Security and measures to protect personal data, including secure disposal

We maintain appropriate levels of security in relation to the collection, storage and disclosure of your personal data and confidential information. Information is stored securely by OCWA in electronic files and databases on servers at our offices, off-site locations and in the cloud. We also store information in paper files and records.

We have security measures in place to protect against the loss, misuse and alteration of personal data under our control.  These include: limiting access to personal information to authorised individuals; encrypting information; protecting systems, drives, folders and files by password; physical security measures; and regular backups of information to protect against ransomware and systems failure.

While we cannot guarantee that loss, misuse or alteration of data will not occur while it is under our control, we take appropriate measures to try to prevent this.

Any sensitive or special categories of data collected and used by OCWA are only shared on a need-to-know basis. In the course of providing our advice services, we may collect certain categories of sensitive data, including details of race; ethnic origin; politics; religion; trade union membership; genetics; biometrics (where used for ID purposes); health; sex life; and sexual orientation.  Such processing typically relates to our legitimate interests as an advice provider, employer and in some limited circumstances, enables us to comply with our duty of care to people who contribute to our work on a voluntary basis. In some situations, we will process such data with your consent, for example when providing it to third party organisations in connection with your advice and support needs.

Payment by credit or debit card

If you use your credit or debit card to donate to us we will ensure that this is done securely and in accordance with the Payment Card Industry Data Security Standard. Find out more information about PCI DSS standards by visiting their website at www.pcisecuritystandards.org

No members of OCWA staff will ever have access to your credit or debit card details.

Legacy income is a valuable way in which OCWA’s mission can be resourced.  We may keep personal data provided to us until after a legacy gift is received, or until we are notified that OCWA is not a beneficiary from the estate, to carry out legacy administration and communicate effectively with the families of people leaving us legacies. This also enables us to identify and analyse the source of legacy income we receive.

Where your information is no longer required we will ensure that it is disposed of in a secure manner. Any paper records will be securely shredded on-site and electronic details will be deleted.

How can I complain?

We want to improve the ways in which we work. Please tell us if something has gone wrong or not happened as it should.  We will try to put things right if we can.  We also want to take every opportunity to learn from your comments and feedback, both positive and negative.

Details of how to leave feedback or make a complaint can be found on the complaints and feedback page on our website.

You have the right to lodge a complaint with the Information Commissioner’s Office.  For more information, visit https://ico.org.uk/

What about personal data transferred to other countries?

OCWA makes use of cloud-based services where personal data is not transferred outside the EEA.

We use cloud-based client and case management services where data is stored in secure data centres within the UK or other EEA countries.

OCWA also makes use of cloud-based services where personal data may be transferred outside the European Economic Area (EEA).  For OCWA this involves transfers to the United States of America. More information can be found on the European Commission’s website. We only use data processors that are part of the Privacy Shield framework. These data processors provide us with the following services:

• Calendar and appointment management
• Electronic survey and online form processing services
• Event management services
• File backup and storage
• E-mail services
• Website management and hosting
• Online platforms for processing payments and donations