Privacy Policy

THE CLUBHOUSE GIBRALTAR – PRIVACY NOTICE
Updated: 11.06.2020

ABOUT THE CLUBHOUSE

The Clubhouse Gibraltar is part of the Clubhouse International Network. We are a not for profit organization, providing support in the Community for those who have been affected by mental illness and mental health problems. We believe that that everyone can recover sufficiently from serious mental illness to lead satisfying lives.

WHAT IS PERSONAL DATA

Personal data is any information that relates to a living individual and makes it possible to identify that particular individual from the information alone or from a combination of that information and any other information which we may obtain.

This Privacy Notice explains how we, The Clubhouse Gibraltar (‘Clubhouse’), may collect and process your personal data.

TYPES OF PERSONAL DATA THAT WE COLLECT

We may collect, receive, use, store and transfer the following kinds of personal data about you:

Identity Data – this is information about you and your identity, for example your name, date of birth or gender.

Financial Data – this is information about your financial activities, including your bank account number.

Contact Data – this is information we use to contact you, such as you address, telephone number, email and communication preferences.

Marketing & Fundraising Data – this is information about your preferences when receiving marketing or fundraising communications from us.

Health Data – this is information about your physical and/or mental health.

Social Media Data – this is information you make public on social media, including your media handles.

HOW WE COLLECT YOUR PERSONAL DATA
We may collect your personal data in the following ways:

Information you give to us

  • during our communications – including in face to face meetings, phone calls, video calls, emails, social media, letters or other correspondence;
  • when you complete any of our forms;
  • when you visit The Clubhouse; or
  • when you give us feedback on our services.

Information we receive from third parties or publicly available sources

We may receive your personal data from third parties such as:

  • companies that introduce you to us;
  • a partner organisation of ours;
  • a public authority or law enforcement agency;
  • a health professional;
  • your friends or relatives;
  • your employer, service provider or agent; or
  • media outlets (including social media outlets).

WHEN AND WHY WE PROCESS YOUR PERSONAL DATA

We will only collect and process your personal data where we are legally allowed to do so and namely (but not exclusively) in situations where you give us consent or where the processing of your personal data is necessary for:

  • us to provide you with our services;
  • us to satisfy our or a third party’s legitimate interest; and
  • us to comply with a legal obligation.

We will only use your personal data to satisfy our or a third party’s legitimate interest if we asses that your rights do not override the legitimate interest in question.

We have to have a lawful basis for collecting, storing and processing your personal data. The below table shows the purpose for which we will process your personal data and our lawful basis for doing so.

Purpose

Type of data

Lawful basis for processing

To process your application to become a Clubhouse Member

Identity

Contact

Health Data

To enable us to provide you with access to The Clubhouse and our support services. 

To provide you with our support services, including:

  • our Outreach Initiative;
  • assisting you in finding employment or work experience; or
  • assisting you when communicating with third parties.

Identity

Contact

Health Data

To enable us to support you when you ask us for that support. We will only do so when we have your express consent to do so.

To enable to provide you with continuous access to The Clubhouse and our support services.

To enable us to engage in our Outreach Initiative, which is a core Clubhouse service. Please see details on this initiative below.

To employ you, provide you with work experience or accept you as a Clubhouse volunteer

Identity

Financial Contact

To enable us to fulfil our obligations under an employment contract with you.

We also have a legitimate interest to accept services from those on work experience or volunteers.

To provide you with information about our services

Identity

Contact

Fundraising & Marketing

Social Media

We will only ever send you true marketing communications if you have provided us with explicit consent for us to do so.

We may send you fundraising communications if you have donated to the Clubhouse in the past or have expressed an interested in our activities. We will always stop sending you such communications if you ask us to.

To network with you

Identity

Contact

Social Media

Fundraising & Marketing

We have a legitimate interest in furthering the work of The Clubhouse through networking.

We will only ever send you true marketing communications if you have provided us with explicit consent for us to do so.

To accept and process your donations

Identity

Fundraising & Marketing

Financial

We have a legitimate interest in processing donations to enable us to continue supplying a valuable service to our community.

To answer questions about our services

Contact

Social Media

We have a legitimate interest in furthering the work of The Clubhouse  by communicating with our community and answering questions about our services.

To comply with an official and lawful request by a public authority 

All personal data that we hold on you

We may need to share your data to comply with a legal obligation in cases where we are lawfully requested to provide information to a public authority.

To engage you or your business as a contractor or other service provider

Identity

Contact

Compliance

Financial

To enable us to perform our obligations under any service agreements we have with you or your business, such as payment of fees. 

We may be required under a specific legal obligation to retain, process and record your personal data for legal, accounting, reporting or regulatory purposes. We will always provide you with details of the regulatory obligations specifically related to the processing of your personal data, upon request. 

We have a legitimate interest to ascertain and monitor the reputability and good standing of our service providers. 

Change of purpose

We will only ever process your personal data for a purpose which is either listed in the table above or compatible with those already listed. Should we have a legal basis to process your personal data for any other reason, we will always inform you directly of the processing and  explain why we are allowed to do so.

SPECIAL CATEGORY PERSONAL DATA

In order to fulfil our mission and adequately support our Members with their mental health we must process special category personal data related to health. We are allowed to do so due to our position as a not-for profit organisation and charity. We will only ever process any health data in accordance with this Privacy Notice and for the purposes specified in the table above.

