Privacy Policy - with anchors Welcome to Hestia! As you are using one of Hestia’s services, we are required to hold some information about you. We take the handling of personal data very seriously. We only ask for or collect your personal information to provide you with a service. This privacy notice explains what information we might hold and why we have it. Privacy Statement At Hestia, we value the support and engagement people have with our charity. From our service users and their families, Trustees, staff, students, volunteers, donors or campaigners - each person is a valued part of our organisation and the support we provide. Our commitment to your data We primarily collect data in relation to the contract or relationship we have with individual service users, particularly when it’s necessary to support their journey through our services. In the work that we do with our service users and in the engagement, we have with supporters and funders, Hestia gathers personal data. We collect data to enhance our service quality; to help us to tailor our services for training and resource allocation; to understand our supporters better; and also to help us to fundraise more efficiently. We want every interaction people to have with Hestia to be positive. In all areas of our work, we are committed to protecting your personal information, being open about what information we hold, ensuring that we only gather information as necessary and retaining it only for as long as we need to What personal information do we collect Hestia only collect information about you relevant to the services we may provide you. You can see full details of the information we collect within the following sections based on your relationship to Hestia. Please see, Service users, Candidates, Volunteers and donors. How we process your information How we process your information will depend on your relationship with Hestia. We will always process your information fairly and in accordance with UK data protection law. You can see full details of how we process your information within the following sections based on your relationship to Hestia. Please see, Service users, Candidates, Volunteers and donors. Our legal basis Hestia will only process your personal information where we have a clear legal basis for doing so in accordance with UK Data Protection law (UK GDPR). UK GDPR defines six legal bases that can be used to collect and process your data. We have obtained your consent We have a contract or agreement with you. We have a legal requirement to fulfil We have a vital interest, or are fulfilling the vital interest of an individual We have a legitimate interest for doing so We have a public interest. Where we have obtained your consent for processing your information, we will keep a record of this, and if you wish to withdraw your consent at any time under your UK GDPR rights, we will record this. Your data protection rights Under data protection law, you have rights including: Your right of access – You have the right to ask us for copies of your personal information. Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances. Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances. Your right to object to processing – You have the right to object to the processing of your personal data in certain circumstances. Your right to data portability – You have the right to ask that we transfer the personal information you have us to another organization, or to you, in certain circumstances. You are not required to pay any charge for reasonably exercising your rights. If you make a subject access request, we have one month to respond to you unless your request is complex in which case we may extend this up to 3 months. Please contact us at [email protected] if you wish to make a request. How to update your information Service User If you are a Service User (receiving care or some form of service from Hestia), you can update the information we hold about you by contacting your support worker or the manager of your service directly. Alternatively, you can drop us an email on [email protected] and we will direct it to the relevant team, who manage your information who manage your information. You can also find information on how to unsubscribe at the bottom of emails we send you and on the contact us page of our website. Candidate If you’re a candidate, you can update the information we hold about you by talking to HR or raising with your hiring manager. Donors and volunteers If you are one of Hestia’s donors or a volunteer, you can update the information we hold about you by contacting your relevant stakeholder within Hestia, or you can email us at [email protected]. You can also update you contact preferences at the bottom of emails we send you. Website Visitors and Cookies When you use our website, we collect data about the services and features you use and how you use them, including how you interact with its content and any advertisements. When you provide your personal details when filling out a registration, making a donation, communicating with us or signing up for or receiving a service on our website, we will collect this data and store it in your record to fulfil your request, answer your enquiries and keep a record of our correspondence with you. We may use this information to: Administer our websites and to troubleshoot, perform data analysis, research, and generate statistics and surveys related to our technical systems Monitor website use to identify non-personalised visitor location, guard against disruptive use, and monitor website traffic. Cookies Our website uses cookies. Cookies are files which are sent to the computer or device through which you access this website, and they collect small amounts of data. They are used to store information about your computer or device and your preferences, so that our website doesn’t have to keep asking you for them. For further information please see our cookie policy here. Tracking We use multiple first and third-party technologies such as pixel tags and web beacons to track and improve the user experience on our sites, quality of service and to monitor the effectiveness of campaigns and digital marketing activity. We may use them to: See what website content is popular and how people are using the site, as they allow us to track users’ movement through our websites. This type of information is aggregated so that we can build up a picture of how the site is performing. Make sure we offer you a consistent service. For example, if we are testing new website content or we want to run a survey, we use tracking to remember what content you have seen or if you have already been asked to join the survey. In addition, when we email you, we may place a tag (also known as ‘tracking pixel’) on the email we send out. These let us monitor performance of our emails marketing activity. Marketing Statement We provide direct marketing and fundraising communications to supporters which includes news, information, and data about: Hestia and our work supporting adults and children in crisis, and related events and campaigns Campaigns to support adults and