DATA PROTECTION & PRIVACY POLICIES
1. PURPOSE
1.1. The Data Use and Access Act 2025 updated the pre-existing UK legal requirement for The Charity to have a Data Protection Policy and a Privacy Policy. For ease of use this policy addresses both these requirements.
2. SCOPE
2.1. Data Protection and Privacy arise because of the common law duty of confidentiality. That common law duty applies to all of us. All team members are required to act in a way that is compliant with this policy.
2.2. This policy applies to all the personal data that The Charity processes regardless how that data is stored (paper, electronic or client management system).
2.3. To meet the requirement for public scrutiny, the privacy section of this policy is on The Charity website.
2.4. All other aspects of the requirement for confidentiality are addressed in the Charity’s Confidentiality Policy. This Data Protection and Privacy Policy should therefore be read and used in conjunction with the confidentiality policy
3. DEFINITION OF KEY TERMS
3.1. The Charity. The charity Hounds for Heroes as registered in England and Wales (1134359) and Scotland (SC043751).
3.2. Team Members. All those who have access to the personal data that The Charity processes and therefore includes all staff and those volunteers, such as trustees, who have access to personal data.
3.3. Partners. All individuals who have ever contacted The Charity with the objective of being partnered with one of The Charity’s dogs regardless of the status of their application or if they become partnered with one of The Charity’s dogs.
3.4. Data Subject. An “identified or identifiable natural person” from whom or about whom information is collected. A company or organisation cannot be a data subject.
4. PRINCIPLES
This Policy adheres to the seven key principles in the Data Protection Act 2018:
I. Lawfulness, fairness and transparency.
II. Purpose limitation.
III. Data minimisation.
IV. Accuracy.
V. Storage limitation.
VI. Integrity and confidentiality (security)
VII. Accountability.
5. DATA SUBJECT RIGHTS
All data subjects who provide their personal data to The Charity have:
5.1. The right to be informed about the collection and use of their personal data. This is achieved by The Charity’s Privacy Policy and the consent sought when requesting personal information
5.2. The right of access to the personal data shared with The Charity. This may be done by making either verbal or written request. The Charity is required to make reasonable and proportionate searches for a data subjects personal data when responding to requests. The DUAA has clarified the time limits for organisations to respond to requests by individuals to access and receive a copy of their personal data. There is now a “stop the clock” rule, allowing The Charity to pause the response time more information from the requester is needed to complete the request and restart the clock once it has been received.
5.3. The right to rectification of inaccurate personal information and to update incomplete personal information. Rectification can be achieved by adding to the record or creating a supplementary record. Even if The Charity decides that the information they have is correct, a statement from the data subject will be placed with the data that is believed to be incorrect stating the data subject’s dispute.
5.4. The right to erasure. The Charity must delete personal information if the data subject believes that:
• we no longer need to process their information for the purposes for which it was provided;
• we have previously requested their permission to process their personal information and they wish to withdraw their consent; or
• we are not using their information in a lawful manner.
5.5. The right to restrict processing of their personal information if they believe that:
• any of their information that is held is inaccurate;
• The Charity no longer needs to process their information for the purposes for which it was provided, but they require the information to establish, exercise or defend legal claims;
• The Charity is not using their information in a lawful manner.
5.6. The right to data portability. Where we have requested a data subject’s permission to process their personal information, data subjects have the right to receive their personal information in a portable format. They may also request to provide it directly to a third party, if technically feasible. We are not responsible for any such third party’s use of their information, which will be governed by their agreement with the data subject and any privacy statement they provide. This right only applies to data that is being processed electronically.
5.7. The right to object. A data subject is required to advise of the circumstances justifying their objection to processing. We can still process personal information where there are compelling grounds, or it is necessary for legal claims.
5.8. Rights in relation to automated decision making (ADM) and profiling. Data subjects have rights in relation to automated decision making, including profiling, where the result will have legal or other significant effects on them. The DUAA, recognising the change in the use of ADM systems since the data Protection Act came into force, has created a more permissive framework under the UK GDPR for organisations to make decisions based solely on automated processing that have legal or similarly significant effects on individuals. Organisations can make such decisions in wider circumstances but must implement certain safeguards for individuals. These include:
• providing people with information about significant decisions made about them
• enabling them to make representations about and to challenge such decisions
• and enabling them to obtain human intervention in respect of such decisions
6. THE ROLE OF DATA PROTECTION OFFICER
6.1. Our Charity falls below the threshold deemed to require a permanently designated and named Data Protection Officer – we do not process large volumes of personally identifiable information and/or sensitive information. We must nevertheless respect Data Protection Officer functions that are a necessary part of good data protection:
6.1.1. An identified point of contact between The Charity and the relevant supervisory authorities.
6.1.2. Training and support in adhering to policy.
6.1.3. Audits and assessments to check UK GDPR compliance.
6.1.4. Sustaining records of all Charity-wide data processing activities.
6.1.5. Make available to public scrutiny and when seeking consent the arrangements for requesting, storing, securing and using and processing personal data.
