Privacy Policy

Introduction

This policy summarises how The Advocacy People collect and use personal information about the people who visit our website or give us their data over the telephone, face to face in person, and in writing, as well as how we store data, how we use it, and how those who give us their details can request that their data is used by The Advocacy People.

The Advocacy People take the privacy of our clients, supporters and volunteers very seriously, and are committed to protecting your privacy.

We are a “data controller” for the purposes of the UK General Data Protection Regulation (UK GDPR). This means that we are responsible for, and control the processing of, your personal information. Occasionally, we act as “Joint Data Controller” with our local authority commissioner.

The Advocacy People are registered with the Information Commissioner’s Office, registration no. Z9231372.

If you have any queries about this policy, please contact the Data Protection Officer –details can be found at the end of this document.

Scope

This policy only applies to The Advocacy People’s advocacy services. Each of the local Healthwatch we host has its own Privacy Policy which can be found on its website.

For job applicants, employees, workers, and volunteers, see separate Privacy Notice available from HR or from the Data Protection Officer.

Definitions

Data Protection Officer (DPO). Our DPO helps us monitor internal compliance, informs and advises on our data protection obligations, provide advice regarding Data Protection Impact Assessments (DPIAs) and acts as a contact point for the people whose information we process and the Information Commissioner’s Office (ICO) (adapted from ICO Feb 2025).

Personal data/personal information. Information relating to natural persons who a) can be identified directly from the information in questions; or b) who can be indirectly identified from that information in combination with other information. Identifiers include but are not limited to name and location data.

The Advocacy People’s Privacy Statement

The Advocacy People are fully committed to complying with data protection legislation and have a legal duty to protect any information we collect from you. The following principles apply whether we hold your information on paper or in electronic form.

Your personal information is only used for the purpose for which we collected it.
Only information that we need to deliver a service is collected.
Your personal information is only seen by those who need it to do their jobs.
We will not share your personal information on to any other organisation without your consent unless we are required to do so by law (see “Sharing information” below).
Personal information is retained only for as long as it is required for the purpose collected.
We will, where necessary, keep your information up to date.
Your information will be protected from unauthorised or accidental disclosure.
We will provide you with a copy of your personal information on request (please see below for information on access rights and requests).
Inaccurate or misleading data will be corrected as soon as possible.

When do we collect information?

We obtain personal information from you when you:

enquire about our activities
make a referral for yourself or another person
send or receive an e-mail
donate to us
ask a question or otherwise provide us with personal information.

Contact and referrals from third parties

We may also receive information about you from third parties; for example, from a social worker who wants to make a referral on your behalf or a relative who asks for information to be provided. We will check that they have your consent to share the information.

If you complete a referral form, or contact us about a third party, we expect you to have the consent of the person concerned and, unless they lack capacity to consent, we will need their consent to proceed with any casework.

Children and young people

The Advocacy People are concerned to protect the privacy of children and young people aged under 16. Where appropriate, we will seek consent from a parent or guardian before collecting personal information about a child aged under 16.

What information do we collect?

The Advocacy People lawfully process personal data in the delivery of services on the basis of legitimate interests.

Personal data is:

necessary to enable us to deliver a service
processed and stored ethically
collected and processed in a way a reasonable person should expect the processing in the circumstances.

When you first contact us, the information we ask for may include:

Your name and contact details
An outline of the issue you are contacting us about. This may include details of a personal nature if this is required for the purpose you have contacted us about.

We may also ask for information about protected characteristics to allow us to review whether our services reach all communities and work in a way that meets people’s needs (Equality Act 2010). You do not have to provide this information if you would prefer not to. Protected characteristics include:

Age
Ethnicity
Gender
Disability

During our work with you we will store copies of any emails or correspondence and notes about the support we have given you.

How do we keep and protect personal information?

Data that you submit verbally (face-to-face / via video or phone call) and in writing (email / letter / webchat / online form / text) is stored and transmitted in line with the UK GDPR and Data Protection Act 2018 and will not be transferred outside of the UK unless we undertake transfer risk assessments required under the law. Where personal data is stored outside of the UK and the EEA, safeguards to protect personal data may include but are not limited to the UK Addendum used in conjunction with the EU Standard Contractual Clauses (SCCs), or UK International Data Transfer Agreement (IDTAs). Such safeguards are subject to Transfer Risk Assessments (TRAs).

Information is stored in an online secure database and other servers protected by encryption and password security. Printed items such as letters are scanned and uploaded to the database. Unless otherwise requested, the original document will be securely destroyed.

Telephone calls are recorded for quality and training purposes. Recordings are not routinely uploaded to our database and are automatically deleted from the secure telephone system three months after the recording is made. Exceptions to this include to enable us to respond to a safeguarding concern or complaint about our services. The original recording will still be deleted after three months.

How long do we keep personal data?

We keep identifiable data for eighteen months after we have last been in contact with you. After eighteen months we consider that your data is no longer necessary for the purpose for which we collected and processed it and will be anonymised, unless we:

are required to keep data longer due to contractual requirements.
consider there is a potential risk to our staff.

