Sage Therapy Centre April 2022
Here at the Sage Therapy Centre we regard the lawful and correct treatment of personal information as highly important to the success of our Centre. It is vital in maintaining confidence and trust between all of us; visitors to the centre, staff, practitioners and teachers. We will always ensure that we treat personal information lawfully and correctly/ We fully endorse and adhere to the principles of the General Data Protection Regulation (GDPR) and the data protection act 2018.
This policy applies to the collection and processing of personal information in manual and electronic records kept by us as part of ensuring our centre operates correctly. It also covers our response to any data breach and other rights under the GDPR/DPA. Those in our organisation who have access to personal information do so in order to accomplish our purpose. This is not given to 3rd party members of staff
Categories of Personal Information We Collect or Obtain Includes:
- Contact details (e.g., name, address, email, telephone number)
- Copies of qualifications, Insurances, Professional membership & regulatory body information, DBS information (if working with young people)
- Financial and transaction data Room hire history, billing information, invoicing and payment records
Data Protection Principles
Under GDPR/DPA2018, all personal information obtained and held by us must be processed according to a set of core principles. In accordance with these principles, we will ensure that:
- Processing will be fair, lawful and transparent
- Information collected for specific, explicit, and legitimate purpose
- Information collected will be adequate, relevant and limited to what is necessary for the purposes of processing
- Information will be kept accurate and up to date. Data which is found to be inaccurate will be rectified or erased without delay
- Information is not kept for longer than is necessary for its given purpose – please refer to the ‘Retention’ section below
- Information will be processed in a manner that ensures appropriate security of the information, including protection against unauthorised or unlawful processing, accidental loss, destruction or damage by using appropriate technical or organisation measures
Data will be retained while you are renting a room in the Centre, and for a period of 12 months after your last room rental or invoice payment, whichever is the latter.
You have the following rights in relation to the personal data we hold on you:
- The right to be informed about the information we hold on you and what we do with it
- The right of access to the data we hold on you. More information on this can be found in the section headed “Access to Data” below
- The right for any inaccuracies in the data we hold on you, however they come to light, to be corrected. This is also known as ‘rectification’
- The right to have data deleted in certain circumstances. This is also known as ‘erasure’
- The right to restrict the processing of the data
- The right to transfer the data we hold on you to another party. This is also known as ‘portability’
- The right to object to the inclusion of any information
If you would like to request access, correct, object to the use, restrict or delete Personal Information that you have previously provided to us, or if you would like to request to receive an electronic copy of your Personal Information for purposes of transmitting it to another company, (to the extent this right to data portability is provided to you by applicable law), you may contact us at email@example.com with the subject line “Data Subject Request.” We will respond to your request as soon as we can and in line with our responsibilities.
Rights of Access to Personal Information
In addition to their rights under this policy, all of Sage Therapy Centre employees and customers and anyone else in respect of whom personal data is processed have a right to ask Sage Therapy Centre, under the GDPR/DPA, for personal information held about them and this section details the information they are entitled to see under the GDPR/DPA.
The rights of our employees and customers under the GDPR/DPA are set out here for completeness
- within one month of a written request a data subject is entitled to:-
(a) be told whether personal data, of which he or she is the subject, is held in records, or otherwise processed by Sage Therapy Centre; and
(b) be given a description of the personal data, the purpose for which the data is being or may be processed and the persons or classes of persons to whom the data has been or may be disclosed; and
(c) have communicated to them in an intelligible form the information constituting the personal data held about them and any available detail as to the source of that information; and
(d) be told the envisaged period for which the data will be stored or, if not possible, how it will be decided when it will be destroyed; and
(e) be informed of their right to erasure of personal data; the right to object to processing; the right to rectification of data; to restriction on processing; and the right to object to processing; and
(f) be informed of their right to complain to the ICO.
(g) know of the existence of any automated decision-making, including profiling, and in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
Access to Personal Information Refused
Sage Therapy Centre reserves the right to refuse the employee or customer’s access to information if:
- It would identify another individual who has not consented to the disclosure Note: organisations are not covered by GDPR so information about them may be disclosed. However, to avoid any claims of breach of confidentiality, their consent should be sought and disclosure should only be made without their consent if it cannot reasonably be obtained and it is reasonable in all the circumstances to make disclosure
- It is legally privileged correspondence e.g. between Sage Therapy Centre and its solicitors
- The data is held for management forecasting or management planning if the disclosure is likely to prejudice that activity e.g. information about plans to promote, transfer or make a worker redundant
- Information containing details of Sage Therapy Centre intentions concerning negotiations with an employee may be withheld to the extent to which access would be likely to prejudice those negotiations
- The information consists of a reference given or to be given in confidence by the employer for:
- the education, training or employment of the worker
- the appointment of the worker to any office
- the provision by the worker of any service
- The information is held for:
- The prevention of the detection of crime; and/or
- The apprehension or prosecution of offenders; and/or
- The assessment or collection of any tax or duty or any other imposition of a similar nature where access would be likely to prejudice any of the above matters
- The information was provided in confidence by a third party
- In the opinion of Sage Therapy Centre or a health professional it would be likely to cause serious harm to the physical and/or mental health of a customer or another person;
The information requested relates to non-personal details such as property records or maintenance details. The association is only obliged to provide access to personal information about the resident and sometimes about their family
Uses and Processing
We acknowledge that processing may only be carried out where a lawful basis for that processing exists and we have assigned a lawful basis against each processing activity. Here are some examples:
We may use information you have provided us to send you emails about networking events, workshops and courses we think you may be interested in, open days, news from therapists and centre-wide announcements. To receive these you will have needed to opt in and at any time you can also opt out. We will also occasionally ask you to update these preferences to make sure you are getting only the information you want.
We will comply with your opt out request as soon as reasonably practicable. Please also note that if you do opt-out of receiving marketing-related emails from us, we may still send you messages for contractual reasons including administration purposes for example outstanding invoices that are due to be paid.
When someone visits our website, we use a third party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site. This information is only processed in a way which does not identify anyone. We do not make, and do not allow Google to make, any attempt to find out the identities of those visiting our website.
If you are a member of the Sage Therapy Centre team, we will also use your data for any of our employment responsibilities. We will never give or sell your data to anyone else.
In the event of security breach or hack to our system, we will inform everyone within 72 hours.
Changes to This Policy
This policy will be reviewed annually in February but if you see any omissions before that please do not hesitate to get in touch with our data protection officer