Privacy policy

Age UK Sutton is a registered charity and a company limited by guarantee. We are also registered with the Information Commissioners Office. This Privacy Statement applies to Age UK Sutton.

Age UK Sutton collects, stores and uses (collectively referred to as “processes”) personal data relating to people who interact with us – this includes clients, volunteers, supporters and staff, as well as people who are referred to us by other people or organisations.  We may use your personal information to:

• Offer you advice and support
• Provide you with any services you request from us
• Process any job or volunteer applications you send to us
• Fulfil any contracts you enter into with us
• Manage and process any donations you make to us or legacies you leave us
• Contact you regarding our services and any events or activities we run
• Analyse any feedback or survey responses you give us
• Let you know about any changes to any of our services that you use
• Anonymously evaluate the performance of our services

We may collect personal information whenever you interact with us.  This can include:

• When you register to use or make an enquiry about any of our services
• When you submit an online enquiry through our website
• When you register to attend an event we are running or involved in
• When you give us feedback about our services or events
• When you make a complaint
• When you apply for a job with us
• When you register to be a volunteer
• When you donate to or fundraise for us

The kinds of information we process about you will vary depending on the support we are giving you and the purposes we are collecting it for.  This may include:

• Your name
• Your address and post code
• Your contact details (such as telephone number and email address)
• Details relating to next of kin or emergency contacts
• Your gender
• Your age
• Whether or not you are a carer
• Details of any interactions we have had with you, such as home visits or telephone conversations and any services or support we are offering you

Sometimes we may ask you for more sensitive information (also known as special category data).  We will only ask for this information when it is necessary for the support we are providing you with (for example, we may ask about any health conditions you have while supporting you with a benefits application, or when offering one of our social care services to you). 

We use services offered by third party organisations to help us manage some functions of our charity, such as Charitylog to store your personal details and Virgin Money Giving and Localgiving to process donations.  Before we use any third party organisation’s services, we put in place contracts that contain data protection clauses and/or ensure the organisation has appropriate data protection measures and policies in place in order to ensure your personal information is protected

If while we are supporting you we think you may benefit from the services or support another organisation provides, we may share some of your information with them.  This can include other charities, such as Sutton Carers Centre or Sutton Citizens Advice Service, or statutory bodies, such as Sutton Social Services.  We will tell you what information we plan to share and ask for your consent to share it before we share anything, unless we are required to share the information to comply with relevant legislation or to protect your vital interests.

Whenever we process information about you we are required to have a lawful basis to do so.  The lawful bases we rely upon are:

• Consent – in some cases we rely on consent to process information, for example when we provide a service to you, if you sign up to our newsletter or if we think you may benefit from us sharing your details with another organisation. Where we rely on consent, we will ask you to explicitly indicate that you consent to us storing your data on our secure systems. In most cases this may take the form of a signed consent form, but occasionally we will ask you to provide verbal consent which will be recorded on our data management system.
• Legitimate interests – we may rely on this basis in limited circumstances where appropriate, for example if you have told us you intend to leave us a legacy
• Legal obligation – we may rely on this basis when we are required to process information in order to comply with our legal obligations, for example to prevent fraud or fulfil our safeguarding responsibilities under the Care Act 2014
• Contract – we may process your personal information if you enter into a contract with us, such as when you take up our Help at Home service
• Vital interests – we may process and/or share your information under this basis if not doing so would put your life in significant danger

For details of the lawful bases that we rely on for each individual service, please contact us using the details at the top of this policy.

Whenever we rely on legitimate interests, we take extra care to ensure that we only process personal information that is necessary for the support we are offering you.  We always balance our legitimate interests against yours to ensure that we have a sound justification for processing your personal information and that the methods we use and information we ask for are as unintrusive as possible.

