Who we are and how to get in touch

We are Off The Record (OTR) and we are here to provide emotional wellbeing and mental health support services for young people in South East Hampshire. 

If you have any questions about how OTR uses your own personal information, or if you want to ask us a question, then please get in touch. If you age 13 or older then you can write to our data protection officer, Kate, by emailing enquiries@otr-south.org.uk. 

If you are under 13, it would better if you discussed this with your parent/carer and they can contact us or your behalf. Alternatively, you can email us yourself but please make sure they are copied them into any emails you send.

We’ve created this young person friendly version of our Privacy Notice to ensure everyone can understand how we use and store personal information. You can also take a look at our full Client Privacy Notice if you would like to.

What we mean by personal information

Any information that could identify you (also referred to as ‘personal data’. This includes: 

Name	Address	Telephone Number
Email Address	Photo or Video	Online ID or Username

As OTR might be providing you with services and support, there are things our staff and volunteers need to know about you. Sometimes, this could be quite sensitive and personal information about what has happened to you, what you are going through, and how you are coping.

There are some types of information we have to be extra careful with. These are known as special category information. This could be information about your:

Health	Support needs	Sex life sexual orientation
Religious or spiritual beliefs	Racial or ethnic origin	Political opinions

Sometimes we also have to use information about crimes and breaking the law to provide our services to you.

Why we collect your personal information

The main reason we need your personal information is so that we know: 

• Who you are
• How we can contact you 
• Why you have come to us for help and support and how you are getting on 
• What services you are interested in and meet the criteria to take part in 
• What help you might need from us to take part in our programmes and activities to get the most out of them

So that we are able to communicate with you and provide you with our service, we need your personal information. If you do not provide us with the required personal information, we won’t be able to communicate with you or provide our services to you. 

We can also use your information to tell you about other services we can offer you as well. Without your personal information, you might miss out on some or all of the things you could take part in or not get the right support from us. Your personal information also helps us to keep you safe and look after your wellbeing. 

Where we get your personal information from and what we do with it

Most of the personal information we get will come from your and/or your parent/carer. 

Sometimes another organisation that knows you might refer you to us, this means they send us some of your personal information so we can invite you to our programmes and activities. Or another organisation that knows you, like your school or college, might share information with us about you to help us better support you, but they must ask your permission to do this first. We don’t buy lists of names from other organisations such as marketing companies.

Here are some examples of when you might give us your information:

• You sign up to take part in one a Managing Emotions Course or to attend Young Carers sessions (groupwork activities).
• You request 1-2-1 counselling support from us. 
• You get in touch with us to help us raise money for us.

Age affects who can agree to us storing and using personal information where we need your specific consent to do this:

• If you are 13 or over, then you can give your own permission (or, ‘consent’)
• If you are under 13 we will have to ask your parent/carer to give their consent

We are really careful with your personal information and we store it safely. Everyone is trained to know how to keep you safe and that includes keeping your information safe. We don’t share your information unless you tell us we can (unless we are really worried about your safety or someone else’s safety).

If you’ve got any questions about where we get your personal information from and what we do with it, a member of staff or volunteer from OTR can discuss all of this with you. We want you to be comfortable with what personal information we collect and why as well as how we keep if safe.

How long we keep your personal information for

We have given a lot of thought into how long we keep your information for. We believe we only keep it for as long as you would consider reasonable, or where we have to because of the law. We have a list of how long we keep all information and what we do with it (delete or archive) afterwards. We use our IT and storage systems to ensure information is kept safely and securely and is disposed of carefully when it is no longer needed. You can ask us for a copy of this list if you would like to see it – it’s called our Data Retention Schedule.

Your rights

You have all the same ‘rights’ with regard to your personal information as adults do. There are 8 rights and you can see them here: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/

Who can see your personal information

We take information privacy and security very seriously. Our internal systems are robust to ensure information is kept safe. Access is restricted according to the type of information we hold so only people that need to see it have access.

Where we use services such as cloud storage or software services to keep your information, we make sure that they are safe and that they are following the legal requirements as well.

When you are an OTR client, only the people who need to see your information can access it. For example, very sensitive information such as your counselling notes won’t be available to everyone, just the person or people providing that service to you.

