Privacy Policy

1. Introduction and company information

This Privacy Policy explains how Harbour Community Support Limited collects, uses, stores, shares, and protects personal data when providing community support services and operating its website, communications, events, and related services.

Data controller: Harbour Community Support Limited
Address: Harbour Community Hub, 18 King Street, Newcastle upon Tyne, NE1 6JE, UK
Email: [email protected]
Phone: +44 191 432 7894

We are committed to handling personal data lawfully, fairly, and transparently, and to protecting the privacy of the people who use our services, visit our premises, contact us, volunteer with us, or otherwise interact with us.

2. Data collection and processing

We may collect and process the following categories of personal data, depending on how you interact with us:

• Identity data: name, title, date of birth, and similar identifiers.
• Contact data: address, email address, telephone number, and emergency contact details.
• Service-related data: information you provide when requesting or receiving community support, referrals, signposting, case notes, attendance records, support plans, and communications about your needs.
• Special category data: where relevant and necessary, information concerning health, disability, accessibility needs, ethnic origin, religion, dietary requirements, or other sensitive circumstances.
• Usage and technical data: website activity, device information, IP address, browser type, and cookies or similar technologies, where applicable.
• Transaction and donation data: records of payments, donations, grants, or financial transactions processed by or for us.
• Volunteer, staff, and governance data: application details, references, DBS or similar screening information where applicable, employment or volunteering records, and trustee or board information.
• Communication data: emails, letters, telephone call notes, feedback, complaints, and enquiries.

We collect data directly from you, from people acting on your behalf, from referral partners, service providers, public sources where appropriate, and from technical systems used to operate our services.

3. Purpose of data processing

We process personal data for the following purposes:

• to provide, manage, and improve our community support services;
• to assess needs and eligibility for support, referrals, and safeguarding arrangements;
• to communicate with service users, volunteers, donors, partners, and other contacts;
• to administer events, activities, workshops, and community programmes;
• to manage donations, grants, accounts, and financial administration;
• to recruit, onboard, and manage volunteers, staff, and trustees;
• to comply with legal and regulatory obligations;
• to protect the safety, wellbeing, and security of individuals and premises;
• to respond to enquiries, complaints, requests, and legal claims;
• to monitor and improve our website, services, and communications;
• to conduct legitimate fundraising, engagement, and impact reporting activities where permitted.

4. Legal basis for processing

We only process personal data where we have a lawful basis to do so. Depending on the context, our legal bases may include:

• Consent: where you have given clear permission for us to process your data for a specific purpose.
• Contract: where processing is necessary to provide a service you have requested or to take steps at your request before entering into an arrangement.
• Legal obligation: where processing is required to comply with a law or statutory duty.
• Vital interests: where processing is necessary to protect someone’s life or prevent serious harm.
• Public task: where processing is necessary for a task carried out in the public interest or under official authority, if applicable.
• Legitimate interests: where processing is necessary for our legitimate interests or those of a third party, and those interests are not overridden by your rights and freedoms.

Where we process special category data, we will only do so where an additional lawful condition applies, such as your explicit consent, safeguarding needs, substantial public interest, vital interests, legal claims, or another applicable condition under privacy law.

5. Data sharing and third parties

We may share personal data with trusted third parties only where necessary and appropriate, including:

• service providers and processors who support our website, email, IT, record keeping, payment processing, or cloud storage;
• professional advisers such as accountants, auditors, insurers, and legal advisers;
• funding bodies, referral partners, partner organisations, and community organisations involved in delivering or coordinating support;
• emergency services, safeguarding bodies, healthcare providers, or local authorities where required to protect welfare or comply with legal duties;
• regulators, law enforcement, courts, and other authorities where required or permitted by law;
• volunteers, staff, or trustees on a need-to-know basis for operational purposes.

We require third parties to handle personal data securely and only in accordance with our instructions or applicable law. We do not sell personal data.

6. Data transfer to third countries

Where personal data is transferred outside the United Kingdom, we will take appropriate steps to ensure that the transfer is lawful and that suitable safeguards are in place. These may include contractual protections, adequacy decisions, or other approved transfer mechanisms.

If you would like more information about any international transfers affecting your data, please contact us using the details below.

7. Storage duration

We keep personal data only for as long as necessary for the purpose for which it was collected, including to meet legal, accounting, safeguarding, or reporting requirements. Retention periods may vary depending on the type of information and the nature of our relationship with you.

• Service and support records are generally retained for the period needed to manage the support provided and for any applicable legal or safeguarding retention period.
• Financial and donation records are generally retained for the period required by tax, accounting, and charity or company law requirements.
• Volunteer, staff, and recruitment records are generally retained in line with employment, safeguarding, and operational requirements.
• Website and technical data are generally retained for as long as needed for security, analytics, or operational purposes.

When personal data is no longer required, we will securely delete, anonymise, or destroy it.

8. User rights

Subject to applicable law, you may have the following rights in relation to your personal data:

• Access: to request a copy of the personal data we hold about you.
• Rectification: to ask us to correct inaccurate or incomplete data.
• Erasure: to ask us to delete your data in certain circumstances.
• Restriction: to ask us to limit how we use your data in certain circumstances.
• Data portability: to receive certain data in a structured, commonly used, machine-readable format and to request transfer to another controller where applicable.
• Objection: to object to processing based on legitimate interests and, in some cases, to direct marketing or similar activities.

To exercise any of these rights, please contact us using the details provided below. We may need to verify your identity before responding. Some rights may be limited where the law permits or requires us to retain or use the information.

9. Withdrawal of consent

Where we rely on your consent to process personal data, you have the right to withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing carried out before consent was withdrawn. If you withdraw consent, we may be unable to continue providing certain services or communications where consent is necessary for them.

You can withdraw consent by contacting us at [email protected].

10. Right to complain

If you have concerns about how we handle your personal data, please contact us first so we can try to resolve the issue. You also have the right to lodge a complaint with the relevant data protection supervisory authority in the United Kingdom, which is currently the Information Commissioner’s Office (ICO), or any successor authority.

We encourage you to contact us before making a complaint so that we can address your concerns promptly and appropriately.

11. Data security

We use appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures may include:

• access controls and authentication measures;
• staff training and confidentiality obligations;
• secure storage and encryption where appropriate;
• restricted access on a need-to-know basis;
• procedures for handling data incidents and breaches;
• regular review of systems, policies, and suppliers.

While we take reasonable steps to protect your information, no system can be guaranteed completely secure.

12. Contact information

If you have any questions about this Privacy Policy or how we process your personal data, please contact:

Harbour Community Support Limited
Harbour Community Hub, 18 King Street, Newcastle upon Tyne, NE1 6JE, UK
Email: [email protected]
Phone: +44 191 432 7894

13. Changes to privacy policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, or data processing practices. Any updated version will be made available when appropriate, and the date of the latest revision may be added at the top or bottom of the policy.

We encourage you to review this Privacy Policy periodically to stay informed about how Harbour Community Support Limited protects your personal data.