Privacy Policy
How HAV CIC protects your personal data and respects your privacy rights
Last Updated: December 2024
Introduction
HAV-HOPE AND ACTION VENTURES CIC (trading as HAV CIC – Hope & Action Ventures) is committed to protecting your privacy and ensuring you have a positive experience on our website and when using our services. This Privacy Policy explains how we collect, use, disclose and safeguard your information when you visit our website and interact with our programmes.
We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Please read this policy carefully to understand our practices regarding your personal data.
Our Data Protection Principles
Lawful & Fair
We only process personal data where we have a lawful basis and in a transparent manner.
Purpose-Limited
We collect data only for specified, explicit and legitimate purposes.
Secure
We implement appropriate security measures to protect your personal data.
Accountable
We maintain records of our data processing and respond to your data rights requests.
Information We Collect
We collect personal data in the following ways:
Information You Provide Directly
When you contact us via email, phone, or our contact form, we collect your name, email address, phone number, and any other information you choose to share. This helps us respond to your enquiries and provide support.
Programme Participation Data
If you participate in our programmes, we collect relevant personal data including name, contact details, demographic information, and data related to your engagement with our services. This enables us to deliver effective support and measure programme outcomes.
Website Usage Data
We may collect information about how you interact with our website, including pages visited, time spent, and referring website. This is collected through standard web analytics tools and helps us improve our online services.
Sensitive Personal Data
In some cases, we may process sensitive personal data (such as information about health, ethnicity, or immigration status) when necessary to deliver our support services. We only do this with your explicit consent and in accordance with UK GDPR requirements.
How We Use Your Information
We use your personal data for the following purposes:
- •To deliver our programmes and services in response to your participation or enquiry
- •To communicate with you about our services, updates, and important information
- •To evaluate the effectiveness and impact of our programmes through outcome tracking
- •To comply with legal obligations and safeguarding requirements
- •To improve our website and services based on user feedback and analytics
- •To prevent fraud and maintain the security of our systems
Legal Basis for Processing
Under UK GDPR, we process your personal data on the following legal bases:
Consent
When you explicitly agree to our processing of your data, such as subscribing to communications or participating in our programmes.
Contract Performance
When processing is necessary to fulfil our agreement with you to provide services or support.
Legal Obligation
When we are required by law to process your data, such as for safeguarding or regulatory compliance.
Legitimate Interests
When we have a legitimate organisational interest that is not overridden by your rights, such as improving our services.
Sharing Your Data
We do not sell or rent your personal data. However, we may share your information with:
- •Partner Organisations: Other community groups, statutory bodies, and service providers involved in delivering our programmes, only with your knowledge and consent.
- •Funders and Evaluators: Grant-giving bodies and independent evaluators may receive anonymised or aggregated data to assess programme impact.
- •Legal and Safeguarding: Relevant authorities when required by law or to protect the safety of individuals.
- •Service Providers: Third parties who provide services on our behalf (e.g., IT support, email hosting) under strict data protection agreements.
Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected. Our retention periods are:
| Data Type | Retention Period |
|---|---|
| Contact form enquiries | 2 years or until resolved |
| Programme participant data | 3 years post-programme completion |
| Website analytics data | 12 months |
| Safeguarding records | As required by law (minimum 6 years) |
Your Data Rights
Under UK GDPR, you have the following rights regarding your personal data:
Right of Access
You can request a copy of the personal data we hold about you.
Right to Rectification
You can ask us to correct inaccurate or incomplete personal data.
Right to Erasure
You can request deletion of your personal data in certain circumstances (the "right to be forgotten").
Right to Restrict Processing
You can ask us to limit how we use your personal data while we verify its accuracy or lawfulness.
Right to Data Portability
You can request your data in a structured, commonly used format and have it transferred to another organisation.
Right to Object
You can object to certain types of processing, including marketing communications.
How to Exercise Your Rights
To exercise any of your data rights, please contact us using the details below. We will respond to your request within 30 days (or up to 90 days for complex requests). We may ask for proof of identity to verify your request.
Contact Our Data Protection Team:
Email: [email protected]
Address: 11 Culmore Road, Hurst Green, Blackheath, Halesowen, B62 9HP, United Kingdom
Data Security
We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure or destruction. These include:
- •Secure data storage with restricted access controls
- •Encrypted transmission of sensitive data
- •Regular security audits and staff data protection training
- •Data protection agreements with all third-party processors
Children's Privacy
Our website is not intentionally directed to children under 13. If we become aware that a child under 13 has provided us with personal data without parental consent, we will delete such information promptly. For young people aged 13-18 participating in our programmes, we obtain appropriate parental or guardian consent before collecting sensitive data.
Cookies and Tracking
Our website uses essential cookies to provide core functionality. We do not use tracking cookies or third-party analytics that require consent. Any non-essential cookies will only be used with your explicit consent.
Third-Party Links
Our website may contain links to third-party websites. We are not responsible for the privacy practices of external sites. We encourage you to review their privacy policies before providing any personal information.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of significant changes by posting the updated policy on our website and updating the "Last Updated" date. Your continued use of our website and services constitutes acceptance of the updated policy.
Questions About This Policy?
If you have any questions, concerns, or complaints about our privacy practices, please contact us:
Email: [email protected]
Address: 11 Culmore Road, Hurst Green, Blackheath, Halesowen, B62 9HP, United Kingdom
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent authority for data protection. Visit www.ico.org.uk for more information.