children in crisis, and the issues that they encounter, in order to bring about positive change in their lives Online and paper petitions relating to campaigns Opportunities to volunteer Appeals and fundraising (including donations, competitions, raffles and similar promotional activities) Our events, activities, local groups and committees Leaving a legacy. Hestia relies on donations and support from others to continue its work on behalf of adults and children in crisis. Being able to contact you for marketing and campaigning purposes is an important part of our fundraising activity and purpose. Fundraising is an important part of our marketing, but we will not share your data with any other organisation, individual or company to allow them to use your personal information for marketing or campaigning purposes, unless we have obtained your specific, freely given, informed and unambiguous consent to do so. How to unsubscribe from Hestia email newsletters If you receive email communications from Hestia but no longer wish to, please click the unsubscribe link at the bottom of any of our emails to be removed from our list, or update your preferences via our website (www.hestia.org/my-details). We will not use your personal information for marketing purposes if you have indicated that you do not wish to be contacted by us for such purposes. However, we will retain your details on a suppression list to help ensure that we do not continue to contact you, unless you have told us that you wish for your data to be deleted. Children under 13 years We are committed to protecting the privacy of the young people that engage with us. Children have the same rights as adults over their personal data, defined within the “Your Data Protection Rights” section. When processing information relating to children, Hestia ensures that: We have a clear legal basis Where consent is provided, we ensure the child understands what they are consenting to and that we do not exploit any imbalance of power within the relationship Where we process information under contract, we consider the child’s competence to understand what they are agreeing to, and to enter into a contract Where we rely on legitimate interests, we take responsibility for identifying the risks and consequences of the processing, and put age appropriate safeguards in place. Hestia does not carry out any marketing activities aimed at children. How to contact us Name: Hestia Housing & Support Address: Hestia, 68 Alie Street, London, E1 8PX Email: [email protected] Hestia is a charity registered with the Charities Commission under charity number 294555, and a company limited by guarantee and registered in England and Wales under company number 2020165. How to complain If you have any concerns about our use of your personal information, you can make a complaint to the data protection team at [email protected]. Alternatively, you can find further information about giving us feedback or lodging a complaint at: www.hestia.org/Pages/Contact.aspx You can also complain to the ICO if you are unhappy with how we have used your data. The ICO’s address: Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF Helpline Number: 0303 123 1113 ICO website: https:///www.ico.org.uk Find the information most relevant to you The sections below contain information specific to different groups of people who interact with Hestia. Please select the section that best describes you: Service users Candidates Volunteers and donors Third parties that we share information with Service users What personal information we collect Please see the table below for the type of information we may keep about you. Type Why Lawful Bases Your personal details (name, age, gender, address, next of kin, contact details, emergency contacts, etc) To allow us to identify you and make appropriate decisions when it comes to providing you with a service. To provide you with the services, products, or information you asked for and to understand how we can improve our services. To respond to or fulfil any requests, complaints or queries you make to us. Legitimate interest or Required by contract or We have your consent Information you have shared with us You may share information with us to support your circumstances or so that Hestia can support you better when providing you with a service. Legitimate interest or Required by contract or We have your consent Information received from other agencies We will generally receive your information from other agencies when you are referred to Hestia Legitimate interest or Required by contract or We have your consent Records relating to the services Hestia may provide you To allow us to keep documented evidence and supporting material in relation to the service Hestia provides you. We will use this information to improve our services to you and to ensure we have an up-to-date record of the services you have received. Legitimate interest or Required by contract Housing Information We may use this information to assess your housing needs when Hestia provides you with housing services. Legitimate interest or Required by contract or We have your consent Health information We collect Health information only when we need to support or provide our services to you. Legitimate interest or Required by contract or We have your consent Photograph We may collect a photograph of you to help identify you or we may process a photo of you as part of confirming your identity. Legitimate interest or Required by contract or We have your consent Financial Information We may collect financial information when providing services to you to support your financial needs. Legitimate interest or Required by contract Employment Information We may collect this information to understand your circumstances when providing you with our services. Legitimate interest or Required by contract or We have your consent Special Category / Sensitive personal data The services that Hestia provide require us to regularly process sensitive personal information / special category information. Depending on your relationship with Hestia, we may process information such as health details, ethnicity, genetic data, sexual orientation, political beliefs and trade union membership. Legitimate interest or Required by contract or We have your consent or We have a vital interest CCTV Hestia offices have CCTV installed to protect and identify against any illegal activity. Legitimate interest How we process your information Processing Activity Bases Collecting your data The information Hestia collects on you will depend on your relationship with Hestia and the types of services we are providing you. We will collect your information in one of the following ways: You were referred to Hestia by another service We receive your information from a third party as part of a providing service under contract We collect your information directly from you We collect information about you from third parties. How we use your information Hestia uses the information you provide to us for one or more of the following purposes: to enable us and our third-party partners provide you with the services, products