Privacy Statement

Privacy Statement - your rights, your information and how we use it

Our Privacy Statement

STAR Project is committed to protecting your personal information.

Our Privacy Statement contains important information about what personal details we collect; what we do with that information; who we may share it with and why; and your choices and rights when it comes to the personal information you have given us.

We may need to make changes to our Privacy Statement/Policy; so please check our website for updates from time to time. This version of our Privacy Statement was last updated in April 2024. Given that STAR Project is a not-for-profit organisation, and given the nature of information we hold and process, we are exempt from notifying the Information Commissioner’s office under the terms in the legislation.

How to contact us

If you have any questions about our Privacy Statement or the information we collect or use about you, please contact;

FAO Data Protection
STAR Project
12-14 Wallace Street
Paisley PA3 2BU
Tel: 0141 889 5850
Email: enquiries@star-project.org.uk

Information we collect and use

Information about you that we may collect and use includes:

  • Information about who you are e.g. your name, date of birth and contact details (including an emergency contact)
  • Information about when and how you engage with our services e.g. Drop-In or group attendance, befriending appointments
  • Information about your contact with us e.g. meetings, phone calls, emails / letters
  • Information classified as ‘sensitive’ personal information e.g. relating to your health, marital or civil partnership status. This information will only be collected and used where it’s needed to provide the product or service you have requested or to comply with our legal obligations, and only with your explicit consent
  • Information on children e.g. where a child is named by a parent or guardian on their behalf e.g. attendance at our Wee STARs toddler group, summer day trips. In these cases, we will collect and use only the information required to identify the child and meet the child’s needs (such as their name, age, gender)

Where we collect your information

We may collect your personal information directly from you, from a variety of sources, including:

  • Application and registration forms
  • Referral forms or details for a specific service
  • Phone conversations with us
  • Emails or letters you send to us
  • Signing up for one of our events
  • Attendance records
  • Our social media accounts
  • Disclosures/PVG’s:

As a registered organisation with Volunteer Scotland Disclosure Service (formerly known as Central Registered Body in Scotland) we receive Disclosures/PVG’s from Disclosure Scotland regarding people’s fitness to work with children and vulnerable adults. This information is handled according to our Policy on PVG Secure Handling.

What we collect and use your information for

We take your privacy seriously and we will only ever collect and use information which is personal to you where it is necessary, fair and lawful to do so. We will collect and use your information only where:

  • You have given us your permission [consent] to contact you with information about products and services offered by us which we believe may be of interest and benefit to you
  • It’s necessary to provide the product or service you have requested e.g. if you wish to attend one of our services or events
  • It’s in the legitimate interests of STAR Project e.g. so we can carry out our obligations arising from any contractual agreements with you, funders, and trusted partners

If you do not wish us to collect and use your personal information in these ways, it may mean that we will be unable to provide you with our services.

Who we may share your information with

We may share your information with third parties for the reasons outlined in 'What we collect and use your information for.'

These third parties include:

  • Organisations we have chosen to support us in the delivery of the products and services we offer to you and other clients e.g. Advice Renfrewshire appointments

We will never sell your details to someone else. Whenever we share your personal information, we will do so in line with our obligations to keep your information safe and secure.

Where your information is processed

All of your information is processed in the UK

How we protect your information

We take information and system security very seriously and we strive to comply with our obligations at all times. Any personal information which is collected, recorded or used in any way, whether on paper, online or any other media, will have appropriate safeguards applied in line with our data protection obligations.

Your information is protected by controls designed to minimise loss or damage through accident, negligence or deliberate actions. Our employees also protect sensitive or confidential information when storing or transmitting information electronically.

Our security controls are aligned to good practice; providing a control environment that effectively manages risks to the confidentiality, integrity and availability of your information.

How long we keep your information

We will keep your personal information only where it is necessary to provide you with our services.

We may also keep your information after this period but only where required to meet our regulatory obligations. The length of time we keep your information for these purposes will vary depending on the obligations we need to meet.

INFORMATION

RETENTION PERIOD

LEGISLATION/REQUIREMENT

Beneficiary details

For period of registration or membership while accessing services/support plus 3 years unless otherwise instructed by subject

Reporting & Monitoring effectiveness/impact, Funding & Governance reporting requirements

Employee details

6 Years

HMRC

Volunteer details

For period of registration or membership while accessing services plus 3 years unless otherwise instructed by subject

Reporting & Monitoring effectiveness/impact/Funding requirements

Application/interview details of unsuccessful candidates

6 Months

Equality Act 2010 Limitations Act

Governance, Historic relevance, Company, Pension & Insurance documents

Permanently

Pensions Act, Employers Liability (Compulsory Insurance) Regulation, Charities Act 2005 & Companies Act

Financial/resources & delivery of services/goods documents

6 Years

Taxes Management Act, VAT Act & Charities Act 2005 & Companies Act

Accident books, records/reports

3 years after last entry or end of investigation if later

RIDDOR Regulations

Your individual rights

You have several rights in relation to how STAR Project uses your information. They are:

Right to be informed

You have a right to receive clear and easy to understand information on what personal information we have, why and who we share it with – we do this in our Privacy Policy and Privacy Statement.

Right of access

You have the right of access to your personal information. If you wish to receive a copy of the personal information we hold on you, you may make a data subject access request (DSAR). This can be done in writing or verbally.

Right to request that your personal information be rectified

If your personal information is inaccurate or incomplete, you can request that it is corrected.

Right to request erasure

You can ask for your information to be deleted or removed if there is not a compelling reason for STAR Project to continue to have it.

Right to object

You can object to STAR Project processing your personal information where: it’s based on our legitimate interests; for direct marketing; and if we were using it for scientific/historical research and statistics.

How to make a complaint

We will always strive to collect, use and safeguard your personal information in line with data protection laws. If you do not believe we have handled your information as set out in our Privacy Statement, please contact us at the contact details above.

If you are still unhappy, you can complain to the Information Commissioner https://ico.org.uk/concerns/