Privacy Policy

1.About this policy

This policy explains how Penumbra collects, processes and looks after your personal information. It applies to everyone whose information we hold: people who use our services, staff and volunteers, our supporters and donors, and people who contact us, visit our digital sites such as websites or visit our premises.

Because we process information in different ways for different groups, this notice has separate sections for supported people, staff and volunteers, and our supporters and donors. The principles that guide us – that we are transparent, that we protect all information with care, and that you have rights over your information – are the same throughout.

2.The Information we hold and where it comes from

The information we hold will depend on how you come into contact with Penumbra. It may be information you have provided directly, or it may have come through a third party, such as when someone is referred by another organisation to our services. This is described in detail in the sections below.

Some of the information we hold is what the law calls special category information, which is more sensitive data that requires stronger legal justifications for collecting, and higher levels of data security. This could include information about your health, your racial or ethnic origin, religion, sexual orientation or disability, and, in employment, trade union membership.

We only gather this kind of information when it is absolutely essential for areas such as to provide effective support, or when legal requirements such as contracts require us to hold the information. We take the responsibility of gathering this sensitive information extremely seriously and ensure that appropriate safeguards are in place to protect it. We explain the legal basis for processing this information in the sections below.

3.How we process your information

The law requires us to have a valid reason, called a lawful basis, for processing your information. We only collect personal information that is necessary for the purposes for which it is processed.

Where the information is sensitive, there must also be additional conditions. Because we work with different groups of people in different ways, the lawful basis differs for each. Each section below explains the specific lawful basis for that group.

New systems and services are designed using Privacy by Design principles, ensuring privacy and security are considered from the earliest stages. Where new technologies or processing activities may present increased privacy risks, Penumbra undertakes Data Protection Impact Assessments (DPIAs).

4.If you use our services

4.1The information we hold

Good support depends on good records. If you access our services, we keep information about your contact with us. The detail of this will vary across our services, but may include information such as your name and address, health and wellbeing, your support plan, goals you are working towards, and details of any referrals made to use by other services. This information is seen only by staff involved in your support and by managers responsible for quality and safety. This information may also be accessed by statutory partners who have a legal right to do so, such as where services are registered with the Care Inspectorate, who may sample records when they are inspecting a service.

4.2 Lawful basis for processing your information

The lawful basis to process your information is because it is necessary to provide the support you (or a referrer) have asked us for, and because we have legal duties to keep you and others safe. For information about your health, which is sensitive information, we rely on the condition that it is necessary for the provision of health and social care (Article 9(2)(h) of the UK GDPR). For safeguarding, we also rely on our duty to protect vital interests (Article 9(2)(c)) and on safeguarding conditions in the Data Protection Act 2018.

Some processing of your information, such as service improvement, research, and any communications about our work do require your consent. These are explained below and you can choose whether or not to agree. Saying no will not affect the support you receive.

4.3 Processing data for safeguarding

The safety of the people we support, and others who may be impacted by our work, matters deeply to us. There are some situations where we have a legal duty to share information with other agencies. For example, where there is a serious concern that you or someone else could be harmed. In Scotland this includes our responsibilities under the Adult Support and Protection (Scotland) Act 2007 and child protection legislation. We do not take these decisions lightly, and we will always try to talk with you about any concerns we have, unless doing so would put you or someone else at greater risk, or may compromise legal processes.

4.4 Working with other organisations

Sometimes supporting you well means working alongside other services, such as NHS services, social work, the Care Inspectorate who regulate many of our services, and other community organisations. Where we share information to help coordinate your support, we shall always let you know about this in advance as standard and wherever possible. There are a very small range of circumstances where we may need to share information without your consent – for example where your safety or someone else’s safety is at serious risk, or where we are legally required to do so, such as by a court order. We will always try to handle this in a way that respects your dignity and keeps you informed.

4.5 If you are a young person

We take extra care with information about young people. Depending on your age and understanding, we will consider whether you are able to make decisions about your information yourself, or whether a parent or carer should be involved. We will explain this to you in a way that makes sense for you.

4.6 Information about other people

Where you give us details of a carer, a family member or an emergency contact, we hold that information so that we can support you and respond if there is an emergency. We handle this information in line with this notice.

5. If you work or volunteer with us

5.1 The information we hold

Depending on your role, we may hold information about your name and contact details; your application, references and interview records; your contract of employment or volunteer agreement; your pay, pension and tax information (where applicable); your attendance and leave records; supervision, appraisal and training records; information about your health where relevant to your role or absence; equalities information; trade union membership; and information about criminal records and PVG scheme membership for regulated roles.

5.2 Lawful basis for processing your information

We process your information because it is necessary to perform our contract with you, to comply with our legal obligations as an employer, and in some cases because it is in our legitimate interests to do so. For information about your health, which is sensitive information, we rely on the employment condition (Article 9(2)(b) of the UK GDPR). For criminal records and PVG scheme membership, we rely on the safeguarding condition (DPA 2018). For equalities monitoring information, we rely on our legal obligation to monitor equality of opportunity.

