Privacy Policy

Introduction

This Privacy Policy explains how Improving Lives Plymouth collects, uses, stores and protects personal information.

It applies to personal information provided by members of the public through our website, by telephone, in person, in writing, or through another organisation making a referral. It also explains how you can manage your personal information and exercise your rights under data protection legislation.

We take your privacy seriously and are committed to protecting the personal information you share with us.

Improving Lives Plymouth is registered with the Information Commissioner’s Office under registration number Z4957486.

Improving Lives Plymouth is the data controller for the personal information described in this policy: we decide how and why it is used, and we are responsible for looking after it.

If you have any questions about this policy, please contact our Data Protection Lead using the details at the end of this policy.

We may update this policy when our services, responsibilities or use of personal information changes.

Our Privacy Statement

Improving Lives Plymouth processes personal information in accordance with the UK General Data Protection Regulation, the Data Protection Act 2018 and other relevant data protection legislation.

We are committed to ensuring that:

• Personal information is used fairly, lawfully and transparently.
• Information is collected for clear and specific purposes.
• We only collect the information we need.
• Access is restricted to staff and volunteers who need the information as part of their role.
• Information is only shared where there is a lawful reason to do so.
• Information is kept accurate and up to date.
• Information is retained only for as long as it is needed.
• Information is protected against unauthorised access, loss, alteration or disclosure.
• Individuals can exercise their rights in relation to their personal information.

These standards apply to both paper and electronic records.

How Do We Collect Information?

We may collect personal information when you:

• Make an enquiry about our services or activities.
• Are referred to one of our services.
• Contact us by telephone, email, in person or in writing.
• Complete an online or paper form.
• Provide feedback, a compliment or a complaint.
• Make a donation.
• Participate in one of our services, activities, groups or events.
• Subscribe to receive updates about our work.
• Apply for a job with us.
• Visit Ernest English House, where CCTV is in operation.
• Give consent for authorised staff to view relevant information through the Devon and Cornwall Care Record.

We also receive personal information about you from other people and organisations, including:

• Referrals from GPs, hospitals, social care and other health and care professionals.
• Carers, relatives or friends who contact us on your behalf.
• Councils, commissioners and funders of the services we provide.
• Partner charities and agencies we deliver services alongside.
• The Devon and Cornwall Care Record, where you have given consent for us to view it.

We use information received in this way only for the purpose it was shared with us for. Where it is appropriate and safe to do so, we will tell you that we hold information about you that came from someone else.

What Information Do We Collect?

The personal information we collect may include:

• Your name, address, telephone number, email address and date of birth.
• Next of kin or emergency contact details.
• Details of your enquiry, support needs or participation in our services.
• Information provided by an organisation or individual referring you to one of our services.
• Equality and diversity information used to help us monitor the reach, accessibility and effectiveness of our services.
• Special category information, such as information about your health, where this is necessary to provide services or support.
• Information relating to criminal offences where this is necessary and we have a lawful reason to process it.
• Information relating to donations, feedback, compliments, complaints or enquiries.
• Information you provide when applying for a job with us, including your CV.
• CCTV images recorded when you visit Ernest English House.
• Relevant information viewed through the Devon and Cornwall Care Record, where you have given consent for authorised staff to access it.
• Information about how our website is used, subject to your cookie preferences.

Photographs, videos or personal stories may be collected for publicity, reporting or promotional purposes where you have given clear permission.

Giving us information is usually your choice. For some things, though, we cannot go ahead without it: for example, registering you with a service, acting on a referral, booking you a place at an event or considering a job application. Where information is required, we will tell you, and we will explain what happens if it is not provided.

How Do We Use Your Information?

We may use your personal information to:

• Deliver and manage the services, support or activities you have requested.
• Assess your needs and provide appropriate information, advice or support.
• Manage referrals to and from our services.
• Meet contractual, funding, regulatory and reporting requirements.
• Monitor, evaluate and improve our services.
• Respond to enquiries, feedback, compliments and complaints.
• Contact you about your experience with us, including satisfaction surveys, service evaluations, research activities or opportunities to participate in research.
• Protect the safety and wellbeing of service users, staff, volunteers, visitors and members of the public.
• Comply with legal obligations and valid requests from authorised bodies.
• Investigate incidents, accidents, complaints or safeguarding concerns, including where relevant CCTV footage is required.
• Maintain the safety and security of our premises, facilities and property.
• Prevent or detect crime.
• Keep appropriate financial records relating to donations and other payments.

