Our GDPR (General Data Protection Regulation) statement
Grapevine Coventry and Warwickshire Ltd (Grapevine) collects information for the purposes of reporting back to funders, to evaluate our own performance and to contact you about the project or piece of work you are currently involved with.
We may collect personal, identifiable information for our records which will be kept securely on our online, backed-up, double password protected system.
All of our funders require reports which often ask for anonymised data including demographics, performance indicators and case studies. Each project will have its own minimum data set.
1. Our lawful basis for processing
Under GDPR, we rely on the following legal grounds:
- Legitimate interests: For standard personal data, where it is necessary for us to deliver our services and report to funders
- Explicit consent: For “Special Category” data (such as ethnicity and health information), which we use to ensure our services are inclusive and safe.
2. What information we collect
The information we collect depends on the specific project, but typically includes:
- Personal details: Name, address, date of birth and gender
- Support and safety: Disabilities, health needs/allergies, communication needs, reasons for referral and access needs
- Demographics: Ethnicity, free school meals eligibility, housing benefit or universal credit, school/college/provider name, school attendance information (under 18s only)
- Contact details: Name of parent/carer, emergency contact number, contact number for person referred and parent email address.
3. Why we collect your information
We collect and process your data for the following purposes:
- Service delivery: To contact you about the project you are involved with and provide appropriate support
- Safety and safeguarding: To ensure we are aware of any health, communication or access needs so we can work with you safely in communities (for example, do you have any health issues that we need to be aware of in order to help you stay safe and healthy?)
- Evaluation and funding: To prove our effectiveness to funders; this is crucial in allowing Grapevine’s work to continue and helps show our reach, diversity and impact
- Equality monitoring: To evaluate how well we are doing and monitor if there are any gaps in our work against our organisational/project objectives (for example, are we working with enough autistic people?).
4. How we store and share your data
- Security: Your data is kept securely on our online, backed-up and encrypted management system (Beacon). Access is restricted to authorized staff
- Anonymisation: While our internal systems contain identifiable data to track your progress, all reports generated for funders, our Board, or external partners are anonymised unless we have sought your specific written consent to share a named case study.
5. How long we keep your data
We do not keep your information for longer than is necessary. Your data will typically be held for the duration of the project plus two years for final analysis and audit purposes.
We may hold information for longer only if there is a legal requirement, a safeguarding necessity or if it relates to a formal complaint.
6. Your rights
You have the following rights regarding your data:
- Right to be informed: You have the right to be told exactly how we use your data. This Privacy Notice is designed to meet this right
- Right of access: You can request a copy of the personal data and notes we hold about you. We will respond to your request as soon as possible, within one month at the latest
- Right to rectification: You have the right to ask us to correct or update any information you think is inaccurate or incomplete
- Right to erasure (Right to be forgotten): In certain circumstances, you can ask us to delete your personal data from our systems
- Right to restriction of processing: You can ask us to “pause” or limit how we use your data (for example, you are happy for us to hold your contact details but do not want us to use your health information)
- Right to data portability: You have the right to ask that we transfer the information you gave us to another organisation, or directly to you, in a format that is easy to read
- Right to object: You have the right to object to us using your data for certain things, such as direct marketing or for our “legitimate interests”
- Rights related to automated decision-making: This right protects you against decisions made without human involvement (note: Grapevine does not use automated decision-making or data profiling; every decision about your support is made by a member of our staff).
7. Contact and complaints
If you wish to exercise your rights or have questions, please contact our Office Manager at 02476 631040 or admin@grapevinecoventryandwarks.org.uk.