6.1.6. Responding to requests to share copies of personal data or erasing data as and when necessary.
6.2. This Policy vests these responsibilities within the roles of the CEO who may then delegate the various functions within The Charity’s organisation provided that there are processes (or measures) in place to ensure the highest standards of data protection and mitigate known risks.
7. RISKS AND MITIGATION TO PERSONAL DATA
7.1. The Charity recognises the following risks to the protection of personal data and provides risk mitigation against each as follows:
7.1.1. Data Loss – the loss of data such as by the accidental deletion of a digital file or the accidental shredding of a paper file. Should the lost data still be required by The Charity then The Charity will be required to ask that a data subject resupplies the lost information with the risk of reputational damage that this may incur. The Charity shall provide the necessary training to minimise the likelihood of such event and provide the necessary IT tools to protect against permanent deletion of digital files.
7.1.2. Deliberate Data Access by a 3rd party – the access, whether for malicious or benign purposes, by a 3rd party, for instance, by hacking into the Charity’s IT systems. The Charity shall provide the necessary training and put in place necessary measures within The Charity’s IT systems that not only protect against such an event but which also give timely warning that such an event is being attempted. These measures are addressed within The Charity’s IT Policy.
7.1.3. Accidental Data Access by a 3rd Party – such as may occur if a computer monitor or a paper file displaying personal data is seen by a 3rd party such as a visitor to The Charity’s HQ. The IT Policy addresses lock-screen times and The Charity shall provide the necessary training that minimises the likelihood of such an event for both working at HQ and working from home.
PRIVACY POLICY
INTRODUCTION
Personal privacy is protected in law. This means:
• You are in control of how we communicate with you
• We use a privacy form to date and record consent (Appendix 1)
• You can opt in or out or change your preferences at any time.
• We will keep your information secure
• We will not sell your data to a third party.
• We will not swap your data with a third party.
• We train our people to ensure that they know how to manage your information in line with the data protection laws and regulations.
• We only pass information to partners who comply with UK GDPR and Data Protection laws in order that we can undertake specialist processing work securely (e.g. direct debit bureaux to process financial donations, mailing houses to print and post out hard copy communications).
• Credit or debit card transactions with us are secure and encrypted and comply with the Payment Card Industry Data Security Standard.
Hounds for Heroes only ask for consent to hold and process personal data as outlined in Articles 4 & 6 of the UK General Data Protection Regulations (GDPR) and the Data Protection Act 2018. This means we ask for, hold and process information to allow us to create successful people- dog partnerships, to fulfil our responsibilities to people who volunteer and work with us, in order to operate the charity and raise the money to deliver our crucial services.
If, after giving consent, you change your mind, you may withdraw your consent for us to contact you, for the continued collection, use or disclosure of your information, at any time, by speaking to any member of the Hounds team or by contacting us at enquiries@houndsforheroes.com or mailing us at:
Hounds for Heroes
Unit 2B Rookery Farm Buildings
Hampshire
GU32 1RU
PRIVACY POLICY: CARE AND SUPPORT
If you are applying to be a partner and/or become a partner, we will ask for personal and sensitive personal information to help us understand how a dog could support you to live your life. We only use this information for the purposes of partnering, training or monitoring the quality of your experience. This information is stored securely, in paper and electronic format.
PRIVACY POLICY: DONORS AND SUPPORTERS
We ask for personal information when you decide to donate, express an interest in supporting us or take part in our activities. We may add to the data you have given us, for example using the Post Office’s National Change of address database, where people are registered with that database to confirm address details.
Donors or supporters are not routinely asked for information categorised by data protection laws as sensitive personal data, such as your race, sexual orientation, political affiliation or religious beliefs. In looking after you we will ask if you have any additional support needs, for example access is you come to HQ or events and in the way you prefer people to communicate with you.