We will only use your information where we have a lawful reason to do so.

Where appropriate and necessary, we may share information with trusted partners, including local authorities, health and care providers, funders, regulators and organisations involved in delivering services. We will only share information that is necessary and proportionate for the relevant purpose.

If you donate, provide positive feedback or share your experience with us, we may contact you to say thank you or ask whether you would be willing for us to share your story.

We will always seek your permission before using an identifiable personal story, photograph or video for publicity or promotional purposes.

Research and Participation Opportunities

Improving Lives Plymouth may occasionally work with universities, research organisations, health and care partners, or other trusted organisations on research, evaluation or consultation activities.

We may contact you to make you aware of relevant research opportunities or ask whether you would like to take part.

We will not share your personal information with a third party for research purposes without your consent. Where appropriate, we may instead provide information about a research opportunity and allow you to contact the research organisation directly should you wish to participate.

Choosing not to participate in research will not affect the services or support you receive from Improving Lives Plymouth.

How We Process Information

We will only process personal information where we have a lawful basis to do so under UK data protection legislation. The bases we usually rely on for our main activities are:

• Providing services and support you have asked for or been referred to: the basis depends on the service, and we tell you which applies when you register with it.
• Safeguarding: our legal obligations, protecting your vital interests or those of another person, and tasks carried out in the public interest.
• Complaints, accidents and incidents: our legitimate interest in running the organisation properly and in establishing or defending legal claims, and our legal obligations, including health and safety law.
• Recruitment: taking steps at your request before entering a contract with you, our legal obligations as an employer, and our legitimate interests in recruiting safely and fairly.
• Donations and fundraising: our legitimate interest in raising funds, our legal obligations for Gift Aid and accounting, and your consent for marketing messages where the law requires it.
• Events and bookings: providing the place you have booked (a contract with you).
• Website enquiries: our legitimate interest in responding to people who contact us.

Where we rely on our legitimate interests, we have considered whether those interests are outweighed by your rights and freedoms, and you can object at any time (see Your Data Protection Rights below).

Special category information. Some of the information we hold is more sensitive: information about your health, disability, ethnic origin, religion, sexual orientation or similar. We only use this information where we have both a lawful basis and one of the additional conditions set out in Article 9 of the UK GDPR and Schedule 1 of the Data Protection Act 2018.

Criminal offence information. Occasionally we need to hold information about criminal offences or allegations, for example in safeguarding work, when carrying out DBS checks on staff and volunteers, or when investigating an incident. We do this only where the law permits it (Article 10 of the UK GDPR and Schedule 1 of the Data Protection Act 2018), with access restricted to the people who need it. We do not normally keep copies of DBS certificates. Where there is an exceptional, documented reason to keep a copy, it is kept for no longer than six months. We keep a record of the check, including the date, the certificate number, the level of check and the recruitment decision.

Where we rely on your consent, you can withdraw it at any time. This will not affect any processing that took place before you withdrew your consent.

We do not make decisions that affect you based solely on automated processing.

Contacting Us Through Our Website

Our website includes a contact form, a volunteering enquiry form and event booking forms. Each form tells you, at the point you fill it in, who will receive your information and how it will be used.

