AOTW Privacy Policy

Autism on the Water (“us”, “we”) respect the privacy of every person who comes into contact with our organisation (“you”) and are committed to ensuring a safe experience. This privacy statement outlines the personal data we may collect about you and how we may process it. This privacy statement also tells you about your rights to control this data.

Responsibility for your data

Autism on the Water is subject to the General Data Protection Regulation and the Data Protection Act 2018.

This Privacy Policy also outlines under which circumstances Autism on the Water collects personal data, why, how we use it, keep it safe and the rights of those whose data we hold.

Why we collect data:

We collect, store and process personal data for the following purposes:

Enquiries made to Autism on the Water.
Services we provide to autistic people.
Volunteer and service provider related information.
Sponsorships and in some cases donations for the purpose of funding the organisation.

How we use personal data:

This privacy statement does not cover the activities of any third parties. Where third parties are involved, you should consult those third parties’ privacy policies for information on how your data is used by them. Autism on the Water does not sell or pass on personal contact details to any organisation and will not do so in future without asking you for a specific opt-in to that scheme.

What personal data do we collect?

Attendees on our events: we collect personal data such as name, contact details, details of additional needs, which enable us to provide the events to our guests in a way that is tailored to their needs and to inform our guests and their families/carers of all information relevant to the event they have expressed a desire to participate in which they may need to participate.
When people make an enquiry, we collect personal data such as your name and email address in order to reply to your query. This information is used to administer and deliver to you the support you have requested and to answer any enquiries accurately.
If you sign a contract with us as a volunteer, service provider, trustee or sponsor, we collect the information required to uphold the contract, this may include your name, contact details and PVG Disclosure status.
When making PVG scheme Disclosure requests, we may handle and process further information about you, some of which may be considered sensitive. We will only allow people who are directly involved in the PVG checking process to handle this data, these people will do so with the utmost discretion and in keeping with the Code of Practice of Volunteer Scotland’s Disclosure Service and any information, which I obtained solely for the purpose of conducting PVG checking will be destroyed securely with only the final outcome of the check being recorded long-term.

Trading in personal data

Some of your personal data may be collected and processed with the intention of providing it to other named organisations, for example where we need to book third-party accommodation, but this will only be done where you have given your express consent at the time of sharing this information (separately to this privacy statement).

Our legal process for processing personal data

Under the General Data Protection Regulation (GDPR) and the Data Protection Act 2018, organisations are required to have a legal basis for processing personal data. The legal basis we use for processing data is:

Legitimate interests for the purposes of fulfilling our activities and the provision of our services.

How long do we keep data?

Data is received by means of completing online forms, email communication and social media messaging systems. As a general rule, we transfer this data to files stored securely on the Autism on the Water Google Drive, which can only be accessed by specific members of the Autism on the Water team. These files are kept in order to store the data in one place to facilitate the running of the organisation. The original form-generated emails, ordinary emails and messages by means of which we become aware of this information are archived in the normal way for the messenger provider.
If, after the information has been used for the proper purposes, for example, after an event you have been involved in is over, you wish to have you data removed from the archive, we can facilitate this but there is no standard expiry date for the storage of archive information no longer directly in use.

Collection of personal data

Our primary goal in collecting personal data from you is to allow us to provide services that meet your needs. We only collect personal data from you through data inputted through online forms (if submitted), emails and social media messaging systems.

Your rights:

Under the GDPR and the Data Protection Act 2018, you have the following rights:

Right to be informed. This Policy provides you with information in relation to how your data is processed. This ensures that we are transparent about what we will do with the information you supply to us.
Right to object to the processing that is likely to cause you damage or distress. Where you challenge the accuracy or lawful processing of your information, we will consider this.
Right to receive an electronic copy of any information you have consented to us holding. You can ask us to provide you with the personal data about you we hold, securely and in a machine-readable format, so it can be moved, copied or transferred to be used across different services or for you to give to another organisation. This is called a subject access request and we will need to verify your identity before giving such information.
Right to object. We will ensure that we have the right consents in place for sending you information.
Rights related to automated decision making. If there is additional profiling based on the information we hold, then you can object to us making decisions about you based on such processing.

You can make a request at any point by email to gdpr@aotw.org.uk. We will respond to a request within one month of receipt. However, where a request is received to erase data, we may not be able to delete all data (for example where data is linked to financial transactions that must be kept for a set period of time under financial regulations).

Confidentiality and security of your personal data

We are committed to keeping the data you provide us secure and will take reasonable precautions to protect your personal data from loss, misuse or alteration. The transmission of information via the internet is not completely secure. Once we have received your information, we will use strict procedures and security features described above to try to prevent unauthorised access. We have implemented rules and technical measures to protect the personal data that we have under our control from:

unauthorised access
improper use or disclosure
unauthorised modification
unlawful destruction or accidental loss

All our data processors (i.e. those who process your personal data on our behalf, for the purposes listed above), who have access to, and are associated with the processing of your personal data, are obliged to keep the information confidential and not use it for any other purpose than to carry out the services they are performing for us in line with the standards set out in the GDPR.

Who we share data with:

We will share data with the appropriate authorities (e.g. police, law enforcement agencies and other parties) where we have a legal obligation. For example, for the detection and prevention of fraud, or where data is required in relation to a criminal offence.

We do not sell or share data with any other third parties without express consent.

This privacy policy is subject to occasional revision. If we have a contract with you or you are due to participate in an upcoming event and we make substantial changes to this privacy policy, we will notify you. You are responsible at all times for keeping your email address up to date. Any changes to this privacy policy will be effective immediately and your continued use of our services or involvement with Autism on the Water after such time shall constitute your acceptance of the amended policy.