Powys Association of Voluntary Organisations (PAVO) is committed to respecting and protecting the right of individuals to privacy.

This notice explains when and why we collect personal information about individuals, including those who visit the PAVO mental health website, our service users, those people and organisations we work with to deliver our services, including our funders, and those who provide us with goods and services. It also tells you how and why we use this data, the conditions under which we may disclose it to others and how we keep it secure.

We may update this notice from time to time so please check this page occasionally to ensure that you’re happy with any changes. By using our website, you’re agreeing to be bound by this this notice.

Any questions regarding this notice and our privacy practices should be sent by email to angela.owen@pavo.org.uk or in writing to PAVO, 30 Ddole Road, Llandrindod Wells, Powys, LD1 6DF. Alternatively, you can telephone 01597 822191.

Who are we?

PAVO is the county voluntary council for Powys. Our mission is to Help Organisations and Improve People’s Lives. We are one of 19 organisations who are partners in Third Sector Wales (TSSW), a national network of third sector infrastructure bodies across Wales working at a local, regional and national level to deliver a Thriving, Sustainable Third Sector, Good Governance, Volunteering and Influencing and Strategic Engagement.

What information do we collect about you, how and why, and who do we share it with?

Below are details of how we collect and use personal data in various circumstances. For each category of individuals, we have set out the lawful purpose or purposes for which we process their information; we will not use the information to contact them for any other reason.

We will only retain personal information for as long as necessary to achieve the purpose for which it was collected. This will vary depending on the situation, but we will delete all personal information as soon as we no longer need it for that purpose.

Visitors to our website

When someone visits www.powysmentalhealth.org.uk we use a third party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns, to find out things such as the number of visitors to the various parts of the site. This information is only processed in a way that does not identify anyone. We do not make, and do not allow Google to make, any attempt to find out the identities of those visiting our website.

Where we do want to collect personally identifiable information through our website, we are up front about this and the information will be provided by you. We make it clear when we are collecting personal information from you and explain what we intend to do with it.

Job applicants

All shortlisting for posts is carried out anonymously and we will only use your contact information once that process has been completed, to let you know whether or not you will be offered an interview and to let you know the outcome of an interview. A full privacy notice is included in all application packs.

If you want to complain or provide us with feedback

We will use the information provided by you to follow up a complaint or grievance in accordance with our Complaints Procedure. We also keep a record of all complaints received and the outcome of investigations, including whether or not the complaint has been upheld. This record includes the name of the complainant but not their contact details. The complaint form with contact details will be destroyed one year after the end of the investigation, including any appeal.

We use your feedback to improve our services and also to illustrate the difference that our services make. We do not attribute feedback unless you have given us your explicit consent to do so. We retain all feedback for one year after the end of the period to which it relates, so that we can use it for reporting purposes and to inform our planning for the following year.

Ebulletin and other news – information

All TSSW contacts are stored on a Customer Relations Management system (CRM) and will have been contacted to find out what information they want to receive from us and how they want to receive it. Click here for details. We use an online mailing system Mailchimp to generate and circulate information and your email address only (no other personal data) is held within their system, you can read the Mailchimp privacy statement HERE https://mailchimp.com/legal/privacy/. PAVO has opted out of allowing Mailchimp to use our data for analytics and there is also an option for you to further manage your data (the information on how to do this is contained within the Mailchimp Privacy Statement) should you wish to do so.

If you access our blogs, Facebook page or other social media through the PAVO mental health website you will not be required to provide any personal data.

Service users

Powys Befriending Service

In order to deliver our befriending service we need to have contact details for both our volunteers and clients, to match volunteers to one to one clients, keep in touch and organise group and individual activities. We keep Volunteers’ bank details so that we can make expense payments (see ‘Those who provide us with goods and services’ below). We also keep more sensitive information about our clients’ health and wellbeing and personal circumstances. We use the information to ensure that we take all necessary steps to safeguard the clients’ health and wellbeing and, in an anonymised form, to report to our funders.
We store all of this information securely in a database on a server in the EEA and share it with the system provider solely for the purposes of system administration and maintenance. We retain personal information as long as the client or volunteer is active in the service and delete it once this is no longer the case.

Community Connectors

When clients are referred to or refer themselves to the Community Connector Team, we collect their name, address, telephone number and service information. This may include information about a client’s health and wellbeing or personal circumstances, which we need to have to ensure that we are able to signpost or refer the client to the appropriate health and social care services. We store all of this information securely in a database on a server in the EEA and share it with the system provider solely for the purposes of system administration and maintenance.

In order to provide our clients with the best possible service, we share relevant information with our partners in Powys Teaching Health Board and Powys County Council, to make sure that they can access the services that matter to them. We only share the information that is necessary to provide the client with adult social care services or where we are required to do so by law.

In all cases, information is only used by authorised health and social care professionals in Powys, involved in the client’s direct care.