• Contact form: your message goes to the Improving Lives Plymouth team you select on the form, and we use it only to respond to your enquiry. We handle contact enquiries under our legitimate interest in responding to people who get in touch with us.
• Volunteering form: your enquiry goes to our HR team and the service you choose, and we use it to respond to your interest in volunteering and to arrange next steps with you. We process volunteering enquiries under our legitimate interests. You can object to us handling your enquiry at any time by emailing hr@improvinglivesplymouth.org.uk.
• Event bookings: your booking details go to Improving Lives Plymouth and the team running the event, and are used to manage your booking and to contact you about the event. We process bookings because they are necessary to provide the place you have asked for. Some paid events are paid for in person on the day. Where an event can be paid for online, payment is taken by PayPal. You can pay with a PayPal account or by card. Your card details are entered directly with PayPal and are never seen or stored by us; we receive only confirmation that the payment was made, the amount, and a PayPal reference, which we keep with your booking record. PayPal processes your payment under its own privacy statement, available at paypal.com/uk/legalhub/paypal/privacy-full. Tickets for some events are sold through Stripe instead. When you choose to book one of these events, you leave our website and pay on a secure page hosted by Stripe. Stripe collects your name, email address, payment details and the answers to any booking questions we ask.For some events we ask you to choose your meal on a short form on our website after you have paid. We use those answers only to give the venue your choices and delete them within four months of the event. Your card details are entered directly with Stripe and are never seen or stored by us. We can see your booking details in our Stripe account and use them only to run the event and to contact you about it. Our website itself records only an anonymous reference, the number of seats and the amount. Stripe processes your payment under its own privacy policy, available at stripe.com/gb/privacy.
• Subscribing to our newsletter: If you sign up for our email newsletter on our website, we ask for your email address and, if you choose to give it, your name. We rely on your consent: you tick a box to agree to receive the newsletter, and we send you an email with a link to confirm that the address is yours. We do not add you to the list until you click that link. Some people who joined our newsletter list before October 2026, and people we write to at their organisation’s address because their organisation works with us, also receive the newsletter; every issue carries an unsubscribe link and you can ask us to stop at any time. The sign-up form passes your details straight to Brevo, the company that sends the newsletter for us; our website does not keep a copy. So that we can show what you agreed to, the record held in Brevo includes the version of the wording you saw, the date and time, and the page you signed up on. Every issue carries an unsubscribe link, and you can withdraw your consent at any time by using it or by contacting us. If you ask us for a posted or other-format copy by phone, email or at reception, we use the details you give us only to provide it.

We keep contact and volunteering enquiries made through our website for 90 days, after which they are securely deleted, unless your enquiry leads to something more: if you go on to use one of our services, the information becomes part of your service record, and if you become a volunteer it becomes part of your volunteer file. The periods for those records are set out in the How Long We Keep Information section below.

Event booking records are kept in line with our Record Retention Policy. Where you are registered with one of our services, your booking forms part of your service record. Payment records, including those held in our PayPal and Stripe accounts, are kept for seven years as part of our financial records.

Registration as a client of our services is handled through a separate registration form provided by Charitylog (Dizions Ltd), the supplier of our secure client record system. Information you submit through that form goes directly into our client record system. Charitylog’s own privacy policy is available at charitylog.co.uk/privacy.

Our website forms are protected against automated misuse by Cloudflare Turnstile, which processes limited technical information about your visit for that purpose only.

Online payments for events are processed by PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A.). PayPal’s payment form loads only on the payment step of a booking, and PayPal sets cookies at that point that are needed to complete your payment securely. We do not use Apple Pay, Google Pay or any other wallet service on our own website.

Some event tickets are sold through Stripe (Stripe Payments UK, Ltd). Stripe’s payment page is hosted by Stripe, not by us, and nothing from Stripe loads on our website. Stripe sets its own cookies on its payment page to keep your payment secure. Stripe’s payment page may offer Apple Pay or Google Pay if they are set up on your device.

Our website also uses Google Fonts to display text. When a page loads, your device requests the fonts from Google, which involves sending your IP address to Google.

Organisations That Process Information on Our Behalf

Some of the systems we use are provided by other organisations, which process personal information on our behalf and on our instructions. They include:

• Our client record system, Charitylog, provided by Dizions Ltd.
• Microsoft 365, which provides our email, calendars, file storage and video calls.
• DigitalOcean, which provides the server our website runs on and where the information you give us through the website is stored.
• 2 Superior Studios Ltd, which maintains our website and its server on our behalf.
• SMTP2GO, which delivers email sent from our website, such as booking confirmations and replies to enquiries.
• PayPal and Stripe, for online payments.
• Cloudflare Turnstile, which protects our forms from automated misuse, and CookieYes, which records your cookie choices.
• Google, for website analytics, where you have accepted analytics cookies.
• Brevo, which holds our newsletter mailing list and sends the newsletter to people who have signed up. Brevo stores this information in the European Union.

