Privacy Policy Privacy Policy Introduction This is the Privacy Policy of Cork Mental Health Foundation Company Limited by Guarantee, Charity Reg No. 20066260 and Cork Mental Health Housing Association Company Limited by Guarantee, Charity Reg No. 20010577, who both have their registered office as Unit 4, Nore House, Riverview Business Park, Bessboro, Road, Cork. Whilst both charities are separate legal entities they operate out of a shared space and pool resources and commercial activities in order to reduce operating costs (e.g. office space, staff, website, etc.). As such, both Cork Mental Health Foundation Company Limited by Guarantee and Cork Mental Health Housing Association Company Limited by Guarantee are considered “joint controllers” under the Data Protection Act 2018 because, collectively, they are in control of all data. Cork Mental Health Housing Association Foundation Company Limited by Guarantee has a shop called Aurora, that trades at St. Joseph’s Road, Mallow, Cork, and Aurora is governed by this Privacy Policy. For ease of reference, both Cork Mental Health Foundation Company Limited by Guarantee and Cork Mental Health Housing Association Company Limited will be referred to in this policy as “Cork Mental Health”. The purpose of this Privacy Policy is to ensure that individuals understand how we process their information. Cork Mental Health endeavours to comply with the General Data Protection Regulation, Data Protection Act 2018 and data protection best practices. This Policy informs individuals how Cork Mental Health processes personal data in accordance with the principles of data protection identified in data protection legislation. We will process any personal information provided to us by individuals, whether it be provided through our website (www.corkmentalhealth.com), in person, by any form, correspondence, telephone, email or by any other means, or otherwise held by us in relation to you in the manner set out in this policy. By submitting your information to us and or by using the Website you confirm your consent to the use of your personal information as set out by this Privacy Policy. If you do not agree with the terms of this Privacy Policy please do not use the Website or provide us with any personal information. Cork Mental Health provides a wide range of services to its service users, members and the general public at large. We employee a number of staff and also at times rely on volunteers; both employees and volunteers have an internal Data Protection Policy that governs how they process data. Information collected by us The information about you that we may collect, use and store (process) includes: Information necessary in order to facilitate, process, deliver or that relates to the billing of an agreed business transaction, fundraising or collection of monies or any transaction associated with Cork Mental Health (e.g. name, address, contact details, billing details, etc.) Information you provide to us by filling out any forms on the website or by way of emailing us or by any other form of written communication. Records of correspondences whether by email, telephone, through any form on our website or by any other means, Information you provide to us in person. Details of any business, commercial or membership transactions you carry out with us, whether through email, the website, telephone, or by any other means. Details of your visits to our website including traffic data, location data, weblogs and other communication data in accordance with our Cookie Policy that may identify personal information (e.g. cookies) and non-personal information (e.g. information of an anonymised or technical nature). How we use your personal information We may use your personal information for the purposes of: Processing any enquiry requested by you; Entering into and or completing any sales or membership related request requested by you; Setting up, operating and managing any account or line of credit, if applicable; Setting up, operating and managing any marketing and or fundraising services subject to your explicit consent (please see Marketing & Fundraising below); Complying with our legal duties and responsibilities; Debt collection and the collection of outstanding monies; Providing, monitoring, reviewing and supporting our online presence via our website and social media (please see our Cookie Policy) Monitoring any billing or credit transactions for the purpose of preventing fraud; Provision of security to, and ensuring the health and safety of, employees, volunteers and visitors to company premises. As Cork Mental Health provides information and some support services for persons affected by mental health issues we do not provide crisis support services. Sometimes we may refer you to a third party but do so without processing your personal data, i.e. we may provide you details of another charity and it is up to you to call them. In some cases we may ask for your permission to refer you to a third party for specific support services but these are on a case-by-case basis and we would only do this with your explicit consent in advance of any referral. We normally obtain consent in writing (via a consent form) and any data processed will be held as confidential, secure, will be used only for the purposes for which it was collected and will be destroyed or deleted once is it no longer necessary (in accordance with our data retention policy). Cork Mental Health does not engage in any automated decision-making processes nor do we use any personal data as a basis for any such automated decisions. Cork Mental Health does not transfer personal data outside the EU or outside the jurisdiction of the General Data Protection Regulation. However, Cork Mental Health may use some external services providers to provide business functions some of whom may be located outside the EU or EEA. In such cases, personal data is protected by use of binding corporate rules or EU-US privacy shield to ensure continued compliant with the General Data Protection Regulation and uphold the privacy rights of all data subject. Some of these service providers may be located within another EU member state, and any that are, are subject to the One Stop Shop Mechanism as identified by the Irish Data Protection Commission. For example, Cork Mental Health uses Zoho CRM software to provide CRM services but Zoho is based in the Netherlands (within the EU) but is bound by the Irish Data Protection Commission’s One Stop Shop Mechanism. For more information about binding corporate rules, EU-US Privacy Shield and the One Stop Shop Mechanism please visit the Data Protection Commission website at www.dataprotection.ie Marketing & Fundraising Cork Mental Health