We will retain our clients’ names, address, telephone number and relevant service information for 10 years, so that we can stay in touch with them. If we have not communicated with a client further during this time, we will delete the personal data we hold regarding them at the end of this period.

For further information on the way in which client information is processed by Powys County Council Adult Social Services, please click here

Participation

We carry out various engagement activities so that individuals can make their views known to us on a range of local and national issues. We bring this feedback to the attention of the appropriate people, so that is can be used to help to improve both our own services and also the services that are delivered by statutory bodies, such as the local council and health board, and also the Welsh Government.

This feedback is usually anonymous and in any event no personal information will be forwarded to the various service providers with whom we share it. However, there are times when we will need to ask for contact details or other personal information, for instance where we need banking information so that we can pay expenses to third sector representatives (see ‘Those who provide us with goods and services’, below), or where we ask for an email address so that we can get further details to enable us to follow up concerns that have been raised (see ‘If you want to complain or provide us with feedback’ above).

People and organisations we work with to deliver our services, including our funders

As a member of TSSW, we use a shared CRM to store details of those with whom we work in the third, statutory and private sectors (click here for further information) as well as individuals living in Powys. This will include work email addresses, which are personal data, as well as some personal email addresses and details of the various interactions that we have with these individuals and, where relevant, the organisations for which they work.

We use this information to enable us to deliver our services effectively and efficiently. We regularly review the data on our CRM and update it or delete it as and when required. We will only send out direct marketing information to our contacts where we have their express consent to do so.

We also store on the shared CRM details of those who attend our training courses, including details of the training attended and any accreditations achieved, for monitoring purposes. In the case of MiDAS training we use this information to provide associated documentation, communicate MiDAS related updates and monitor and evaluate the MiDAS scheme.

When you attend one of our courses you will be asked to fill in an evaluation form that also asks if you wish to be contacted in relation to other PAVO training. If you consent to us contacting you in this regard this will be recorded on the CRM. You may withdraw this consent at any time by emailing training@pavo.org.uk.

Those who provide us with goods and services

In order to process and make payments we have to use some or all of the details that have been given to us, including contact name and email, address and bank details. In some cases this will be personal information. Where this is the case, we will process the information lawfully and in a way that respects and protects individuals’ right to privacy. We store all of this information securely in a database on a server in the EEA. We share it with the system provider solely for the purposes of system administration and maintenance.

We will review our sales ledger annually and delete the details of anyone to whom we have not made a payment within the past two years.

How do we protect your information?

We have in place administrative, technical and physical measures, both on our website and internally, designed to guard against and minimise the risk of loss, misuse or unauthorised processing or disclosure of the personal information that we hold.

Where information is stored on servers, they are situated within the EEA. Should this not be the case, we will ensure that European Commission approved standard contractual arrangements are in place.

Your rights

You have rights as an individual that you can exercise in relation to the personal information we hold about you. These are:-

• a right of access to a copy of the information comprised in your personal data
• a right to object to processing that is likely to cause or is causing damage or distress
• a right to prevent processing for direct marketing
• a right to object to decisions being taken by automated means
• a right in certain circumstances to have inaccurate personal data rectified, blocked, erased or destroyed
• a right to claim compensation for damages caused by a breach of the Data Protection Act.

Cookies

For many visitors to our website we do not collect any personal information. However, when we provide services, we want to make them easy, useful and reliable. This sometimes involves placing small amounts of information on your device, such as your computer or mobile phone. These include small files known as cookies.

Our cookies contain no data specific to an individual, so that your privacy remains protected. They don’t contain your email address, nor do they tell us who you are.

We use cookies to monitor our website, its usage including visitor numbers and page views. We also use cookies to improve your user experience whilst on our website, including:

• enabling a service to recognise your device so you don’t have to give the same information during one task
• recognising that you have already given a username and password so you don’t need to enter it for every web page requested

How can I stop cookies and what effect will this have?

You can stop cookies from being deployed on your computer by configuring your browser not to accept them. However, in order to get the best use out of our website, you will need to have cookies enabled. Please refer to your browser’s ‘help’ facility for information on how to enable and disable cookies.

If cookies are already on your system, you can delete them – For more information on cookies and deletion of cookies please visit: http://www.aboutcookies.org.uk/managing-cookies. Please be aware that deleting certain cookies can result in difficulties when navigating around sites.

Contact us

If you would like to get in touch to discuss this privacy notice or how we use your personal information, to exercise your rights or to provide feedback or make a complaint about use of your information, please contact:-

Angela Owen, Head of Internal Services
PAVO, Plas Dolerw, Milford Road, Newtown, Powys, SY16 2EH
angela.owen@pavo.org.uk
01686 626220

You can also contact the Information Commissioner’s Office at https://ico.org.uk/ for information, advice or to make a complaint.