5.3 Location data in our staff systems

Where your role involves visiting people in the community, some of our systems may record your location at the point when you log on and when you log off. Location data is collected only when the application is actively used for authorised work purposes. Background location tracking is not undertaken.

We process this information for two separate purposes. The first is your safety: knowing your location when you start and finish helps us account for your whereabouts and respond if there is a concern for your safety as a lone or remote worker. The second is attendance: it allows us to confirm that visits are taking place within the expected work area. We only use this information for attendance purposes in the event of any queries being raised as to the delivery of the service and do not monitor it pro-actively.

This location information is held within the supported persons records for the duration of the supported persons record and is accessed only where there is a proper reason. If you have any concern about the use of this location data, please speak to Penumbra’s Data Protection Officer or HR.

This location data is processed on the basis of our legitimate interests – both in our duties to ensure the safety of staff who are lone or remote workers and in keeping accurate records. Before introducing this we completed a data protection impact assessment and a legitimate interests assessment to confirm it was necessary and proportionate.

5.4 Criminal records and the PVG scheme

Because we support adults and young people who may be at risk, many of our roles are regulated work under Scottish law. For these roles you are required to be a member of the Protecting Vulnerable Groups (PVG) scheme run by Disclosure Scotland. We carry out appropriate checks before you start and, where relevant, during your employment.

We process information about criminal convictions, cautions and other relevant matters to comply with our legal obligations and to meet our duty to safeguard the people we support.

We handle this information with particular care, restrict who can see it, and keep it only for as long as we need it. Our policy on the recruitment and employment of people with criminal records provides more detail.

5.5 Health and wellbeing

We may hold information about your health where it is relevant to your role, your absence, or any adjustments you need. We process this to meet our obligations as an employer and to support your wellbeing. Our lawful basis is that this is necessary for employment purposes.

5.6 Equalities monitoring

We monitor equality of opportunity by collecting information about race, ethnicity, gender identity, sexual orientation and disability. You provide this voluntarily. We process it to understand whether our workplace is genuinely inclusive and to identify where improvements are needed. The lawful basis for this is our legal obligation to monitor that we are upholding our equalities duties.

6. If you support us

6.1 The information we hold

If you donate, fundraise for us or otherwise support our work, we may hold your name, contact details and information about your gift or support. The information we hold may also include records of your communication preferences, Gift Aid declarations, fundraising event participation and previous donations. If you use an external fundraising platform, that organisation will share your information with us where you have agreed to it.

6.2 Lawful basis for processing your information

We process your information because it is necessary to perform the transaction you have initiated (for example, processing your donation) and to comply with our legal obligations (such as tax law and Gift Aid requirements). We may also process your information on the basis of our legitimate interests to maintain a record of our relationship with you, manage supporter engagement, understand the effectiveness of our fundraising and communications activities and keep accurate records of donations, volunteering and other support.

We may contact you about our work, services, campaigns and fundraising activities where we have your consent, where this is permitted by law or where we can rely on another lawful basis. This includes the charitable purposes soft opt-in where applicable and permitted by law. You can change your communication preferences or opt out at any time.

6.3 Donations and fundraising

Penumbra conducts fundraising in accordance with Scottish charity law, including the Code of Fundraising Practice and relevant guidance issued by OSCR and the Fundraising Regulator.

If you donate, fundraise for us or otherwise support our work, we process your information to process and acknowledge your gift, to claim Gift Aid where you have allowed it, to keep an accurate record of your relationship with us and to meet our financial and legal obligations. If you use an external fundraising platform, that organisation will share your information with us where you have agreed to it. Your payment card details are handled by a specialist payment provider and are not held by us.

6.4 Contacting you about our work

We may contact supporters by post, email, telephone or other electronic means to provide updates about our work, services, events, campaigns, volunteering opportunities and fundraising activities.

We will only send electronic marketing communications where:

You have given your consent;
Another lawful basis applies under data protection or electronic communications legislation; or
We are permitted to do so under applicable privacy and electronic communications legislation, including the charitable purposes soft opt-in which may allow charities in certain circumstances to contact supporters who have previously expressed an interest in their work

Electronic marketing communications are managed in accordance with GDPR and the Privacy and Electronic Communications Regulations (PECR).

Where we rely on consent, you can withdraw it at any time. Where we rely on the charitable purposes soft opt-in or another lawful basis, you can opt out of receiving marketing communications at any time. Every electronic marketing communication will include a simple way to unsubscribe or update your communication preferences.

We may process information about your previous donations, fundraising activities, volunteering or engagement with Penumbra to better understand supporter interests, improve our fundraising activities, assess the effectiveness of our communications and ensure that messages are relevant and appropriate. We do not process this information to make solely automated decisions that have legal or similarly significant effects on you.

You can update your preferences, withdraw consent where applicable or opt out of receiving marketing communications at any time by contacting us using the details in section 13.