Each of these organisations works under a written contract that requires it to keep the information secure, to use it only on our instructions, and to delete or return it when the contract ends. We do not allow them to use your information for their own purposes.

Your Choices About Contact

We may contact you about:

• Services you use or have expressed an interest in.
• An enquiry, referral or request you have made.
• Appointments, activities or administrative matters.
• Feedback you have provided.
• Safeguarding matters or other circumstances where contact is necessary.

You can ask us to stop sending promotional communications or change how we contact you at any time. This will not prevent us from contacting you where communication is necessary to provide a service, respond to an enquiry, meet a legal obligation or address a safeguarding concern. Your right to object to direct marketing is explained in the next section.

Your Data Protection Rights

Depending on the circumstances, you may have the right to:

• Ask us to correct inaccurate or incomplete personal information.
• Ask us to delete your personal information.
• Ask us to restrict how we use your personal information.
• Object to certain types of processing.
• Request a copy of your information in a portable format where applicable.
• Withdraw your consent where we rely on consent to process your information.
• Ask us to review certain decisions made solely through automated processing.
• Make a complaint to the Information Commissioner’s Office if you are unhappy with how your personal information has been handled.

These rights do not apply in every circumstance. If we cannot comply with a request, we will explain the reason where the law allows us to do so.

Your right to object. Where we rely on our legitimate interests or on a task carried out in the public interest, you can object to our use of your information. We will stop unless we can show compelling grounds that override your interests, rights and freedoms, or the processing is needed for legal claims. Where we use your information for direct marketing, you can object at any time and we will stop, without exception. To object, contact the Data Protection Lead using the details at the end of this policy.

For information about requesting access to the personal information we hold about you, please see the Subject Access Requests section below.

Subject Access Requests

You have the right to ask whether Improving Lives Plymouth holds personal information about you and to request a copy of that information. This is known as a Subject Access Request.

A request can be made verbally or in writing. You do not have to use a particular form, but completing our Subject Access Request Form may help us identify and process your request efficiently.

Complete the Improving Lives Plymouth Subject Access Request Form

We will respond without undue delay and normally within one month. Where permitted by data protection legislation, the response period may be extended if a request is complex or if you have made several requests. We will tell you if an extension is required.

We may ask for information to confirm your identity or authority to act on behalf of another person. This helps us make sure that personal information is released securely and only to someone entitled to receive it.

If we need further information to identify the records you require, we will contact you.

You can also make a request by contacting the Data Protection Lead using the details at the end of this policy.

We keep a record of your request and our response for three years, or six years where the request was complex, disputed or connected to a complaint or claim.

Safeguarding and Legal Obligations

Improving Lives Plymouth is committed to safeguarding the wellbeing of people who use our services.

There may be circumstances where we need to share personal information without consent, including where:

• We believe there is a risk of harm to you or another person.
• It is necessary to protect the welfare of a child or an adult at risk.
• We are required to share information by law.
• Disclosure is necessary to prevent or detect serious crime.
• An authorised statutory body has a lawful right to request the information.
• Information is needed to establish, exercise or defend legal rights.

Where appropriate and lawful, we will explain how and why information is being shared. However, there may be circumstances where informing someone could place an individual at risk, affect an investigation or be prohibited by law.

We will only share information that is relevant, necessary and proportionate to the concern or legal requirement.

Records of safeguarding concerns, referrals and their outcomes are kept for 25 years from the point the matter is closed, with access restricted to staff who need it. Where we share information with the police or another statutory body, we keep a record of the request and our decision for six years.

Devon and Cornwall Care Record

Improving Lives Plymouth participates in the Devon and Cornwall Care Record, a shared system that allows authorised health and care professionals to access relevant information to support an individual’s care and wellbeing.