Your data subject rights

Under data protection laws in the UK and EU, you have certain rights over the personal information that we hold about you. If you would like to exercise your rights, please get in contact with any of the details listed above. Here is a summary of the rights we think apply:

Right to be informed. You have the right to be informed about the collection and use of your personal data. The information must be provided at the time your personal data is collected, and you must be given the opportunity to ask questions. At any time, if you have any questions, please get in touch using the contact information at the end of this Notice.
Right of access. You have a right to request access to a copy of your personal information that we hold about you, along with the information on what personal information we use, why we use it, who we share it with, how long we keep it for and whenever it has been used for automated decision making. You can make a request for access free of charge and proof of identity is required. This is called a Subject Access Request.
Right to object. You have the right to object to processing where we are using your personal information such as where it is based on legitimate interests or for direct marketing.
Right to rectification. Inaccurate or incomplete information we hold about you can be corrected. The accuracy of your information is important to us and we are working on ways to make this easier for you to review and correct the information that we hold about you. If any of your information is out of date or if you are unsure of this, please get in touch through any of the contact details listed in this notice.
Right to data portability. You can ask us to provide you or a third party with some of the personal information that we hold about you.
Right to restrict processing. You have a right to restrict the processing of some or all of your personal information if there is a disagreement about its accuracy, or we are not lawfully allowed to use it.
Right to erasure. You may ask us to delete some or all of your information we hold about you. As personal information is held on the basis of legitimate interests, this will mean we are not able continue our service to you. Sometimes where we have a legal obligation we cannot erase your personal data.
Rights related to automated decision making and profiling. Automated decision-making takes place when an electronic system uses personal information to make a decision without human intervention. The Advocacy People do not undertake these activities.

If you have any queries or wish to make a request, contact details for our Data Protection Officer (DPO) can be found at the end of this Notice.

Contact after finishing our work with you

We will only contact you for the purposes of collecting feedback about our services or in responding to a concern, complaint or compliment. If you would prefer not to be contacted, please let a member of our team know.

We will not at any time use your information for marketing purposes such as promotion of events or services.

Sharing Information

With your consent

In the course of our work with you, we might need to share information with another organisation so we can help resolve your situation, for example, when making a complaint about an NHS service, or when the advocacy service is being transferred to a different provider. We will always seek your consent, usually in writing.

Without your consent

The only time we would share your information is if you tell us something which makes us think you or someone else may be:

at risk of serious harm or abuse (we rely on vital or legitimate interests to share such information)
committing a serious criminal offence, or if a court says we must (we rely on legal obligation as the lawful basis to share such information)

We will always try to tell you if we are going to do this.

Using anonymised data

We might use anonymised data (i.e. in a way that no one will be able to identify you) to tell people about what we do, for example, in reports to the organisations who fund our services and case stories which help explain what advocacy is.

Working in partnership

Depending on which local authority area you live in, we may work in partnership with other advocacy providers. This means we may subcontract our work with you to another advocacy organisation, in which case they will be bound by the same requirements as we are under this policy. A full list of our partners is available on the Partners and Supporters page of our website. Alternatively, The Advocacy People may ourselves be subcontracted by other advocacy providers. Your advocate will be able to clarify any specific queries you may have. We rely on legitimate interest to work within such partnerships.

Websites

Personal information processed in our website, i.e. through webchat or our ‘Contact Us’ form, is transferred to our database and deleted.

We gather general information about the use of our websites (The Advocacy People and the local Healthwatch we host), such as which pages users visit most often, and which are of most interest. We may also track which pages users visit when they click on links sent in The Advocacy People’s e-mails. We will not sell any information about your web browsing activity.

Cookie Usage. The Advocacy People’s website uses cookies, tracking pixels and related technologies. Cookies are small data files that are served by our platform and stored on your device. Our site uses cookies dropped by us or third parties for a variety of purposes including to operate and personalise the website. Cookies help us to provide you with a better experience by allowing us to understand what areas of the website are of interest to our visitors (e.g. via Google analytics) so we can make improvements.

Our cookies aren’t used to identify you personally. They collect anonymous information on the pages visited and we do not use advertising cookies. Most browsers will allow you to turn off cookies. Please note however that turning off cookies will restrict your use of our website. To learn more about cookies and how to manage them, visit AboutCookies.org.

Other websites

Our websites may include links to websites run by other organisations. The Advocacy People are not responsible for the privacy practices of these other websites so you should read their privacy policies carefully.

Donations

If you are kind enough to give a donation, we may contact you to thank you, for which we will rely on our legitimate interest as the lawful basis, or to obtain your permission to publicise details of your particular case or feedback; but not any details that identify you without your consent.

We do not share or sell donor details with other charities or third parties.

Changes

If your personal details change, please help us to keep your information up to date by notifying your advocate or other member of our team.

This Notice will be reviewed every two years or after any significant changes to services, legislation or best practices and therefore we may change the terms of this Privacy Notice from time to time. If we do so, we will publish the revised policy on The Advocacy People’s website so please check from time to time. By continuing to use our website you will be deemed to have accepted such changes.

Data Protection Regulator

Further information and independent advice about data protection issues is available from the Information Commissioner’s Office at www.ico.org.uk.

For further information and requests

If you would like further information regarding the processing of your personal data, and/or would like to make a rights request, please contact our external Data Protection Officer in the first instance. Our Data Protection Officer is currently Nesar Khan from Hope & May, an external data protection specialist organisation. The DPO can be contacted at nesar.khan@hope-may.com or by calling 0330 111 0013.

Subject Access Requests can be submitted verbally or in writing. You may wish to use our Subject Access Request Form to ensure you supply all the information we need to process your request. You can also use this form if you are requesting information on behalf of somebody else. Please call or email using the details above if you would like to make a request.