6.5 Your communication choices

You are in control of how we contact you. You can update your communication preferences, withdraw consent where applicable or opt out of marketing communications at any time. We will keep a record of your preferences and act on them as soon as reasonably practicable.

7.Cookies and Website Process

Our websites use cookies to improve your experience, understand visitor behaviour, and provide relevant content. You can manage or disable cookies through your browser settings.

For more information, please see our Cookies Policy. Our Cookies Policy complies with the UK Privacy and Electronic Communications Regulations 2003 (PECR) and the UK GDPR

8. Sharing your information

We will never sell your information, and we share it only where we have a lawful reason to do so.

We use some carefully chosen suppliers who handle information on our behalf, such as IT and payment providers. Where a supplier acts on our behalf, we put a written contract in place that requires them to protect your information and to process it only as we instruct.

Where we share information with another organisation that decides how to process it in its own right, such as an NHS body or the local authority, that organisation is responsible for its own processing of your information.

Where there is a serious risk to someone’s safety, we may need to share information with an emergency service, the police or social work, in line with our duty of care and the law (see also section 4.3 above).

We are committed to meeting our regulatory duties and will cooperate with bodies such as the Care Inspectorate and the Information Commissioner’s Office. In those cases we share information only where there is a clear lawful basis for doing so.

9. Keeping your information safe and how long we keep it

We use appropriate technical and organisational measures to protect your information, whether it is held on paper or electronically, and we train our staff to handle it properly.

Different categories of information are retained for different periods depending upon legal, regulatory and operational requirements. Penumbra maintains a formal Data Retention Schedule which defines these periods and information is securely deleted once no longer required.

When we no longer need information, we delete it. In a small number of cases we are required to keep certain records, for example for legal or safety reasons, even where you have asked us to delete them. Where that happens, we pseudonymise and restrict access to the information so that it can be seen only by senior staff, and we shall explain clearly to you our reasons why we believe the information cannot be deleted at this time. Information kept in this way remains your personal information and continues to be protected by this notice.

10. How we keep your information safe

All data is stored in line with UK data protection laws and only retained within the schedules in our Data Protection Policy.

We employ layered security measures, including encrypted systems, access controls (in addition to password protection, data is protected by multi-factor authentication and secure device authentication), staff training, and incident reporting procedures.

All staff receive data protection training and compliances is monitored by both our Learning and Practice Development Team and our Data Protection Officer.

We take any data breaches extremely seriously. We investigate any breaches fully and have a detailed Data Breach Procedure and, where appropriate, report to the ICO within 72 hours.

Penumbra seeks, wherever reasonably practicable, to ensure that personal information is stored within the United Kingdom or jurisdictions recognised as providing an adequate level of protection. Some of our technology suppliers may process information outside the UK. Where this occurs, Penumbra ensures appropriate safeguards are in place, including adequacy regulations, the UK International Data Transfer Agreement (IDTA), or other approved transfer mechanisms.

11. Your rights

You have a number of rights over your personal information. You can ask us to:

Give you a copy of the information we hold about you (known as a Subject Access Request);
Correct information that is wrong or incomplete;
Delete information, in certain circumstances; (see section 9 above for discussion of where this may not be possible).
Restrict how we process your information, in certain circumstances;
Provide information you gave us to another organisation, where this applies;
Stop processing your information for a particular purpose, where we are relying on our legitimate interests;
Withdraw your consent, where we are relying on it, at any time; and
Stop processing your information for direct marketing at any time.

You will not usually have to pay to exercise these rights. We may need to confirm your identity first. Some rights do not apply in every situation, because they depend on why we are processing your information. If a right does not apply, we will explain why.

Penumbra may use artificial intelligence (AI) technologies to assist with administrative processes, reporting, data analysis and service improvement. Any use of AI will; comply with UK GDPR, maintain appropriate human oversight, protect confidentiality, never replace professional judgement in decisions affecting supported people and be subject to ongoing governance and review.

We do not make decisions about you using only automated means or without any human involvement, that have a legal or similarly significant effect on you. AI-assisted technologies may be used in future to support administrative efficiency, but significant decisions affecting individuals will always involve appropriate human oversight.

To exercise any of these rights, please contact us using the details in section 12. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk if you are unhappy with how we have handled your information, although we hope you will contact us first so that we can put things right as quickly as possible.

12. Changes to this notice

We review this notice regularly to keep it accurate and up to date. Where we make significant changes, we will make this clear and, where appropriate, let you know.

13. How to contact us

For any question about this notice, to exercise your data rights, or to change how we contact you, please contact our Data Protection Officer:

By post: Data Protection Officer, Penumbra Mental Health, Orchard Brae House, 30 Queensferry Street, Edinburgh, EH4 2HS
Email: DPO@penumbra.org.uk
Telephone: 0131 475 2380

If you wish to raise a concern with the regulator, you can contact the Information Commissioner’s Office at ico.org.uk, by telephone on 0303 123 1113, or by writing to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.