Privacy policy
The 180 Programme is a not for profit Community Interest Company (CIC) registered at Companies House (No. 11146784). We are a charitable cause with a head office at Unit 25 Albert Mill, Albert Place, Darwen, Lancashire, BB3 0QE.
The project is supported by the commercial activities of our trading company, 180 CrossFit DeltaFox, which donates all its profits to the organisation. This policy covers both bodies and any personal information collected may be used across both entities.
Aims and objectives
The 180 Project is committed to operating lawfully in line with GDPR and ensuring that we are open, honest and transparent about the ways in which we use your personal information.
The organisation operates within a set of 180 Values:
A commitment to treat and value everyone equally, respecting differences.
A commitment to transparent, honest, and open relationships, and a working through of differences.
A deep sense of hope that things can change and be transformed, and that people can come to fulfil their God given potential.
A commitment to promoting reconciliation, between individuals, families, and communities.
An intention to be a blessing, graciously reaching out to others.
A commitment to working for justice, working to protect the vulnerable and provide for those in need, being biased in favour of the disadvantaged.
Purpose
The purpose of this policy is to explain what to expect when we collect and use your information.
The key objectives of this policy are:
to explain what personal information is.
to explain how we collect and use personal information.
to explain how we keep your personal information safe.
to explain your rights in respect of your personal data.
to ensure staff and volunteers understand and are able to operate in line with GDPR.
for participants and members to understand how their personal information will be stored/used.
Legal framework
The personal information we collect is processed in accordance with General Data Protection Regulation (GDPR) (EU) 2016/679 and Protection Act 2018 which ensures that we have the right controls in place to use it responsibly and keep it safe from inappropriate access or misuse.
Organisations that collect personal data need to have a lawful basis for doing so. The law sets out six ways to process personal data. Four of these are relevant to the types of processing that we carry out. This includes information that is processed on the basis of:
a person’s consent
the 180 Project’s legitimate interest
a contractual relationship (e.g. to provide you with goods/services purchased)
processing that is necessary for compliance with a legal obligation (for example to process a gift aid declaration and carrying out due diligence on large donations)
Personal information may be legally collected and used if it is necessary for a legitimate interest of the organisation using the data, as long as its use is fair and does not adversely impact the rights of the individual concerned. When we use your personal information, we will always consider if it is fair and balanced to do so and if it is within your reasonable expectations. We will balance your rights and our legitimate interests to ensure that we use your personal information in ways that are not unduly intrusive or unfair.
What is personal information?
Personal information is any data which is related to an identified or identifiable natural person. This information allows a person to be uniquely identified, either on its own or when linked with other information.
Examples include:
Personal identifiers - title, name, date of birth
Contact details - postal address, post code, telephone number, email address
GDPR recognises some information as special categories of personal data because the information requires more protection due to its sensitivity. This includes but is not limited to, data which is related to; race or ethnic origin, sexuality, religious beliefs, health issues and criminal convictions
We will always treat all information, including any special categories of personal data we process, with the greatest care and respect.
Why we collect personal information
We collect personal information from parties we engage with in order to meet our organisational objectives and fulfil commercial contracts.
This allows us to:
provide services which respond to need.
meet contractual obligations.
plan, manage and develop our service provision.
keep people informed about our work.
fundraise effectively.
plan, manage and develop our commercial offer.
What personal information we collect and how it is used
Service users (Participants)
All information shared by participants will be treated with the utmost respect, in line with The 180 Project Confidentiality Policy whilst also adhering to The 180 Safeguarding Adults, Children and Young People Policy.
Whether you have contacted us directly or have been referred to us by another agency, we will ask you for your personal details and information about your health and circumstances to ensure our programme is suitable for you.
Participants entering the programme will be asked about their ethnicity and family circumstances. This special information allows us to establish how best we provide support within our diverse community.
At periodic intervals, participants will be asked to complete reviews about their experience on the programme. We will provide further details about how this information will be used and shared.
When participants agree to share their 180 story, to support our work and engage with others with similar experiences, we will provide details about how it will be used and shared.
All personal and special information entrusted to us is stored and shared strictly in line with the 180 Project Confidentiality and Safeguarding policies.