We share your information with law enforcement agencies such as the police, or statutory agencies, such as the local authority, when required to do so by law. We might also share your information with other organisations that help us run Off The Record such as our accountant, or external agencies such as HMRC, Companies House, and the Charity Commission when we are legally required to do. Sometimes we share personal data with funders and commissioners.

Here’s a reminder of what our Confidentiality Statement says: “Off The Record is a private and confidential source of help. This means we would only break confidentiality (share personal information about you with anyone outside Off The Record) if we had reason to believe that you or someone else is at serious risk of harm. We will discuss this with you first unless we believe that to do so could increase the level of risk.”

What to do if you’re not happy about how we’ve used your personal information

If you have a concern about how we have handled or processed your information, please get in touch with us and let us know that you are unhappy so we can try and put things right. 

If you are unsatisfied with our response, you can contact the Information Commissions Office (ICO) to make a complaint.

Reviewing this document

This privacy notice was last updated by adults in August 2022, in line with the current laws on Data Protection and GDPR. We aim to review it regularly and involve young people in reviewing it too.

1. Who we are 

We are Off The Record – South.  

• Company registered in England and Wales with company number 3333729 
• Charity registered in England and Wales with charity number 1064275 
• Registered address is at 138 Purbrook Way, Leigh Park, Havant, Hampshire, PO9 3SU 

To contact us: 

• 023 9247 4724 
• enquiries@otr-south.org.uk 
• 138 Purbrook Way, Leigh Park, Havant, Hampshire, PO9 3SU. 

We take the privacy, including the security, of personal information we hold about you seriously. This privacy notice informs you about how we collect your personal information through our website and other electronic communications channels and how we use it. Please read this privacy notice carefully. 

We have appointed our Chief Executive as our Data Protection Officer (DPO). You can contact them using the details set out above. 

We may issue you with other privacy notices from time to time, this privacy notice is intended to supplement these and does not override them. 

We may update this privacy notice from time to time. This version was updated in August 2022. 

 

2. Key definitions 

Data Controller: the organisation or person responsible for deciding how personal information is collected and stored and how it is used. 

Data Processor: an individual or organisation appointed by the Data Controller to carry out certain tasks in relation to the personal information. 

Electronic Communications: including website use and contact us forms, email, social media messages, text, chat, and other messaging services. 

Personal Information/Data: any information from which a living individual can be identified. It does not apply to information that has been anonymised. 

Special/Sensitive Information – includes information relating to health, racial and ethnic origin, political opinions, religious and similar beliefs, trade union membership, sex life and sexual orientation and also includes genetic information and biometric information. Requires extra protection under data protection law.  

Criminal Offence Information: personal data of offenders or suspected offenders in the context of criminal activity, allegations, investigations, and proceedings. 

In this privacy notice, we will refer to ourselves as ‘we’, ‘us’ or ‘our’. We are the Data Controller of the personal information we collect, hold and use about you, as explained in this notice. 

 

3. Personal information that we collect and hold about you 

When you become and OTR client and you attend our counselling service or take part in activities or programmes such as Managing Emotions, or Young Carers, we collect and store certain information about you. 

The general categories of personal information we might collect about you are: 

General Category	Types of Personal Data in that category
Identity information	Your identity such as your name (including any previous names and any titles that you use), gender, marital status and date of birth
Contact information	Your contact details such as email address, addresses, telephone numbers
Survey information	Your opinions, preferences, and experiences that we may collect from you or that you have provided to us in respect of surveys and feedback
Marketing information	Your marketing and communications preferences that lets us know how we can contact you and what you want to hear about
Special/sensitive information	Relating to your health, wellbeing, support needs and the issues you are asking us to support you with. This may include information about things like your politics, health, sex life and sexual orientation
Demographic information	Your race, ethnic origin, religion and other information we ask for to help ensure our service is accessible to everyone in our community
Media	Photos, videos, audio recordings, testimonials and case studies that may be used internally or externally
Criminal convictions, offences, and related activity	Your history and life experience information that helps us provide a service that meets your individual needs

 

 

4. How and why we use personal information 

We can only use your personal information for certain legal reasons set out in data protection law. There are legal reasons under data protection law other than those listed below; but, in most cases, we will use your personal information for the following legal reasons: 

1. Contract Reason: in order to perform our obligations to you under a contract or agreement we have entered into with you; 
2. Legitimate Interests Reason: the use of your personal information is necessary for our (or a third party’s) legitimate interests, so long as that legitimate interest does not override your fundamental rights, freedoms or interests; 
3. Legal Obligation Reason: we have to use your personal information in order to perform a legal obligation by which we are bound; and 
4. Consent Reason: you have given us your consent to use your personal information for a specific reason or reasons. 
5. Vital Interests: the processing is necessary to protect someone’s life. 

