Privacy Policy

1. Introduction and Company Information

This Privacy Policy explains how HarbourLink Community Support Ltd collects, uses, stores, shares, and protects personal data when operating its community services, activities, communications, and related support functions.

HarbourLink Community Support Ltd is the data controller for the personal data described in this Privacy Policy.

Contact details:

• Company: HarbourLink Community Support Ltd
• Address: HarbourLink Community Hub, 18 North Street, Southampton, SO14 2YB, UK
• Email: [email protected]
• Phone: +44 23 8051 6947

This Privacy Policy is intended to be read together with any other notices we may provide at the time we collect your data. By using our services or communicating with us, you acknowledge that your personal data may be handled as described in this policy.

2. Data Collection and Processing

We may collect and process the following categories of personal data, depending on your relationship with us and the services you use:

• Identity data: name, title, date of birth, and similar identifiers.
• Contact data: address, email address, telephone number, and emergency contact details.
• Service and participation data: records of attendance, bookings, participation in community activities, referrals, support requests, and service preferences.
• Communication data: correspondence with us by email, telephone, online forms, post, or in person.
• Support and safeguarding data: information relevant to delivering community support, assessing needs, managing risks, or safeguarding welfare, where appropriate and lawful.
• Technical data: IP address, device information, browser type, cookie data, and website usage information.
• Payment and transaction data: limited financial information if donations, fees, or other payments are made.
• Special category data: where necessary and lawful, we may process information relating to health, disability, ethnicity, religion, or other sensitive information to support inclusive community services, accessibility, or safeguarding.

We may collect personal data directly from you, from your authorised representatives, from referrals, from partner organisations, from public sources where appropriate, and automatically through our website or digital tools.

3. Purpose of Data Processing

We use personal data for the following purposes:

• to provide community support services, events, activities, and related assistance;
• to manage enquiries, referrals, registrations, and bookings;
• to communicate with service users, volunteers, donors, partners, and other contacts;
• to assess needs, offer tailored support, and ensure accessibility;
• to maintain safeguarding, welfare, and risk management measures;
• to administer donations, payments, and related records;
• to improve our services, website, outreach, and community engagement;
• to comply with legal, regulatory, accounting, and reporting obligations;
• to prevent fraud, abuse, misuse, and other unlawful activity;
• to establish, exercise, or defend legal claims.

4. Legal Basis for Processing

We process personal data only where we have a lawful basis to do so. Depending on the context, our legal bases may include:

• Consent: where you have given clear consent for a specific purpose, such as receiving certain communications or processing optional sensitive information.
• Contract: where processing is necessary to provide services requested by you or to take steps before entering into an arrangement.
• Legal obligation: where processing is required to comply with applicable law.
• Vital interests: where processing is necessary to protect someone’s life or physical safety.
• Public task / substantial public interest: where relevant and permitted in connection with community support, safeguarding, or related lawful purposes.
• Legitimate interests: where we have a legitimate and proportionate reason to process data, such as improving services, managing operations, maintaining security, or communicating with stakeholders, provided your rights and interests do not override those interests.

Where special category data is processed, we will also rely on an appropriate additional condition permitted by applicable law, such as explicit consent, safeguarding, or another lawful basis where relevant.

5. Data Sharing and Third Parties

We may share personal data with third parties where necessary, proportionate, and lawful. These recipients may include:

• service providers acting on our behalf, such as IT, cloud hosting, website, email, administration, and document storage providers;
• payment processors and financial service providers;
• professional advisers, such as accountants, auditors, lawyers, and insurers;
• public authorities, regulators, law enforcement, or courts where required by law;
• partner organisations, referral agencies, community groups, and support providers involved in delivering or coordinating services;
• emergency services or safeguarding bodies where necessary to protect a person’s safety.

We require third parties to handle personal data securely and only for the purposes we specify, unless they are independently responsible for their own legal obligations.

6. Data Transfer to Third Countries

Some of our service providers may store or process data outside the United Kingdom. Where this occurs, we will take appropriate steps to ensure that personal data remains protected in accordance with applicable legal requirements.

These measures may include using approved contractual safeguards, assessing the destination’s legal framework, and applying security controls intended to protect your information during transfer and storage.

7. Storage Duration

We retain personal data only for as long as necessary for the purposes for which it was collected, including to meet legal, accounting, safeguarding, contractual, and reporting requirements.

The length of time may vary depending on the type of information and the reason for processing. In general:

• service and support records are retained for the period needed to provide services and handle follow-up matters;
• financial and accounting records are retained for the period required by law;
• communication records are retained for as long as reasonably necessary to manage enquiries and continuity of service;
• safeguarding-related information may be retained longer where necessary to protect welfare or comply with legal duties;
• marketing preferences are retained until you opt out or the information is no longer needed.

When data is no longer required, we will delete, anonymise, or securely archive it in accordance with our retention practices.

8. User Rights

Subject to applicable law, you may have the following rights in relation to your personal data:

• Access: request confirmation of whether we process your personal data and obtain a copy of it.
• Rectification: request correction of inaccurate or incomplete personal data.
• Erasure: request deletion of your data in certain circumstances.
• Restriction: request limitation of processing in certain cases.
• Data portability: request your data in a structured, commonly used, machine-readable format where applicable.
• Objection: object to processing based on legitimate interests or direct marketing.

To exercise any of these rights, please contact us using the details provided below. We may need to verify your identity before responding. Some rights may not apply in all cases, particularly where we must retain data to comply with legal obligations or safeguard the welfare of others.

9. Withdrawal of Consent

Where we rely on your consent to process personal data, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

If you withdraw consent, we may still be able to process your data if we have another lawful basis to do so.

10. Right to Complain

If you have concerns about how we handle your personal data, please contact us first so we can try to resolve the matter.

You also have the right to complain to the relevant data protection authority in the United Kingdom. The supervisory authority is the Information Commissioner’s Office (ICO).

Website: https://ico.org.uk/

11. Data Security

We take appropriate technical and organisational measures to protect personal data against accidental loss, unauthorised access, disclosure, alteration, or destruction. These measures may include:

• access controls and password protection;
• secure storage and limited staff access on a need-to-know basis;
• encrypted or protected systems where appropriate;
• staff awareness and confidentiality obligations;
• regular review of data handling practices and service provider arrangements.

No system can be guaranteed completely secure. However, we work to maintain appropriate safeguards and to respond promptly to any suspected data incident.

12. Contact Information

If you have any questions about this Privacy Policy or how HarbourLink Community Support Ltd handles your personal data, please contact us:

• HarbourLink Community Support Ltd
• HarbourLink Community Hub, 18 North Street, Southampton, SO14 2YB, UK
• Email: [email protected]
• Phone: +44 23 8051 6947

13. Changes to Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, or data handling practices. Any updated version will be posted with a revised effective date where appropriate.

We encourage you to review this Privacy Policy periodically so that you remain informed about how HarbourLink Community Support Ltd protects your personal data.