Improving Lives Plymouth does not add or contribute information to the Devon and Cornwall Care Record.

Where it is relevant to the support we provide, and only with your consent, authorised Improving Lives Plymouth staff may view information held within the Devon and Cornwall Care Record. This may help staff provide safe, informed and coordinated support.

Access is:

• Restricted to authorised members of staff.
• Limited to staff who require access as part of their role.
• Made only with your consent.
• Monitored and recorded within the system.

You can choose not to give Improving Lives Plymouth permission to view your record.

For information about the Devon and Cornwall Care Record, including your choices about how your information is made available through it, please visit the Devon and Cornwall Care Record website.

CCTV Monitoring

Improving Lives Plymouth operates CCTV at Ernest English House to help maintain a safe and secure environment for staff, volunteers, service users, visitors and property.

CCTV may be used to:

• Promote the safety and security of people using or visiting the building.
• Assist with the investigation of incidents, accidents or safeguarding concerns.
• Assist with the prevention or investigation of criminal activity.
• Protect Improving Lives Plymouth’s premises and property.

Access to CCTV recordings is restricted to authorised personnel who have a legitimate reason to view them.

Recordings are normally retained for 30 days and are then securely deleted. Footage may be retained for longer where it is required for an investigation, safeguarding matter, insurance claim or legal process.

Individuals may request access to CCTV images relating to them. Any disclosure will be subject to the rights of other people shown in the footage and any applicable legal restrictions or exemptions.

Appropriate signs are displayed to inform people that CCTV is in operation.

Job Applicants

If you apply for a job with us, we use the information you provide, including your CV and any documents you upload through our website, to process your application and to meet our legal obligations as an employer.

If your application is unsuccessful, we keep your application information, including interview notes, for twelve months after the vacancy has closed, so that we can respond to any questions or challenges about the recruitment process, and then securely delete it. If we would like to keep your details on file for future opportunities beyond that, we will ask for your permission first. If you are appointed, your application becomes part of your personnel file, which is kept for six years after your employment ends.

How Long We Keep Information

We only keep personal information for as long as necessary to:

• Fulfil the purpose for which it was collected.
• Provide the relevant service or support.
• Meet legal and regulatory requirements.
• Comply with funding or contractual obligations.
• Respond to complaints, claims or safeguarding concerns.
• Maintain appropriate organisational records.
• Newsletter subscribers, for as long as you stay subscribed. When you unsubscribe, your email address is kept on a do-not-contact list so that we do not email you again by mistake; you can ask us to delete it instead.

The periods we keep information for are set out in our Record Retention Policy, available below. In summary:

• Records of the support we give you, including referrals, assessments and your participation in our services, groups and activities: six years after your involvement with the service ends.
• Records relating to a child or young person: until their 21st birthday.
• Contact and volunteering enquiries made through our website that are not taken further: 90 days.
• Volunteer files: two years after you stop volunteering.
• Job applications from unsuccessful candidates: twelve months after the vacancy closes.
• Complaints and the records of how we investigated them: 25 years from the point the complaint is closed. This period is required by our insurer and allows us to respond to historic matters.
• Safeguarding records: 25 years from closure, with restricted access.
• Records of accidents or incidents involving you on our premises or at our activities: three years, or longer where a child, a safeguarding concern, an insurance matter or a legal claim is involved.
• Donations, Gift Aid declarations and payment records, including event payments taken through PayPal or Stripe: seven years.
• Subject Access Requests and other information rights requests: three years from closure, or six where complex or disputed.
• CCTV recordings: normally 30 days, as explained in the CCTV Monitoring section.

Data Retention Policy
PDF

Some records have to be kept for longer than these periods, for example where the law, a contract, our insurer, a funder, a safeguarding concern, an audit, an investigation or a possible legal claim requires it. Where that happens, the reason is recorded and access is limited to the people who need it.

Once information is no longer required, it is securely deleted, destroyed or anonymised.

Protecting Your Information

We use appropriate organisational and technical measures to protect the confidentiality, integrity and availability of personal information.