So that we are able to communicate with you and provide you with our service, we need your personal information. If you do not provide us with the required personal information, we won’t be able to communicate with you or providing our services to you. 

It is important you keep your personal information up to date. If your personal information changes, please contact us as soon as possible to let us know. If you do not do this, then we may be prevented from continuing to communicate with you or providing our services to you. 

Where we rely on consent for a specific purpose as the legal reason for processing your personal information, you have the right under data protection law to withdraw your consent at any time. If you wish to withdraw your consent, please contact us using the details above. If we receive a request from you withdrawing your consent to a specific purpose, we will stop processing your personal information for that purpose, unless we have another legal reason for processing your personal information – in which case, we will confirm that reason to you. 

 Please also note the following: 

1. if we use the Legitimate Interests Reason as the legal reason for which we can use your personal information, we also explain what that legitimate interest is; and 
2. for some of the purposes, we may have listed more than one legal reason, because the legal reason may be different in different circumstances. If you need confirmation of the specific legal reason that we are relying on to use your personal data for that purpose, please contact us. 

Purpose	Legal Reason(s) for using your personal information
To communicate with you about the service(s) you have signed up for	Contract Reason
To enrol you as a client and ensure you meet enrolment criteria	Contract Reason
To provide you with the service(s) you enrol for in a safe, effective manner	Contract Reason
To recommend and send communications to you about additional OTR news, services, activities, and events. More details about marketing are set out below	Consent Reason
To ensure the smooth running and compliant operation of our organisation in providing our service to you and improving the services we provide	Legal Obligation  Contract Reason
To enable us to illustrate our reports and promotion of our work through publicity and other communications with real life quotes, examples, and images	Consent Reason

 

Where we process special category data and criminal information data we must tell you about both the lawful basis for doing this and the special category condition. 

Purpose	Legal Reason(s) for using your personal information	Special Category Condition	Schedule 1 Condition
To fully understand and support you with the issues you are seeking help with from OTR	Contract Reason  Legal Obligation	(d) Not-for-profit bodies     (g) Reasons of substantial public interest (with a basis in law)	8. Equality of opportunity or treatment    17. Counselling    18. Safeguarding of children and individuals at risk
To fulfil our Safeguarding obligations	Contract Reason  Legal Obligation	(d) Not-for-profit bodies     (g) Reasons of substantial public interest (with a basis in law)	18. Safeguarding of children and individuals at risk

 

Sometimes we may anonymise personal information so you can no longer be identified from it and use this for our own purposes. In addition, sometimes we may use some of your personal information alongside other people’s information to give us statistical information for our own purposes. Because this is grouped together with other personal information and you are not identifiable from that combined data, we are able to use this. 

Under data protection laws, we can only use your personal information for the purposes we have told you about, unless we consider that the new purpose is compatible with the purpose(s) we told you about. If we want to use your personal information for a different purpose that we do not think is compatible with the purpose(s) we told you about, then we will contact you to explain this and what legal reason is in place to allow us to do this. 

 

5. How we collect personal information 

We usually collect information directly from you when you fill out a form, survey, or questionnaire, contact us by email, by telephone, or by other electronic means, or while you are taking part in one of our services, programmes, or activities. 

We may receive some of your personal information from third parties, this includes: 

1. Identity and Contact Information from other agencies / organisations referring you to us; 

 

6. Who personal information may be shared with 

We will share your personal information internally as needed to ensure we can respond to you. Sometimes this may also involve sharing information with third parties however this will always be on a strictly need to know basis. 