or information you have asked for; to keep a record of your relationship with us; to respond to or fulfil any requests, complaints or queries you make to us; to send you correspondence and communicate with you; to provide feedback to our partners and commissioners on the work, services and events which they have commissioned; to meet our legal and contractual obligations, to you, our commissioners, regulators and/or law enforcement bodies; to establish, defend or enforce legal claims; to understand how we can improve our services, products or information by conducting analysis and market research. How we store your data Your information is stored securely within the EEA in accordance with data protection law, either in our UK offices or within our IT systems that are supported and provided by our third-party IT provider. We will never transfer your information outside of the UK/EEA without a clear basis for doing so and not without strict controls and agreements in place that protect your information. We will always notify you if we are required to store or transfer your information outside of the UK. How we share your data We will only share your data with third parties where required and under one of the following legal bases: Required by law Required by contract We have your consent A list of third parties Hestia may share your information with can be found within the “Hestia third parties we may share your information with” section. How long we keep your data How long we keep your information will depend on your relationship with Hestia and the contracts under which Hestia processes your information. We will only keep information for as long as we need to, in accordance with legal requirements and regulations. Quick links Back to the top Candidates Volunteers and donors Third parties that we share information with Candidates What personal information we collect Please see the table below for the type of information we may keep about you. Type Why Lawful Bases Your personal details (name, age, gender, address, contact details, etc) When you contact us, we may keep certain information regarding your contact. We will do this to ensure we can respond to or follow up your query. When you apply to work at Hestia, we will process this information to ensure we are able to identify you. To respond to or fulfil any requests, complaints or queries you make to us. Legitimate interest or We have your consent Your employment details To understand your experience and suitability for the role. Legitimate interest or We have your consent Information you have shared with us You may share information with us as part of your application Legitimate interest or We have your consent Information received from other references We may obtain references from your previous employers to assist with our decisions or validate your experience. Legitimate interest or We have your consent Background Checks or Health Checks We may ask for specific information relating to your health or history where you are applying for a role that requires a background check. Legitimate interest or We have your consent Marketing / Communications information We may contact you about future roles or opportunities. Legitimate interest or We have your consent CCTV Hestia offices have CCTV installed to protect and identify against any illegal activity. Legitimate interest How we process your information Processing Activity Bases Collecting your data We will collect your information from you directly when you apply to Hestia. We may also collect information from references you have provided. How we store your data Your information is stored securely within the EEA in accordance with data protection law, either in our UK offices or within our IT systems that are supported and provided by our third-party IT provider. We will never transfer your information outside of the UK/EEA without a clear basis for doing so and not without strict controls and agreements in place that protect your information. We will always notify you if we are required to store or transfer your information outside of the UK. How we share your data As a candidate we may share your information with our suppliers and third parties who assist us in providing recruitment services. This can include our third-party IT provider where we may store your information on our IT. We may also share your information with suppliers that carry out background checks on behalf of Hestia. We will only share your data with third parties where required and under one of the following legal bases: Required by law Required by contract We have your consent. A list of third parties Hestia may share your information with can be found within the “Hestia third parties we may share your information with” section. How long we keep your data How long we will keep your information will depend on how long you remain a candidate at Hestia. We will only keep information for as long as we need to in accordance with legal requirements and regulations. Quick links? Back to the top Service users Volunteers and donors Third parties that we share information with Volunteers and donors What personal information we collect Please see the table below for the type of information we may keep about you. Type Why Lawful Bases Your personal details (name, age, gender, address, contact details, etc) When you contact us, we may keep certain information regarding your call. We will do this to ensure we can respond or follow up to your query. When you volunteer at Hestia, we will process this information to ensure we are able to identify you and contact you should we need to. We will also use this information to assist with our decision making in relation to the services you are volunteering for. When donating we will process this information to confirm your details and payment. We will also use this information to protect against fraud. To allow us to identify you and make appropriate decisions when it comes to providing you with a service. To provide you with the services, products, or information you asked for and to understand how we can improve our services. To respond to or fulfil any requests, complaints or queries you make to us. Legitimate interest or Required by contract or We have a legal requirement or We have your consent Payment information To support your donation or payment to Hestia Legitimate interest or We have a legal requirement Your employment details If you are a donor, we will process this to support your status as UK taxpayer if you add Gift Aid to your donation. If you are a volunteer, we may process this information as part of our background checks and contractual requirements. We have a legal requirement or Required by contract or We have your consent Social media We use information we collect and receive from social media to produce aggregate data relating to items such as video views, demographics, and location data. Sources of this data may include YouTube, Instagram, Facebook, Twitter (X) or LinkedIn. We do this so that we can learn about the type of people who are interested in Hestia, so that we can reach and market to new audiences. Legitimate interest