PRIVACY POLICY: PURCHASING
If you make a payment or purchase and choose a direct payment gateway to do this, the payment gateway will only temporarily store your credit card data. (unless you have given explicit permission to the gateway). Your data is encrypted through the Payment Card Industry Data Security Standard (PCI-DSS) and stored only as long as is necessary to complete your purchase transaction. After that is complete, your information is deleted. All direct payment gateways adhere to the PCI-DSS standard as managed by the PCI Security Standards Council, which is a joint effort of brands like Visa, Mastercard, American Express and Discover to help ensure the secure handling of credit card information by all parties involved in the transaction.
PRIVACY POLICY: KEEPING YOUR DATA SECURE
To protect your personal information, we take reasonable precautions and follow industry best practices to make sure it is not inappropriately lost, misused, accessed, disclosed, altered or destroyed. We use third party IT providers to use specialist software to keep and protect the security of all the data we request and use, including the risk of cyber-attacks like for example ransomware. Hard copy paper records are the exception. Where this is the only option, locked cabinets are used. Keys are restricted to people whose role requires them to use and process that information.
PRIVACY POLICY: DISCLOSING YOUR INFORMATION
We won’t share your information with any other organisations for marketing, market research or commercial purposes, and we don’t pass on your details to other websites. We may disclose your personal information if we are required by law to do so or if you violate our Terms of Service.
PRIVACY POLICY: DIGITAL AND SOCIAL MEDIA
The security of information transmitted over the internet can never be guaranteed. Using internetbased systems means individuals transmit their personal data at their own risk. The Charity has procedures and digital security features in place that we review and monitor to try and keep data secure as is possible once we receive it.
We are able to confirm the web browser you use and IP address and we record and track the use of our websites and other social media: for example the number of times our videos on YouTube are watched and the click and open rate on social media posts and content on our website. Our website uses cookies to help you in your interactions with the site. Most session cookies last only for the duration of your visit and are deleted when you close your browser. No personally identifiable data is collected.
Examples of the sort of information session cookies collect include:
• The last search term that you used within the site and search results
• Your preference in terms of accessible viewing options
• A unique ID to track the pages you look at and your session from page to page Some cookies are persistent, meaning that they last beyond your session, enabling an enhanced user-experience when you return to the site. Again, a non-exhaustive list of examples of the use of persistent cookies includes:
• The option to “Remember my username” when signing-in to the site
• The fact that you have voted in a poll, so that you are prevented from voting multiple times
MEASURING WEBSITE USAGE (Google Analytics)
We use Google Analytics software to collect information about usage of the Hounds for Heroes website. We do this to help make sure the site is meeting the needs of its users and to help us make improvements. Google Analytics does not store personal information, it stores information about:
• the pages you visit on the Hounds for Heroes website
• how long you spend on each page
• how you got to the site
• what you click on while you’re visiting the site
We don’t allow Google to use or share our analytics data.
Google Analytics sets the following cookies:
Name: _ga
Purpose: This helps us count how many people visit the Hounds for Heroes website by tracking if you’ve visited before Expires: 2 years
Name: _gat
Purpose: Used to manage the rate at which page view requests are made
Expires: 10 minutes
Name: _gat_UA-XXXXXXXXX
Purpose: Used by Google Tag Manager to link to GA account
Expires: When you close your browser
Name: _gid
Purpose: Used by Google Tag Manager to track if you’ve visited before Expires: When you close your browser
LINKS TO OTHER WEBSITES
Our website can contain links to and from other websites. This privacy policy only applies to this website, and doesn’t cover other services or sites that we link to. If you go to another website from this one, we advise you to read the privacy policy on that website to find out what it does with your information.
THIRD PARTIES
From time to time, we may embed external content from third-party websites (e.g. Facebook, YouTube) within our website. These websites may utilise cookies and the Privacy Policy that will apply to such third-party content will be that published on the website of that third-party content provider. In general, the third-party providers used by us will only collect, use and disclose your information to the extent necessary to allow them to perform the services they provide to us. Certain third-party service providers, such as payment gateways and other payment transaction processors, have their own privacy policies in respect to the information we are required to provide to them for your purchase-related transactions. For these providers, we recommend that you read their privacy policies so you can understand the manner in which your personal information will be handled by these providers.
CHANGES TO THIS PRIVACY POLICY
We reserve the right to modify this privacy policy at any time, so please review it frequently. Changes and clarifications will take effect immediately upon their posting on the website. If Hounds for Heroes is acquired or merged with another charity, your information may be transferred to this charity. We will notify you in the event of such a change. If we make material changes to this policy, notification of the change will be done via our website.