the contract we are about to enter into or have entered into with you.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• Where we need to comply with a legal obligation

Occasionally, we may rely on consent as a legal basis for processing your personal data but where we do this we will explain what we would like consent for.

We have set out below, in a table format, a description of all  the ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table below.

Purpose/Activity	Type of data	Lawful basis for processing including basis of legitimate interest
All individuals
To process and deliver the services including: (a) Manage payments, fees and charges (b) Collect and recover money owed to us	(a) Identity (b) Contact (c) Financial (d) Transaction (e) Marketing and Communications	(a) Performance of a contract with you (b) Necessary for our legitimate interests (to recover debts due to us)
To manage our relationship with you which will include: (a) Registering you as a new customer (b) Notifying you about changes to our terms or privacy policy (c) Asking you to leave a review or take a survey	(a) Identity (b) Contact c) Profile (d) Marketing and Communications (e) Health information (f) Racial or ethnic origin (g) Sexual orientation	(a) Performance of a contract with you (b) Necessary to comply with a legal obligation (c) Necessary for our legitimate interests (to keep our records updated and to study how customers use our products/services)
To provide monitoring and evaluation information to our funders;	(a) Identity (b) Financial (c) Transaction (d) Marketing and Communications	Necessary for our legitimate interests (to ensure funding obligations are met and to be able to obtain future funding)
To comply with our legal responsibilities to HMRC , the Pensions Regulator, any other relevant official bodies and to comply with legal obligations to act in the public interest and uphold the rule of law	(a) Identity (b) Contact (c) Financial (d) Transaction (e) Marketing and Communications	Necessary to comply with a legal obligation
To comply with Safeguarding responsibilities and duties, including carrying out Disclosure and Barring Service (DBS) checks	(a) Identity (b) Contact (c) Financial (d) Transaction (e) Marketing and Communications (f) Health information (g) Racial or ethnic origin (h) Sexual orientation	(a) Necessary to comply with a legal obligation (b) Necessary to protect the vital interests of the data subject or of another natural person
To host training, meetings and events that you are attending	(a) Identity (b) Contact (c) Marketing and Communications	(a) Performance of a contract with you (b) Necessary for our legitimate interests (to ensure a standard of performance across the business)
To monitor the quality of services we deliver to you, and ensure they meet your expectations and to manage queries or complaints you may have.	(a) Identity (b) Contact (c) Usage	(a) Performance of a contract with you (b) Necessary for our legitimate interests (to ensure a standard of performance across the business)
To send you questionnaires and surveys for monitoring and evaluation purposes and staff and service development purposes.	(a) Contact (b) Marketing and Communications (c) Usage	Consent
To train and develop our employees;	(a) Identity (b) Contact (c) Financial (d) Usage	(a) Performance of a contract with you (b) Necessary for our legitimate interests (to ensure a standard of performance across the business)
To engage with independent living service and goods providers, such as domiciliary care agencies if you use one or want us to help you find such services and goods;	(a) Identity (b) Contact (c) Financial (d) Usage (e) Health information (f) Racial or ethnic origin (g) Sexual orientation	Performance of a contract with you
To administer and protect our business and our website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)	(a) Identity (b) Contact (c) Technical	(a) Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise) (b) Necessary to comply with a legal obligation
To deliver relevant website content and advertisements to you and measure or understand the effectiveness of the advertising we serve to you	(a) Identity (b) Contact (c) Profile (d) Usage (e) Marketing and Communications (f) Technical	Necessary for our legitimate interests (to study how customers use our products/services, to develop them, to grow our business and to inform our marketing strategy)
To use data analytics to improve our website, products/services, marketing, customer relationships and experiences	(a) Technical (b) Usage	Necessary for our legitimate interests (to define types of customers for our products and services, to keep our website updated and relevant, to develop our business and to inform our marketing strategy)
To make suggestions and recommendations to you about goods or services that may be of interest to you provided by LCIL or closely linked third parties, to send newsletters, articles and invitations to events and information relating to fundraising activities	(a) Identity (b) Contact (c) Technical (d) Usage (e) Profile (f) Marketing and Communications	Consent
Potential or actual employees of us or our customers
Making a decision about your recruitment, eligibility for work and employment. Including review of CV, application form and any related documents compiled in the recruitment process by you or a third party.	(a) Identity (b) Contact (c) Employment and education history	(a) Performance of a contract with you (b) Necessary for our legitimate interests (to ensure the appointment of suitably qualified staff for vacant positions)
Undertaking a review of your continued eligibility to work including fitness for work, managing sickness absence and making reasonable adjustments.	(a) Identity (b) Contact (c) Employment and education history (d) Health information	(a) Performance of a contract with you (b) Necessary for our legitimate interests (to ensure the continued appointment of suitably qualified staff for positions) (c) Necessary to comply with a legal obligation
Paying you and, if you are an employee or deemed employee for tax purposes, deducting tax and National Insurance contributions (NICs).	(a) Identity (b) Contact (c) Financial	(a) Performance of a contract with you (b) Necessary to comply with a legal obligation
Enrolling you in a pension arrangement in accordance with our statutory automatic enrolment duties.	(a) Identity (b) Contact (c) Financial	(a) Performance of a contract with you (b) Necessary to comply with a legal obligation
Business management and planning, including accounting and auditing.	(a) Identity (b) Contact (c) Financial	(a) Necessary for our legitimate interests (to allow the proper running of the business) (b) Necessary to comply with a legal obligation
Conducting performance reviews, managing performance and determining performance requirements including making decisions about salary reviews, compensation and training and development requirements	(a) Identity (b) Contact (c) Education and training history	(a) Performance of a contract with you (b) Necessary for our legitimate interests (to ensure a standard of performance across the business)
Gathering evidence for possible grievance or disciplinary hearings including legal disputes involving you, or other employees, workers and contractors, including accidents at work.	(a) Identity (b) Contact (c) Technical (d) Usage (e) Education and training history (f) Health information (g) Racial or ethnic origin (h) sexual orientation	(a) Performance of a contract with you (b) Necessary for our legitimate interests (to bring and defend legal claims) (c) Consent (where you data is required in relation to a third party issue)
Complying with legal and regulatory frameworks including health and safety obligations and prevention of fraud.	(a) Identity (b) Contact (c) Technical (d) Usage (e) Education and training history (f) Health records	Necessary to comply with a legal obligation
Equal opportunities monitoring.	(a) Identity (b) Health information (c) Racial or ethnic origin (d) sexual orientation	Consent