OUTREACH INITIATIVE

A core part of our services is supporting our Members in taking an active role within The Clubhouse. Selected staff, Members and volunteers may participate in our Outreach Initiative during which those individuals are asked to call or text existing Clubhouse Members to check-in. This activity is central to the mission of the Clubhouse. In order to be a Clubhouse Member you must therefore be happy with you contact data to be used in this way. We provide training on handling personal data to those individuals who may receive access to your contact data as part of the Outreach Initiative.   

KEEPING YOUR PERSONAL DATA CURRENT

To keep the personal data we hold about you accurate and current, please keep us informed of any changes to the personal data you have provided during your relationship with us.

WHO MAY RECEIVE YOUR PERSONAL DATA

In order to provide you with our services and to allow us to effectively run and manage the Clubhouse, we may share your personal data with:

  • Third party service providers (ours): such as providers that assist us in our marketing and website hosting and development.
  • Third party service providers (yours): such as providers that we may, with your consent, introduce you to.
  • Agents, advisors and business partners: such as providers that assist us with legal and financial aspects of our business and other companies or individuals that we may partner up with to enable us to provide you with our services and to improve our service offering.
  • Public agencies: such as law enforcement agencies, government entities, regulators, courts and other third parties who may request your personal data under a legal requirement or court order. We will always take your interests into account when responding to such requests.
  • Volunteers: individuals who assist us in running The Clubhouse services
  • Clubhouse Members: only in relation to the Outreach Initiative.

We do not allow our third-party service providers, agents, advisors, business partners or contractors to use your personal data for their own purposes and only permit them to process your personal data in accordance with our instructions.

TRANSFERS OUTSIDE OF THE EEA

Should we need to transfer your personal data outside of the European Economic Area (EEA), we will comply with at least one of the following requirements:

  • When dealing with international third parties (including any other organisation within the Clubhouse International network), we will ensure that your personal data is covered by contractual clauses, approved by the European Commission, which will extend EU data protection standards to your personal data.
  • When dealing with third parties from the US (including any other organisation within the Clubhouse International network), we will ensure that they are part of the Privacy Shield, which providers comparable protection to personal data shared between Europe and the US.
  • We will ensure that the country to which your personal data is being transferred has been evaluated by the European Commission and is regarded as a jurisdiction offering adequate protection to personal data.

PERSONAL DATA SECURITY

We limit access to your personal data to only those individuals who need such data to provide The Clubhouse service. All of those who have access to the personal data we hold are obliged to use it only in accordance with our instructions and are subject to a duty of confidentiality.

In the unlikely event that we experience a data breach, we have procedures in place to uncover, contain and mitigate the situation and notify the relevant authorities or data subjects, as legally required. 

HOW LONG WE KEEP YOU PERSONAL DATA

We will only retain your personal data for as long as it is necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, reporting or regulatory requirements. In the event of a complaint or a reasonable prospect of litigation, we may retain your personal data beyond our usual retention periods.

We may retain anonymised and/or aggregate data indefinitely as long as it is no longer considered personal data.

YOUR RIGHTS IN RELATION TO YOUR PERSONAL DATA

You have the right to:

  • Request access to your personal data. We will provide you with a copy of the personal data we hold about you.
  • Request correction of any personal data that we hold about you. We will correct any incomplete or inaccurate data we hold about you.
  • Request erasure of your personal data. We will delete or remove personal data provided that (i) we do not have a lawful basis to retain the data; or (ii) you have successfully objected to our processing of your data; or (iii) we have processed your information unlawfully; or (iv) we are required to erase your personal data to comply with an applicable local law.
  • Object to processing of your personal data. We will stop processing your data if we have been unfairly relying on a legitimate interest (our or of a third party) for processing causing an undue impact on your fundamental rights and freedoms.
  • Request restriction of processing of your personal data. We will suspend the processing of your personal data if (i) you ask us to check the data’s accuracy; or (ii) our use of the data is unlawful but you do not want us to erase it; or (iii) you need us to retain the data past our retention period in order to establish, exercise or defend a legal claim; or (iv) you have objected to our processing and your objection is being investigated.
  • Request the transfer of your personal data. We will provide to you, or a third party you have chosen, with your personal data in a structured, commonly used, machine-readable format. This right only applies to automated data which we process under your consent or where we such personal data is used to perform our contract with you or your business/employer.
  • Withdraw consent. We will stop processing any personal data which we are using under your consent. Remember that any processing done before consent is withdrawn remains lawful.

If you wish to exercise any of these rights please contact us on [e-mail].

Fees and confirming your identity

You will not have to pay a fee to exercise any of your rights in relation to your personal data, but we may charge a reasonable fee or refuse to comply with your request if it is clearly unfounded, repetitive or excessive.

We will ask you for information and documents to confirm your identity prior to you exercising your rights in relation to your personal data.

THIRD-PARTIES

This Privacy Notice relates to the activities of The Clubhouse only. If we refer you to or help you engage with a third-party, that third party will have their own policy which we encourage you to read.

CONTACT US

If you have any questions or queries regarding how we collect or process your personal data please get in touch with our Data Protection Office at [e-mail].

COMPLAINTS

If you become concerned about our management of your personal data, please contact our Data Protection Officer at [e-mail].

You also have the right to make a complaint at any time to the Gibraltar Regulatory Authority, although we would appreciate an opportunity to resolve your concerns in the first instance.

CHANGES TO OUR PRIVACY NOTICE

We may make changes to this Privacy Notice from time to time, to mirror changes to our activities, practices and procedures or where necessary due to a change in regulation. A current version of our Privacy Notice will always be available on our website and any material changes may also be notified to you by email.