relies on the public for support and fundraising; without which we are unable to provide a wide range of support services. Our fundraising is governed by our fundraising and governance policies that are available on our About us page. In terms of data processing, subject to your explicit consent, we may also use your personal information for the purpose of: Marketing and Sales promotions; Providing you with information about promotional offers on our products and services; Carrying out any service user, membership or customer research, survey and analysis; Fundraising activities, including brand or event awareness, participation and collections of monies; At some interactions with Cork Mental Health you may be asked to consent to your data being used for marketing and or fundraising purposes. In such cases, consent will require a positive action on your part. For example, on an enquiry form you would have to tick a box stating that you consent to your data being processed for marketing and or fundraising purposes in order to receive dedicated funding or marketing emails. Cork Mental Health is committed to privacy by design and privacy by default. As such, you will never have to ‘opt-out’ of our marketing or fundraising processes; you will only ever have the option of ‘opting in’ if you’d like to be included. We do not engage in ‘pre-ticked’ boxes on consent forms nor do we ever assume you would consent to your data being processed. You are free to withdraw consent for any marketing and or fundraising related matters at any time you want. Social media Cork Mental Health engages in a number of social media services and we strive to uphold privacy rights online. However, sometimes members of the public may post something objectionable and beyond our control to Cork Mental Health’s social media pages/forums. In such cases, we will act to rectify any difficulties as soon as we are notified or become aware of the problem. We do not provide a continuous monitoring of social media sites/forums so there may be a slight delay from the initial post to when become aware of a problem. Cork Mental Health sometimes hold marketing or fundraising events in which service users, members of Cork Mental Health, employees, volunteers and the general public may be present. Such events are often held at public locations. Sometimes we may wish to take a photograph at such events to promote our brand or event on social media. In such cases, it is our policy for our photographer/social media handler to announce their presence and provide additional instructions and assistance. However, we do not have any control over private individuals or their social media accounts and we cannot stop members of the public from posting pictures of events online without the consent of all participants. For information relating to social media usages, cookies or widgets, please see our Cookie Policy. Information Storage We will take reasonable steps to ensure that your information is kept secure and protected, including but not limited to electronic data being protected using appropriate software, relevant networks safety and security checks, and, where applicable, any physical data records will be kept in an appropriately secure environment. We have a general data retention policy that relates to the retention of relevant data for seven years. Personal data that is no longer required will be destroyed and or deleted in secure manner. We do not record or process personal data that is not required or not necessary for any of our stated purposes. Disclosure of data We may outsource certain commercial functions to external third parties, e.g. debt collection, accounting auditors, etc. and in such cases where you personal data is required for the purposes of completing those functions then an appropriate data processing agreement, with relevant safeguards, will be in place to ensure our ongoing obligations under the Data Protection Act 2018 are upheld. We may also have to disclose certain personal data in accordance with any legal obligation imposed on us. Any such disclosure would be in accordance with the law, e.g. disclosed on foot of a court order, Child First Act, etc. Requesting your data Any person has the right to find out whether an organisation has any personal data about them, what they use the personal data for and ask for copies of personal information held by that organisation. If you wish to make a data access request in order to get a copy of any personal data we may process, please write a letter stating that you wish to make a data access request and address it to: Brendan McCarthy Development Manager Cork Mental Health Unit 4, Nore House, Riverview Business Park, Bessboro Road, County Cork. Or email [email protected]. In order to process your request we may request that you send us a copy of your identification (passport, drivers licence, etc.). The reason we ask for personal identification is to ensure that you are the correct person making the request for your personal data. Unfortunately, verbal access request requests cannot be entertained. In response to any data access request, you have the right to refer the matter to the Data Protection Commission if you are unhappy with the outcome, however, we ask that you would notify us first of any issue so that we may help resolve it as quickly as possible. Rectifying mistakes You have the right to rectify any incorrect or inaccurate personal data at no cost to you. If you believe that we are incorrectly processing any of your personal data, please inform us by writing to the above address or email [email protected]. Queries or complaints If you have any queries or complaints regarding our Privacy Policy or any data protection matter, please let us know by writing to the above person or email us a. Individuals have the right to refer any matter to the Data Protection Commission by contacting them at www.dataprotection.ie or by writing to: Data Protection Commission Office of the Data Protection Commission Canal House Station Road Portdarlington Co. Laois If you are, for whatever reason, considering contacting the Data Protection Commission about us we would ask that you inform us of your difficulty first so that we can try to resolve it to your satisfaction. Changes to our Privacy Policy Any changes we may make to our Privacy Policy in the future will be posted on the website. Any changes will become effective upon posting the revised Privacy Policy on the website. If we make any material or substantial changes to this Privacy Policy we will use reasonable endeavours to inform you by email, notice on the Website or any other agreed communications channels. Privacy Policy last reviewed: January 2019 Manage Cookie Preferences