Introduction
This privacy policy explains how health equalities group (HEG) collects, uses, stores, and protects your personal data. HEG is committed to ensuring that your privacy is protected and to being transparent about how we manage your personal data. This policy outlines the types of data we collect, how we use it, and the measures we take to protect your information. It also explains your rights under the general data protection regulation (GDPR) and other relevant laws.
Who we are
We’re Health Equalities Group, a public health charity working to improve the wellbeing of communities across the UK.
We are a registered charity (charity number is 1110067), and our registered address is 151 Dale Street, Liverpool, L2 2JH.
This policy applies to all activities and entities under HEG, HoM Partnerships CIC, European Healthy Stadia Network CIC, and our associated programmes, projects, and campaigns, e.g., ‘Food Active,’ ‘GULP,’ and ‘Prevention Pledge.’
Our purpose
We’re an independent voice for preventative public health in the North-West and beyond. We believe everyone deserves to live a long, healthy, and happy life. But right now, not everyone gets that opportunity.
That’s why we work with local authorities, charities, the NHS, and central government to help improve the conditions that hold back so many of our communities. Together, we can create a fairer, healthier society.
What information do we collect?
HEG collects information and processes several types of personal data depending on your relationship with us, to support the aims of the organisation. This may include:
- Basic information: name, title, gender, date of birth
- Contact information: postal address, email addresses, phone number, links to social media accounts
- Financial information: payment details for services or donations
- Professional information: identification, employer, job title, salary details, career history, professional qualifications, CVs, and other data related to professional engagements
- Sensitive information: in certain cases, we may collect data on protected characteristics such as ethnicity or age, or other sensitive information with your explicit consent (these types of data enable us to monitor diversity across our portfolio of work)
- Website usage information: IP addresses, cookies, and interaction data collected via our website and social media platforms
- Training and events: personal photos and videos of events
You may also withdraw your consent for us to process your personal information at any time, though we may have already disposed of the information.
Processing children’s information
As part of our school-based programmes, HEG collects and processes personal data from children, including their first name and first letter of their last name (for example, ‘John Smith’, would be ‘John S’), class name, and school name. This data is collected to allow us to pair pre- and post-survey responses and assess the effectiveness of our programmes.
To ensure the privacy and anonymity of the children involved:
- Data pairing: We use the first name and first letter of last names, along with class and school information, solely for the purpose of accurately pairing pre- and post-survey data.
- Anonymisation: Once the data is paired, the first name and first letter of last names of the children are deleted from our records. The children are then assigned a unique number to maintain anonymity in any further analysis or reporting.
- Data security: We implement stringent security measures to protect the personal data of children throughout the collection, processing, and anonymisation stages. Only authorized personnel have access to this data, and all processing is conducted in accordance with GDPR requirements.
Parents or guardians are informed about the data collection process and the measures taken to protect their child’s privacy. They have the right to access their child’s data, request rectification, or object to the processing at any time.
If you have any concerns regarding the processing of your child’s data, please contact us at: info@hegroup.org.uk
How do we collect your data?
We collect personal data in several ways, including:
- Directly from you when you fill out forms on our website, participate in our programmes, or engage with us through email, telephone, or social media
- From third-party sources, including publicly available databases and social media platforms, in compliance with your privacy settings on those services
- Automatically through cookies and similar technologies when you visit our website (see our cookies section below for more details)
Cookies
Cookies are small text files stored on your device when you visit our website. We use cookies to:
- Enhance website functionality and improve user experience
- Analyse website traffic and user behaviour via tools like Google analytics and Facebook analytics
- Assist in marketing efforts by tailoring content to your preferences
You can manage your cookie preferences through your browser settings. Please note that disabling cookies may impact your experience on our website.
For more information about cookies, visit the All About Cookies website.
How will we use your information?
We use your personal data for the following purposes:
- To provide and manage the services and information you request
- To send you newsletters, updates, and marketing communications (with your consent)
- To otherwise communicate with you regarding our aims and objectives
- To respond to enquiries and complaints
- To process payments and manage financial transactions
- To fulfil contracts you have entered into with HEG
- To conduct research, evaluations, and surveys to improve our projects and services
- To build our understanding of how our programmes positively contribute to public health outcomes
- To comply with legal and regulatory obligations, including anti-money laundering checks
- To ensure the security and integrity of our systems and data
- To maintain our internal records to keep a record of your relationship with us
Lawful Bases for Processing
HEG processes personal data under several lawful bases, including your consent, the necessity for the performance of a contract, compliance with a legal obligation, protection of vital interests, and for the purposes of legitimate interests pursued by HEG or a third party, provided these interests do not override your fundamental rights and freedoms.
Marketing communications
HEG will only send you marketing communications if you have given your consent or if we have a legitimate interest based on your relationship with us. You can opt out of receiving these communications at any time by using the unsubscribe link in our emails or by contacting us directly at: info@hegroup.org.uk
Who do we share your information with?