These measures include:

• Limiting access to authorised staff and volunteers.
• Using passwords, access controls and other security measures.
• Storing paper and electronic records securely.
• Providing appropriate data protection guidance and training.
• Managing access when a person changes role or leaves the organisation.
• Securely deleting or destroying information when it is no longer required.
• Reviewing and responding to suspected personal data breaches.

Although we take reasonable steps to protect personal information, no system can remove every possible security risk.

International Transfers

Personal information is normally stored and processed within the United Kingdom. Some of the services that support our website, such as Google Analytics, PayPal, Stripe and SMTP2GO, which delivers email sent from our website, may process limited information outside the UK. Where this happens, we make sure safeguards recognised by UK data protection legislation are in place, such as UK adequacy regulations or approved international data transfer agreements.

Children and Young People

We primarily provide services to adults. However, we may sometimes engage with children and young people.

Where we collect personal information relating to someone under the age of 16, we will take account of their age, understanding and individual circumstances.

Where appropriate, we may seek consent from a parent or guardian. However, whether this is required will depend on the service, the young person’s understanding and the lawful basis for processing the information.

We will respect the views and privacy of children and young people while also meeting our safeguarding and legal responsibilities.

Information may be shared without consent where necessary to protect a child or another person from harm.

Records relating to a child or young person are kept until their 21st birthday, or longer where a safeguarding matter or legal requirement applies.

Donations

Where you make a donation, we may process your personal information to:

• Administer and acknowledge your donation.
• Maintain financial and accounting records.
• Meet tax, fraud prevention and other legal obligations.
• Claim Gift Aid where you have provided a valid declaration.
• Contact you about the donation.
• Keep you informed about our work where you have agreed to receive communications.

Where a third-party donation or payment service is used, that organisation may process your information under its own privacy notice.

Records of donations, including Gift Aid declarations, are kept for seven years to meet accounting and tax requirements.

Photographs, Videos and Personal Stories

We may ask for permission to use photographs, videos, case studies, testimonials or personal stories for reporting, publicity or promotional purposes.

We will explain:

• How the material will be used.
• Where it may be published or displayed.
• Whether your name or other identifying information will be included.
• How you can withdraw permission for future use.

We will not use identifiable photographs, videos or personal stories for publicity without appropriate permission.

Withdrawing permission will not normally affect material that has already been lawfully published or distributed, but we will stop further use where reasonably possible.

Cookies

Our website uses a small number of cookies. When you first visit, a banner lets you accept or reject them, and you can change your choice at any time using the Cookie Settings button. We do not use advertising cookies.

Full details of every cookie we use and why are in our Cookie Policy.

External Links

Our website may contain links to websites operated by other organisations.

This Privacy Policy applies to Improving Lives Plymouth and to the websites we operate, including the Trauma Informed Plymouth Network website, which has its own privacy policy covering how that site uses information. Other organisations are responsible for their own websites and privacy practices.

We recommend reading the privacy information on any external website before providing personal information.

Changes to This Policy

We may update this Privacy Policy to reflect changes to our services, legal responsibilities or use of personal information.

The latest version will be published on our website. The date of the most recent review will be shown in the Document Control section below.

Where a change could have a significant effect on how we use personal information, we will take reasonable steps to bring the change to the attention of affected individuals.

Complaints and the Data Protection Regulator

If you are concerned about how we have handled your personal information, please contact our Data Protection Lead first so that we can consider and respond to your concern.

You also have the right to raise a concern with the Information Commissioner’s Office:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113
Website: Visit the Information Commissioner’s Office website

Contacting Improving Lives Plymouth

For information or requests relating to this Privacy Policy, including Subject Access Requests and data protection enquiries, please contact:

Data Protection Lead
Improving Lives Plymouth
Ernest English House
Buckwell Street
Plymouth
PL1 2DA

Telephone: 01752 241052
Email: admin@improvinglivesplymouth.org.uk

Document Control

Version 2.7. Last reviewed: October 2026. Next review due: October 2027. Owner: Data Protection Lead.