THE CLUBHOUSE GIBRALTAR – PRIVACY NOTICE
Updated: 11.06.2020
ABOUT THE CLUBHOUSE
The Clubhouse Gibraltar is part of the Clubhouse International Network. We are a not for profit organization, providing support in the Community for those who have been affected by mental illness and mental health problems. We believe that that everyone can recover sufficiently from serious mental illness to lead satisfying lives.
WHAT IS PERSONAL DATA
Personal data is any information that relates to a living individual and makes it possible to identify that particular individual from the information alone or from a combination of that information and any other information which we may obtain.
This Privacy Notice explains how we, The Clubhouse Gibraltar (‘Clubhouse’), may collect and process your personal data.
TYPES OF PERSONAL DATA THAT WE COLLECT
We may collect, receive, use, store and transfer the following kinds of personal data about you:
Identity Data – this is information about you and your identity, for example your name, date of birth or gender.
Financial Data – this is information about your financial activities, including your bank account number.
Contact Data – this is information we use to contact you, such as you address, telephone number, email and communication preferences.
Marketing & Fundraising Data – this is information about your preferences when receiving marketing or fundraising communications from us.
Health Data – this is information about your physical and/or mental health.
Social Media Data – this is information you make public on social media, including your media handles.
HOW WE COLLECT YOUR PERSONAL DATA
We may collect your personal data in the following ways:
|
Information you give to us |
|
|
Information we receive from third parties or publicly available sources |
We may receive your personal data from third parties such as:
|
WHEN AND WHY WE PROCESS YOUR PERSONAL DATA
We will only collect and process your personal data where we are legally allowed to do so and namely (but not exclusively) in situations where you give us consent or where the processing of your personal data is necessary for:
- us to provide you with our services;
- us to satisfy our or a third party’s legitimate interest; and
- us to comply with a legal obligation.
We will only use your personal data to satisfy our or a third party’s legitimate interest if we asses that your rights do not override the legitimate interest in question.
We have to have a lawful basis for collecting, storing and processing your personal data. The below table shows the purpose for which we will process your personal data and our lawful basis for doing so.
|
Purpose |
Type of data |
Lawful basis for processing |
|
To process your application to become a Clubhouse Member |
Identity Contact Health Data |
To enable us to provide you with access to The Clubhouse and our support services. |
|
To provide you with our support services, including:
|
Identity Contact Health Data |
To enable us to support you when you ask us for that support. We will only do so when we have your express consent to do so. To enable to provide you with continuous access to The Clubhouse and our support services. To enable us to engage in our Outreach Initiative, which is a core Clubhouse service. Please see details on this initiative below. |
|
To employ you, provide you with work experience or accept you as a Clubhouse volunteer |
Identity Financial Contact |
To enable us to fulfil our obligations under an employment contract with you. We also have a legitimate interest to accept services from those on work experience or volunteers. |
|
To provide you with information about our services |
Identity Contact Fundraising & Marketing Social Media |
We will only ever send you true marketing communications if you have provided us with explicit consent for us to do so. We may send you fundraising communications if you have donated to the Clubhouse in the past or have expressed an interested in our activities. We will always stop sending you such communications if you ask us to. |
|
To network with you |
Identity Contact Social Media Fundraising & Marketing |
We have a legitimate interest in furthering the work of The Clubhouse through networking. We will only ever send you true marketing communications if you have provided us with explicit consent for us to do so. |
|
To accept and process your donations |
Identity Fundraising & Marketing Financial |
We have a legitimate interest in processing donations to enable us to continue supplying a valuable service to our community. |
|
To answer questions about our services |
Contact Social Media |
We have a legitimate interest in furthering the work of The Clubhouse by communicating with our community and answering questions about our services. |
|
To comply with an official and lawful request by a public authority |
All personal data that we hold on you |
We may need to share your data to comply with a legal obligation in cases where we are lawfully requested to provide information to a public authority. |
|
To engage you or your business as a contractor or other service provider |
Identity Contact Compliance Financial |
To enable us to perform our obligations under any service agreements we have with you or your business, such as payment of fees. We may be required under a specific legal obligation to retain, process and record your personal data for legal, accounting, reporting or regulatory purposes. We will always provide you with details of the regulatory obligations specifically related to the processing of your personal data, upon request. We have a legitimate interest to ascertain and monitor the reputability and good standing of our service providers. |
Change of purpose
We will only ever process your personal data for a purpose which is either listed in the table above or compatible with those already listed. Should we have a legal basis to process your personal data for any other reason, we will always inform you directly of the processing and explain why we are allowed to do so.
SPECIAL CATEGORY PERSONAL DATA
In order to fulfil our mission and adequately support our Members with their mental health we must process special category personal data related to health. We are allowed to do so due to our position as a not-for profit organisation and charity. We will only ever process any health data in accordance with this Privacy Notice and for the purposes specified in the table above.
OUTREACH INITIATIVE
A core part of our services is supporting our Members in taking an active role within The Clubhouse. Selected staff, Members and volunteers may participate in our Outreach Initiative during which those individuals are asked to call or text existing Clubhouse Members to check-in. This activity is central to the mission of the Clubhouse. In order to be a Clubhouse Member you must therefore be happy with you contact data to be used in this way. We provide training on handling personal data to those individuals who may receive access to your contact data as part of the Outreach Initiative.