Information you have shared with us You may share information with us during your interactions with Hestia. Legitimate interest or Required by contract or We have your consent Information received from other agencies If you are a donor, we may receive your information from other agencies that carry out marketing campaigns. If you are a volunteer, we may receive your information from volunteering agencies Legitimate interest or Required by contract Records relating to the services Hestia may provide you We will use this information to improve our services to you and to ensure we have an up-to-date record of the interactions you have had with Hestia. Legitimate interest or Required by contract Background Checks or Health Checks Where you volunteer, some services Hestia provide require us under contract to carry out background checks on all employees. Required by a contract or We have your consent Marketing / communications information We will collect information about you as part of our marketing campaigns. We will also collect information about your communications preferences. Legitimate interest or We have your consent Research We may use certain information to carry out research on our marketing campaigns and donor campaigns. Legitimate interest CCTV Hestia offices have CCTV installed to protect and identify against any illegal activity. Legitimate interest How we process your information Processing Activity Bases Collecting your data The information Hestia collects on you will depend on your relationship with Hestia and the types of services we are providing you. We collect information about you when you visit our website, donate to us, engage with our social media, or visit us. When you donate, we are required to record certain information. For instance, if you add Gift Aid to your donation, we must make a record of your status as a UK taxpayer and keep this for 7 years from the date of your donation as required by HMRC. We will also collect information about you when you volunteer at Hestia. How we store your data Your information is stored securely within the EEA in accordance with data protection law, either in our UK offices or within our IT systems that are supported and provided by our third-party IT provider. We will never transfer your information outside of the UK/EEA without a clear basis for doing so and not without strict controls and agreements in place that protect your information. We will always notify you if we are required to store or transfer your information outside of the UK. How we share your data We will only share your data with third parties where required and under one of the following legal bases: Required by law Required by contract We have your consent. As a donor, we may share your information with third parties and suppliers who manage our donorship campaigns and platforms. As a volunteer, we may share your information with our suppliers and third parties who assist us in providing services to our service users. A list of third parties Hestia may share your information with can be found within the “Hestia third parties we may share your information with” section. How long we keep your data How long we will keep your information will depend on your relationship with Hestia. We will only keep information for as long as we need to in accordance with legal requirements and regulations. Quick links Back to the top Service users Candidates Third parties that we share information with Third parties that we share information with Organization What we share Why Wanstor (third party IT provider) We may inadvertently share information about you with our third-party provider when your information is hosted on our IT systems. Information about you that you may request in a Subject Access Request (SAR). Wanstor support and manage our IT systems. Equipment that forms our IT systems and infrastructure will be owned by Wanstor and as such your information may be stored on Wanstor equipment on behalf of Hestia. Wanstor provides Hestia with security consultancy and data protection services. Wanstor consultants may have access to information you request in a SAR, to carry out our obligations under UK GDPR. The government and regulators Where we have a contract with the government, we will share information specifically required by the contract. This will often be anonymized data. To support the requirements of the contract. To provide statistics on the services we are providing. Local authorities Information relevant to the contract. Hestia have various contracts with local authorities that require us to share certain information with them. NHS Information about you that is relevant to the services we are providing you. Hestia may have a contract with the NHS where we are providing services on their behalf, we may share information regarding you as required by this contract. We may also share information about you with the NHS to help provide you with support as part of a referral where we have a legal basis or your consent for doing so. Hestia partners / other care or support providers Information about your needs or circumstances. Hestia work closely with its partners and other organisations that provide similar services to Hestia. We may share your information with them to help provide you with services and support your needs. We only do this where we have a legal basis or your consent for doing so. Legal supplier Information relevant to you exercising your data subject rights under UK GDPR. Information relating to your complaints. We may share your information with our legal suppliers where Hestia require legal support to make decisions about you. Charities Information about your needs or circumstances. To help refer you to suitable charities that can assist you where we have a legal basis or your consent for doing so. Other suppliers Information about you relevant to the services the supplier is providing for Hestia. We may need to share specific information about you with our suppliers who support us in providing a service to you. Payment providers We will share transaction data with our payment services providers for the purposes of processing your payments, refunding and dealing with complaints and queries relating to payments and refunds. You can find information about the payment services providers' privacy policies and practices at: Stripe https://stripe.com/gb/privacy GoCardless https://gocardless.com/legal/privacy/ Paypal https://www.paypal.com/ie/webapps/mpp/ua/privacy-full To complete your payment. To comply with legal requirements. Auditors Information about the services Hestia provide you. Where Hestia contracts require us to be audited, or where we are required by a regulator, we may share information specific to the audit. Emergency services / safeguarding teams Information specifically relating to the incident or that is relevant to address a risk to you or others. If we believe you or another person is at risk, we may share your information with another organisation or third party to help keep you or others safe. Quick links Back to the top Service users Candidates Volunteers and donors Manage Cookie Preferences