We will only share your personal data with:
- Trusted third-party service providers who assist us in delivering our services (e.g., IT service providers, cloud storage providers, email marketing services, and payment processors).
- Regulatory bodies, assessors and auditors as required by legal obligation or internal governance
- HEG partners and associated organisations with your consent or as part of our legitimate interest
We will not sell or rent your data to third parties. Any third-party processing your data on our behalf will be subject to contractual obligations to ensure the protection and confidentiality of your information.
Where do we keep your data?
Your data will be stored within the United Kingdom (UK) or the European Economic Area (EEA). If data is transferred outside of the UK or EEA, we will ensure that appropriate safeguards, such as binding corporate rules (BCRs), standard contractual clauses (SCCs), or reliance on an adequacy decision by the UK government are in place to protect your data.
How long do we keep your data?
We retain personal data for as long as necessary to fulfil the purposes outlined in this policy or to comply with legal obligations. Specifically:
- Data related to services, grants, and contracts will be retained for at least seven years following the completion of the engagement
- Financial records will be kept for at least seven years in accordance with financial regulations
- Alumni, award holders, and community members’ data may be retained indefinitely to preserve the history and effectiveness of HEG’s actions and engagements
How do we protect your data?
We implement a range of technical and organisational measures to protect your data, including:
- Secure network infrastructure with firewalls and monitoring systems
- Encryption of sensitive data, including mobile and removable devices
- Regular security audits and access controls to ensure only authorised personnel can access your data
Data Breach Notification
In the unlikely event of a data breach that poses a risk to your rights and freedoms, HEG will notify the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of the breach. If the breach is likely to result in a high risk to your rights and freedoms, we will also inform you directly without undue delay.
Your rights
Under the General Data Protection Regulation (GDPR) and other relevant data protection laws, you have several rights concerning your personal data. These rights are designed to give you more control over how your data is used and to ensure that organisations like Health Equalities Group (HEG) manage your data responsibly. Below is a detailed explanation of your rights:
- Right to be informed: You have the right to be informed about the collection and use of your personal data. This Privacy Policy is part of our commitment to transparency, explaining how and why we process your data, the types of data we collect, and the circumstances under which we share it.
- Right of access: You can request access to the personal data we hold about you. This is often referred to as a ‘data subject access request.’ Upon your request, we will provide a copy of the data, along with information about how it is being processed, free of charge. If your request is excessive or unfounded, we may charge a reasonable fee or refuse to comply.
- Right to rectification: If the data we hold about you is inaccurate or incomplete, you have the right to request that we correct or update it. We will also notify any third parties with whom we have shared your data to ensure they make the necessary corrections.
- Right to erasure: Also known as the ‘Right to be Forgotten,’ this right allows you to request the deletion of your personal data in certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected, or if you withdraw your consent. Please note that this right is not absolute and may be subject to certain legal or regulatory obligations.
- Right to restrict processing: You have the right to request that we temporarily suspend the processing of your personal data. This right applies, for example, when you contest the accuracy of the data, object to the processing, or when the processing is unlawful, and you oppose erasure.
- Right to data portability: You can request that we provide your personal data in a structured, commonly used, and machine-readable format so that it can be transferred to another organisation. This right only applies to data you have provided to us and that is processed by automated means* based on your consent or in the performance of a contract.
- Right to object: You have the right to object to the processing of your personal data in certain circumstances, such as for direct marketing purposes. If you object, we will cease processing your data for that purpose unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms.
- Right to withdraw consent: If we are processing your personal data based on your consent, you have the right to withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal.
- Right to complain: If you believe that your data protection rights have been violated or if you are dissatisfied with how we have handled your data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s supervisory authority for data protection issues.
We are committed to upholding these rights. If you wish to exercise any of these rights, please contact us using the contact details provided in this Privacy Policy. We will respond to your request within 28 days, and in certain cases, this period may be extended by two further months if the request is complex or numerous. We will inform you of any such extension and the reasons for the delay.
* Currently, HEG does not engage in automated decision-making or profiling that produces legal effects concerning individuals or similarly significantly affects them. Should this change in the future, we will provide you with all relevant information, including the logic involved, as well as the significance and potential consequences of such processing.
How to contact us or raise a concern
If you have any questions about this privacy policy or wish to exercise any of your rights, please contact us at:
Address:
Health Equalities Group (HEG)
151 Dale Street, Liverpool, L2 2JH
Email:
info@hegroup.org.uk
Telephone:
0151 237 2686
If you are not satisfied with our response or believe we are processing your data unlawfully, you can also contact the information commissioner’s office (ICO) at www.ico.org.uk or by calling +44 (0) 303 123 1113.
Future changes
We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. Any significant changes will be communicated through our website or directly to you if appropriate.
Version 1.0 published [23/08/2024]
This privacy policy is kept under regular review.