Staff and Volunteers
When individuals apply to work or volunteer at The 180 Project, we will use the information they supply to us to process their application. Where we want to disclose information to a third party, for example to take up a reference or obtain a ‘disclosure’ from the Disclosure and Barring Service, we will not do so without informing them beforehand unless the disclosure is required by law.
Personal information about unsuccessful candidates will be held for 12 months, after which it will destroyed or deleted. We may retain de-personalised statistical information about applicants to help inform our recruitment activities however no individuals will be identifiable from that data.
After a person takes up employment with The 180 Project, we will compile a file relating to their employment. We have to hold this information in order to employ people. The information contained within this file will be kept private and confidential and will only be available to access by key personnel for purposes directly relevant to their employment. Once their employment with us has ceased, we will retain the file for seven years before it is deleted.
Fundraising
Fundraising plays a vital role to support the delivery of our services. We rely on the support of individuals, organisations and businesses who fundraise and donate to The 180 Project to help us continue our work and achieve our mission.
If you are making a donation through our website, our online payment processing platform, Stripe, will require you to provide your name, address, banking/credit card and contact details. This information will be used to process and complete your donation. We do not keep a record of these debit/credit card details.
If you sign up for one of our fundraising events, we will use your contact details to provide you with information about the event and any associated fundraising.
We may also use the services of online platforms to manage registrations for events we run and to support fundraising campaigns. When you submit your personal information to these platforms, the platform will collect and send your registration details to us.
To help us plan and deliver our fundraising activities, it is important for us to have an insight into our beneficiaries. This allows us to tailor our communications and make appropriate approaches for financial support to those who have opted into communications, made donations in the past and to potential donors who may contribute in the future.
To do this we may:
analyse your existing relationship with The 180 Project.
review information made available publicly by the Charity Commission, Companies House, social media and information that has been publicly published in newspapers and articles, if we have reason to think that someone could be interested in our cause.
Websites
Our websites uses cookies where necessary to support basic functions and allow the website to function effectively. Cookies are small text files that are placed on your computer by websites that you visit. They are widely used in order to make websites work, or work more efficiently, as well as to provide information to the owners of the site.
When you first visit our sites, we will ask you to either accept our use of cookies or block them in your browser. Please be aware that blocking cookies may cause some areas of the website to function incorrectly.
We also make use of Google Analytics which uses cookies to help us to monitor performance. Information collected by cookies is in an anonymous form and is not personally identifiable. It allows us to analyse visitor behaviour such as; how visitors came to our site, how often they have visited, what device was used and which pages they visited. We do not make any attempt to find out the identities of those visitors.
Our websites may contain links to third party websites. This policy only applies to our websites, if you leave our websites to follow links to third party websites, we encourage you to be aware of the privacy policies of those sites.
We may from time to time use a third-party provider, Hootsuite, to manage our social media interactions. If you send us a private or direct message via social media the message will be stored by Hootsuite for three months.
Customers
Payments for goods purchased through our online shop are taken via our online payment processing platform, Stripe, which will require you to provide your name, address, banking/credit card and contact details. This information will be used to process and complete your donation and where it is necessary, contact details will be shared with suppliers to fulfil orders. We do not keep a record of these debit/credit card details.
DeltaFox Members
We offer various services to our members and hold the details of the people who have requested our services, such as a gym membership, in order to provide it to them. However, we only use these details to provide the service the person has requested and for other closely related purposes, e.g. to inform members of new classes or timetables, to share updates/news about the gym, to publicise upcoming events.
When new members sign up using the Wix app, their consent to these communications is requested.
Where new members have completed paper membership or waiver documents prior to the developed Wix app, these documents have been scanned and saved within a protected folder in the organisations shared drive only available to access by key personnel for purposes directly relevant to their membership. Scans of these documents will not show any banking details given to set up subscriptions. Paper copies of all of the above are destroyed immediately after scanning.
These documents will be form part of the cyclical GDPR audit which is carried out annually. Where there is no longer a need to keep them on file, they will be deleted.
The developed Wix app will remove the need for any paper documents to be used.