KEEPING YOUR PERSONAL DATA CURRENT
To keep the personal data we hold about you accurate and current, please keep us informed of any changes to the personal data you have provided during your relationship with us.
WHO MAY RECEIVE YOUR PERSONAL DATA
In order to provide you with our services and to allow us to effectively run and manage the Clubhouse, we may share your personal data with:
- Third party service providers (ours): such as providers that assist us in our marketing and website hosting and development.
- Third party service providers (yours): such as providers that we may, with your consent, introduce you to.
- Agents, advisors and business partners: such as providers that assist us with legal and financial aspects of our business and other companies or individuals that we may partner up with to enable us to provide you with our services and to improve our service offering.
- Public agencies: such as law enforcement agencies, government entities, regulators, courts and other third parties who may request your personal data under a legal requirement or court order. We will always take your interests into account when responding to such requests.
- Volunteers: individuals who assist us in running The Clubhouse services
- Clubhouse Members: only in relation to the Outreach Initiative.
We do not allow our third-party service providers, agents, advisors, business partners or contractors to use your personal data for their own purposes and only permit them to process your personal data in accordance with our instructions.
TRANSFERS OUTSIDE OF THE EEA
Should we need to transfer your personal data outside of the European Economic Area (EEA), we will comply with at least one of the following requirements:
- When dealing with international third parties (including any other organisation within the Clubhouse International network), we will ensure that your personal data is covered by contractual clauses, approved by the European Commission, which will extend EU data protection standards to your personal data.
- When dealing with third parties from the US (including any other organisation within the Clubhouse International network), we will ensure that they are part of the Privacy Shield, which providers comparable protection to personal data shared between Europe and the US.
- We will ensure that the country to which your personal data is being transferred has been evaluated by the European Commission and is regarded as a jurisdiction offering adequate protection to personal data.
PERSONAL DATA SECURITY
We limit access to your personal data to only those individuals who need such data to provide The Clubhouse service. All of those who have access to the personal data we hold are obliged to use it only in accordance with our instructions and are subject to a duty of confidentiality.
In the unlikely event that we experience a data breach, we have procedures in place to uncover, contain and mitigate the situation and notify the relevant authorities or data subjects, as legally required.
HOW LONG WE KEEP YOU PERSONAL DATA
We will only retain your personal data for as long as it is necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, reporting or regulatory requirements. In the event of a complaint or a reasonable prospect of litigation, we may retain your personal data beyond our usual retention periods.
We may retain anonymised and/or aggregate data indefinitely as long as it is no longer considered personal data.
YOUR RIGHTS IN RELATION TO YOUR PERSONAL DATA
You have the right to:
- Request access to your personal data. We will provide you with a copy of the personal data we hold about you.
- Request correction of any personal data that we hold about you. We will correct any incomplete or inaccurate data we hold about you.
- Request erasure of your personal data. We will delete or remove personal data provided that (i) we do not have a lawful basis to retain the data; or (ii) you have successfully objected to our processing of your data; or (iii) we have processed your information unlawfully; or (iv) we are required to erase your personal data to comply with an applicable local law.
- Object to processing of your personal data. We will stop processing your data if we have been unfairly relying on a legitimate interest (our or of a third party) for processing causing an undue impact on your fundamental rights and freedoms.
- Request restriction of processing of your personal data. We will suspend the processing of your personal data if (i) you ask us to check the data’s accuracy; or (ii) our use of the data is unlawful but you do not want us to erase it; or (iii) you need us to retain the data past our retention period in order to establish, exercise or defend a legal claim; or (iv) you have objected to our processing and your objection is being investigated.
- Request the transfer of your personal data. We will provide to you, or a third party you have chosen, with your personal data in a structured, commonly used, machine-readable format. This right only applies to automated data which we process under your consent or where we such personal data is used to perform our contract with you or your business/employer.
- Withdraw consent. We will stop processing any personal data which we are using under your consent. Remember that any processing done before consent is withdrawn remains lawful.
If you wish to exercise any of these rights please contact us on [e-mail].
Fees and confirming your identity
You will not have to pay a fee to exercise any of your rights in relation to your personal data, but we may charge a reasonable fee or refuse to comply with your request if it is clearly unfounded, repetitive or excessive.
We will ask you for information and documents to confirm your identity prior to you exercising your rights in relation to your personal data.
THIRD-PARTIES
This Privacy Notice relates to the activities of The Clubhouse only. If we refer you to or help you engage with a third-party, that third party will have their own policy which we encourage you to read.
CONTACT US
If you have any questions or queries regarding how we collect or process your personal data please get in touch with our Data Protection Office at [e-mail].
COMPLAINTS
If you become concerned about our management of your personal data, please contact our Data Protection Officer at [e-mail].
You also have the right to make a complaint at any time to the Gibraltar Regulatory Authority, although we would appreciate an opportunity to resolve your concerns in the first instance.
CHANGES TO OUR PRIVACY NOTICE
We may make changes to this Privacy Notice from time to time, to mirror changes to our activities, practices and procedures or where necessary due to a change in regulation. A current version of our Privacy Notice will always be available on our website and any material changes may also be notified to you by email.