Whenever you provide us with personal information, you have various rights available to you relating to how we process it.  These rights are:

• The right to be informed - You have the right to know what information we collect and store about you, why we collect the information and what we do with it
• The right to access - You have the right request a copy of any information that we store about you and we are required to respond to your request within 30 days.
• The right to rectification - If you information we store about you is incorrect, you have the right to request that we correct it
• The right to erasure (aka “the right to be forgotten”) - You have the right to request that we remove all personal information that we store about you.  This can either result in information being anonymised, suppressed or erased, depending on the information that we hold
• The right to restrict processing - You have the right to restrict how we process your information if; (a) you are contesting the accuracy of the information, (b) you believe the data has been processed unlawfully and you would prefer that we restrict the processing of the information instead of erasing it, (c) you believe we no longer need the information but want us to retain it in order for you to establish, exercise or defend a legal claim or (d) you have objected to our processing of the information and we are currently investigating the objection
• The right to data portability - In some cases you have the right to request a portable copy of your information in a commonly used, machine readable format
• The right to object - You have the right to object to us processing your personal information 

If you would like to exercise any of the above rights or would like any further information about them, you can contact us using the details in the Our details section of this statement.

If you would like to know what information we currently hold about, you can submit a Subject Access Request to us.  Your information will usually be provided to you free of charge.  When you submit a request, we are required to respond to you within 30 days.  Please contact us using the details in the Our details section of this statement to make a request to us.  Please be aware that to protect the security of the information we hold, we may ask you to provide idenfication documents to confirm you have the right to access the information you are requesting.

We will only store your information for as long we are required to fulfil the purpose that it was collected for.  This length of time depends on various factors, including the support we are offering you and whether or not we need to keep the information to comply with any current legislation (for example, details of any payments we have received from you).  Any information we no longer need is either deleted or anonymised.  For details of how long we keep your information in different circumstances, please contact us using the details in the Our details section of this statement.

We will only contact you directly regarding fundraising and marketing if you have given us your consent to contact you in this way. We operate a separate list for marketing and fundraising purposes in order that we can keep you informed about our services and activities, but we will ask for specific consent to include your name on this list. If you would like us to stop sending you fundraising or marketing communications, please contact us via email at comms@ageuksutton.org.uk or by phone on 020 8078 0002.

If you are aged 16 or under‚ please get your parent / guardian's permission beforehand whenever you provide us with personal information.

Cookies are tiny software files that are stored on a computer or mobile device when an individual visits a website. Cookies allow websites to recognise that a user on an individual computer has previously visited the site. The cookies save some information about that user for when they access the site again in the future. You can find out what cookies the Age UK Sutton website use in the table below.

For more information about the different types of cookie, visit the About Cookies website and for information about the types of cookies used on our website, please visit our Cookies page.

If you use our services while you are outside the EEA, your information may be transferred outside the EEA in order to provide you with those services.

As part of the services offered to you through this website, the information which you provide to us may be transferred to countries outside the European Economic Area (“EEA”). By way of example, this may happen if any of our servers are from time to time located in a country outside of the EEA. You should be aware that these countries may not have similar data protection laws to the UK. By submitting your personal data, you’re agreeing to this transfer, storing or processing. If we transfer your information outside of the EEA in this way, we will take steps to ensure that appropriate security measures are taken with the aim of ensuring that your privacy rights continue to be protected as outlined in this policy.

We undertake regular reviews of who has access to information that we hold to ensure that your info is only accessible by appropriately trained staff, volunteers and workers.

We take our data protection responsibilities seriously.  If you have any concerns, you can contact our Privacy Officer to share them via:

• Telephone – 020 8078 0002
• Email – dataprotection@ageuksutton.org.uk

You also have the right to complain or raise a concern with the Information Commissioners Office (ICO), who oversees data protection in the UK.  You can contact them via:

• Telephone - 0303 123 1113 (Please note that calls to this phone number are charged at the same rate as 01 or 02 numbers.)
• Online – https://ico.org.uk/global/contact-us/

All of our data protection processes, including this statement, are reviewed annually, or when we need to make amendments to reflect new services or types of support that we offer.  This statement was last reviewed April 2024.