We use third-party data processors to manage memberships, booking apps and to process and manage payments. They include, but are not limited to, Clubwise and Wix, Further information on these companies and their privacy policies can be found on their websites or supplied by us upon request.
Communications
In order to achieve our vision, ‘To break the cycle of addiction, crime and prison … creating a lasting recovery’, we need to reach as many people as possible and share our work. We, therefore, think it is reasonable and legitimate for us to use your contact details to contact you by email to tell you more about our work and how you can support us. This includes newsletters, appeals, events, campaigns and information on volunteering.
We fully respect your choice to receive these communications. We will ask your permission to be included in our mailing list from which you can unsubscribe at any time by contacting at hello@180project.co.uk.
Who we share information with
We recognise the importance of working with other partner organisations with common goals, for example other charities, healthcare organisations, fitness establishments or companies. This often allows us to achieve more than doing things on our own.
In these cases, we may share your personal information with third parties with the skill, experience and facilities to support your needs. We will always ask you first if you are happy with this and give you the choice on whether your details are passed to our partners or not. We will only share personal information when it is consented to or in the case of identifying someone who is at risk of harm.
Our contracts with third parties require that any personal information shared is subject to appropriate contractual confidentiality obligations. This commits our partners to process your personal information only on our instructions and in accordance with applicable data protection and privacy laws.
Very occasionally we may be legally required to share information with official agencies, regulatory bodies, local authorities or the police to protect you or to prevent or detect a crime. We may share information you give us if a member of staff or volunteer has concerns about your own or someone else's safety or wellbeing. We would need to share what you tell us if:
we believe your life or someone else’s life is in danger.
you tell us that you or someone else is being, or is at risk of being, abused by another person.
it is necessary to prevent or detect a crime.
we are required to do so under a court order.
How we keep your information secure
We undertake an annual review our information collection, storage and processing practices, including physical security measures, to guard against unauthorised access to systems and prevent your personal information from being accidentally lost, altered or disclosed. We restrict access to personal information to employees and volunteers who have legitimate reason to need it.
If it is necessary to transfer data to or from third parties, we will always seek your consent and use a secure method to do so.
We follow procedures set out by the Information Commissioner’s Office to deal with any suspected personal data breach and will notify you and any applicable regulator e.g The Data Protection Authority/Supervisory Authority of a breach where we are legally required to do so. For further details see: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/personal-data-breaches/
How long we keep your information
We know that your needs for support and your relationship with us will change over time.
We will keep your personal information only for as long as we have an ongoing relationship with you or for as long as we need it for compliance purposes in accordance with statutory requirements.
We retain service user records for seven years after they complete their ‘participant’ journey with us and delete their files after this.
We keep financial records and details of any contracts we enter into with you for seven years after the relevant transaction.
Where it is necessary for us to keep financial records to honour contractual obligations with funders, they will be held only for as long as is required.
We may keep details about any actual, suspected or potential criminal offences or concerns for longer periods of time in accordance with governmental, regulatory or police guidance.
Your rights
The General Data Protection Regulation (GDPR) gives you control of your personal information and the way it is used.
You have the right to:
change how or if we contact you at any point
request a copy of the information we hold about you at any time
ask us at any time to; amend your personal information, limit the way we use your data, withdraw consent to use your data for direct marketing, stop analysing your data to understand our supporters better, or delete your data.
Reporting concerns
The 180 Projects strives to meet the highest standards to protect your privacy. For this reason, we take any concerns about this very seriously.
This policy was drafted with brevity and clarity in mind. It does not provide exhaustive detail of all aspects of our collection and use of personal information. However, we are happy to provide any additional information or explanation needed.
If you have any complaints about the way we collect and manage your personal information, we encourage you to bring it to our attention by applying The 180 Project Complaints Policy. If you are unhappy with the way we respond to any complaint, you also have the right to complain to the Information Commissioner’s Office which regulates the use of personal data in the UK or to the Fundraising Regulator which regulates fundraising charities.
Changes to this policy
The 180 Project will review this policy annually or as and when required by legislation.
Contact us
If you would like to contact us in relation to this policy, please use the details below:
The 180 Project
Unit 25 Albert Mill
Albert Place
Darwen
BB3 0QE