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us using the contact details at the top of this policy.

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law

5. Disclosure of your personal data

We may share your personal data with the specific third parties listed below:

• Local Authorities and national and local health organisations, including those that provide Personal Budgets, Direct Payments and Personal Health Budgets;
• Customers’ family and friends if they assist a customer and the customer asks us to communicate with them;
• Customers’ formal representatives;
• Personal Assistants;
• Suppliers of goods and services that our customers use or wish to use, such as domiciliary care agencies;
• HMRC ;
• The Pensions Regulator and pension providers;
• Charity auditors;
• Hosts of training and other events to inform them about attendees’ access and other requirements;
• Official bodies if required by law and/or Safeguarding obligations.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

6. International transfers

We do not transfer your personal data outside the European Economic Area (EEA).

7. Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

8. How long we will store your personal data for

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

Type of personal data	Retention period
General service provision records	We will keep such information for a period of 6 years from the date of our last interaction with you
Identification and Due Diligence	We will keep information that we need to complete anti-money laundering and due diligence checks for a period of 5 years from the date of our last interaction with you; this is in order to comply with our anti-money laundering obligations.  If you continue to work with us, we will update this information at least every 3 years.
Financial transactions	We will keep information about you and any financial transactions, including fees paid and payments for services, for a period of 7 years, in order to comply with HMRC requirements to keep accurate records that can be audited.
HR records	We will keep such information for a period of 7 years from the date of the end of employment.
Contact information for marketing purposes	Contact information for these purposes will need to be refreshed periodically and in any event at least every 2 years. We will hold you contact details on a suppression list once consent is withdrawn to ensure that no further marketing materials are sent.
Employment application	We will keep any information relating to an employment application process for a period of 12 months after the relevant position opening has been closed. During this time we may use your contact details to inform you about other Leeds CIL jobs you may wish to apply for.

9. Your legal rights

Under certain circumstances, you have rights under data protection laws in relation to your personal data. These rights include:

You have the right to:

• Request access to your personal data (commonly known as a data subject access request). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
• Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
• Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
• Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
• Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios:
  • If you want us to establish the data's accuracy.
  • Where our use of the data is unlawful but you do not want us to erase it.
  • Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims.
  • You have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
  • Grounds to process your information which override your rights and freedoms.

• Request restriction of processing Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
• Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

If you want more information about your rights under GDPR, please see the guidance from the Information Commissioners Office on Individual's rights under the GDPR.

If you want to exercise any of these rights, please email, call or write to our DPM (see ‘Who We Are' a).  When doing so please provide us with the information we need to identify you such as your name, address, email address and matter reference.  We may need to contact you to request:

• further information to verify your identity;
• proof of your identity and address;
• details of the right or rights that you wish to exercise;

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated. If we are processing significant amounts of data for you, or numerous categories of data, we may also ask you to define the categories of data to which you are exercising your rights.

Changes to this privacy notice

This privacy notice was reviewed in May 2019.  It is due for review no later than end May 2020.  We constantly review our internal privacy practices and may change this policy from time to time.  When we do we will inform you by updating our website and telling you in any documentation or messages we send you.

Accessibility

If it would be helpful to have this notice provided in another format (for example: in another language, audio, braille) please contact us.