The event organiser, Why me?, has the legal responsibility to tell ticket buyers and event attendees how their personal information will be collected and used. You can find their Privacy Policy below or contact them to request it.
This privacy notice explains in detail the types of personal data we may collect about you when you interact with us. It also explains how we store and handle that data and keep it safe. We know that there’s a lot of information here, but we want you to be fully informed about your rights, and how Why me? uses your data. We hope the following sections will answer any questions you have, but if not, please get in touch with us.
Conditions for Processing Data
We are only entitled to hold and process your data where the law allows us to. The current law on data protection sets out a number of different reasons for which we may collect and process your personal data. These include:
Legitimate Interests
In specific situations, we require your data to pursue our legitimate interests in a way which might reasonably be expected as part of running our charity and which does not materially impact your rights, freedom or interests. This may include to satisfy our external quality auditors or our regulators.
Legal compliance
If the law requires us to, we may need to collect and process your data. For example, we can pass on details of people involved in fraud or other criminal activity.
Consent
In some situations, we can collect and process your data with your consent. For example, when you tick a box to receive email newsletters. When collecting your personal data, we’ll always make clear to you which data is necessary in connection with a particular service. As standard practice and in the course of our work we will record data about the meeting or communication we have had with you; you have the right to request a copy of this data.
When do we collect your data?
We normally collect your data when you provide it to us. You may give us your data by email, through an online web form, over the telephone, face to face, or by post.
What sort of data do we collect?
We may collect your name and contact details as well as a record of our contact with you and any donations you have given.
How do we use your data?
We process personal information for the following purposes:
We will never release your personal details to any organisation outside Why me? for mailing or marketing purposes.
We use a third party provider, Rocket Science Group, to deliver our monthly e-newsletter via the Mailchimp software. We gather statistics around email opening and clicks using industry standard technologies to help us monitor and improve our e-newsletter
How do we protect your data?
We take protecting your data very seriously and will treat your data with the utmost care and take all appropriate steps to protect it. We have clear data protection and information security policies and procedures in place (along with Regulatory and other legal obligations to keep your data safe) and these are regularly assessed as part of our Quality Standards and compliance processes.
We protect our IT systems from Cyber Attack.
Access to your personal data is password-protected, and sensitive data (such as personal information associated with a restorative justice case) is secured by SSL encryption.
We regularly monitor our system for possible vulnerabilities and attacks and we carry out penetration testing to identify ways to further strengthen security.
How long will we keep your data?
We only keep your data for as long as is necessary for the purpose(s) for which it was provided.
Who do we share your personal data with?
We sometimes share your personal data with trusted third parties. For example, third party agencies to support the restorative justice casework; secure file storage and destruction companies, auditors, the company that securely hosts our off-site cloud storage servers. We use secure encrypted systems, such as the MyRJ software system and the CJSM mail software to share this information.
Here’s the policy we apply to those organisations to keep your data safe and protect your privacy:
We provide only the information they need to perform their specific services. They may only use your data for the exact purposes we specify in our contract with them. We work closely with them to ensure that your privacy is respected and protected at all times. If we stop using their services, any of your data held by them will either be deleted or rendered anonymous.
Where is your data processed?
Your data is stored and processed within the EEA. If we ever have to share your personal data with third parties and suppliers outside the European Economic Area (EEA), we will seek your specific consent to do so. The EEA includes all EU Member countries as well as Iceland, Liechtenstein and Norway.
We may use systems like MailChimp to send you updates and newsletters. MailChimp is based in the US and therefore some limited information (your name and email address) may be transferred to Mailchimp (and therefore to the US) for the purposes of using that system. Mailchimp is signed up to the US EU Data Privacy Shield and we believe that there is no material risk associated with transferring this limited information outside of the EU.
Other websites
Our website may contain links to other websites which are outside our control and are not covered by this privacy policy. If you access other sites using the links provided, the operators of these sites may collect information from you which will be used by them in accordance with their privacy policy, which may differ from ours.
What are your rights?
You have the right to request:
Your right to withdraw consent
Whenever you have given us your consent to use your personal data, you have the right to change your mind at any time and withdraw that consent.
Where we rely on our legitimate interest
In cases where we are processing your personal data on the basis of our legitimate interest, you can ask us to stop for reasons connected to your individual situation. We must then do so, unless we believe we have a legitimate overriding reason to continue processing your personal data.
The Regulator
If you feel that your data has not been handled correctly, or you are unhappy with our response to any requests you have made to us regarding the use of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office. You can contact them by calling tel: 0303 123 1113, or go online to www.ico.org.uk/concerns
Changes to this policy
Our Privacy Policy may change from time to time. In this case, the amended version will be published on the Site.
Our privacy notice for those in contact with our legal service
Our privacy notice for those in contact with our legal service is set out below
Our privacy notice for those in contact with our restorative justice service
Contractual obligations
The main purpose for our holding your data is to provide you with restorative justice services under the agreement we have with you. This agreement is a contract between us and the law allows us to process your data for the purposes of performing a contract (or for the steps necessary to enter into a contract).
When do we collect your data?
We normally collect your data when you provide it to us or when it is provided to us by others (your victim liaison officer, for example) during your case.
What data do we collect?
We may gather details of your age, ethnicity, gender from you as part of the monitoring and evaluation of the service. We also collect and hold information about your case or personal situation, mostly provided by you to us or from third parties, obtained with your consent.
How do we use your data?
We only use your data for the purposes of providing you with restorative justice advice, assistance and facilitation and for reasons directly associated with that services (i.e. providing information to prisons to set up conferences; to third party support agencies who may be in a position to support you).
How do we protect your data?
We take protecting your data very seriously. The data you give us is often extremely sensitive and confidential.
With whom do we share your personal data?
We sometimes share your personal data with trusted third parties. We only do this where it is necessary for providing you restorative justice. For example, we may share your data with victim liaison officers, victim support, specialist victim services, restorative justice experts, translators, secure file storage and destruction companies, auditors, the company that securely hosts our off-site cloud storage servers.
How long will we keep your data?
We only keep your data for as long as is necessary for the purpose(s) for which it was provided. Normally this is for six years after your case or matter ends. This protects you should you be unhappy with our services and want to complain after your case ends.
For some cases we may decide that it is proper and appropriate to keep data for longer than six years, but we will notify you if we believe that your case falls into this category.
NB
Please note that everything in our general privacy notice applies to individuals accessing the restorative justice service, as well as the above.