These can include: 

1. Our contractors, subcontractors, associates, trainers, and others that are directly involved in the delivery of our services 
2. Third parties who are not part of our organisation such as: 
3. Suppliers: for example, IT support services, administration providers, funders, commissioners, fundraising agencies. 
4. Government bodies and regulatory bodies: for example, HMRC, fraud prevention agencies; 
5. Our advisors: for example, lawyers, accountants, auditors, insurance companies; 
6. Our bankers; 
7. Email and communications providers: for example, provided by companies such as Microsoft. 
8. Any organisations that propose to merge with or take over OTR and its assets. 

We do not sell or trade any of the personal information that you have provided to us. 

Depending on the circumstances, the organisations or people we share your personal information with will be acting as either Data Processors or Data Controllers. Where we share your personal information, we will have in place a contract or agreement that set out the responsibilities and obligations of each party, including in respect of security of personal information. 

NOTE: If we have a Safeguarding concern about a child, young person, or adult at risk of harm, we will fulfil our legal obligation to share information with the appropriate Safeguarding authority. 

 

 

7. Transfers to countries outside of the EEA 

If a transfer of personal information by us means your personal information is transferred outside of the UK and the European Economic Area (EEA), we will put safeguards are in place to ensure that a similar degree of protection is given to your personal information as is given to it within the UK and the EEA and that the transfer is made in compliance with data protection laws. 

We may need to transfer personal information outside of the UK and the EEA to the third parties listed above if they, or their data servers, are located outside of the UK and the EEA. 

 

8. How long we hold your personal information 

We will only hold your personal data for as long as is necessary. This time will depend on the purposes for which we collected the personal information, which services, programmes or activities you participate in, and how long you remain an OTR client. 

In some cases, we are legally obliged to keep personal information (such as in relation to accounting or auditing records or for tax reasons). We may also need to keep personal information in case of any legal claim or proceedings.  

You can ask to see our Data Retention Schedule for more specific information on how long we keep different types of information for. 

 

9. Automated decision making 

We do not carry out any automated decision making. 

 

10. Your rights under data protection law 

Under data protection laws, you have certain rights in relation to your personal information, we’ve listed them below although not all of them apply to OTR’s use of your data. You can find out more from the Information Commissioner’s Office (ICO). 

1. Right to be informed: so you know how your personal data is collected and used 
2. Right of access: also called ‘subject access’; the right to obtain a copy of the personal information that we hold about you. 
3. Right to correction: to have any inaccurate personal data corrected or completed. 
4. Right to erasure: also called ‘right to be forgotten’, applies in certain circumstances. 
5. Right to restrict processing: applies in limited circumstances. 
6. Right to data portability: to obtain and reuse your personal data for your own purposes across different services 
7. Right to object: to processing your personal information in some circumstances, including to object to direct marketing. 
8. Rights in relation to automated decision making and profiling: right to additional protection where organisations use personal data for automated individual decision-making and profiling. 

In addition to the rights above, where we rely on consent as the legal reason for using your personal information, you have the right to withdraw your consent. 

If you want to exercise any of the above rights in relation to your personal information, please contact us using the details above.  If you do make a request, then please note: 

1. We may need certain information from you so that we can verify your identity; 
2. We do not charge a fee for exercising your rights unless your request is unfounded or excessive; and 
3. If your request is unfounded or excessive, then we may refuse to deal with your request. 

 

11. Marketing 

You may receive marketing from us about the work of OTR and about other OTR services, where you have consented to this, or we have another legal reason by which we can contact you for marketing purposes. 

We will give you the opportunity to manage how or if we market to you. To change your marketing preferences, and/or to request that we stop processing your personal information for marketing purposes, you can contact us. 

If you do request that we stop marketing to you, this will not prevent us from sending communications to you that are not to do with marketing. 

We do not pass your personal information on to any third parties for marketing purposes. 

 

12. Complaints 

If you are unhappy about the way that we have handled or used your personal information, you have the right to complain please contact us first using the details at the beginning of this notice so we have the opportunity to address your complaint. You can also complain to the UK supervisory authority for data protection, which is the Information Commissioner’s Office (ICO). 

 

13. Third-party websites 

Our website may contain links to third-party websites. Those third-party websites may collect personal information from you and you will need to check their privacy notices to understand how your personal information is collected and used by them.