Your Privacy.
See how we handle your privacy both when you use our services and when you use this website.
Our policies.
Privacy Statement for Oasis Project Service Users
How we respect privacy when we deal with personal information about individuals using our services.
Please note, “we” and “us” in this statement refers to Oasis Project.
Privacy is a fundamental right. When you access one of our support services, Oasis Project will always prioritise your privacy and protect your personal data with the greatest possible care.
In this Privacy Statement we explain how we manage the personal data of people receiving support, why we request it, and what we use it for.
If you have any comments or questions about this statement, feel free to email us at info@oasisproject.org.uk or write to us at 3 Globe House, Morley Street, Brighton, BN2 9RA.
Which services and teams does this privacy notice cover?
Oasis Project supports people across Brighton & Hove and East Sussex.
Services covered in this privacy notice include:
- Our adult treatment services in Brighton (as part of Pavilions)
- Young Oasis (Brighton & Hastings)
- Sex Workers Outreach Project (SWOP)
- East Sussex Oasis Women’s Recovery Services
- Our Crèche
Note: Fulfilling Lives Eastbourne and Hastings are managed under the BHT Privacy Notice)
When do we collect your personal data?
We collect your information when you are seeking to access one of our services. This may be a different route for each service. In most cases we will collect information at three stages:
- When you are enquiring about a service, referring yourself, or a professional you know is completing a referral form on your behalf.
- When you meet with a worker from one of the services for the first time and they complete an initial assessment to decide if a service is suitable for you and to know how we can best support you.
- Whilst you are receiving a service from us we will keep records of how the support we offer is going.
What personal data do we collect?
Each service will require different information about you depending on the needs you have and the support offered. We will collect these types of data:
- Personal details about you, for example your age, your health, and safe ways to contact you
- Personal details about your family and living situation (if this is relevant to the support you receive)
- Details about what is happening or has happened to you
- Any risks that you or your family are experiencing
- Information about anyone else supporting you
- Information on whether our support to you is being helpful
We will never collect more information than is required.
We will ensure that we always seek your consent for each piece of personal data we process. In most cases this will be written consent at an initial meeting with a service.
We are always happy to explain why we gather particular pieces of personal data.
How do we use your personal data?
Data we collect about you is used for the following purposes:
- To ensure we are offering you the best possible service and that each service is considering your individual strengths, difficulties and situation.
- To know who is accessing our services and what needs they have. This is to help us know if a service is being successful or to help us identify areas we could improve.
- To communicate with other professionals about you (with your permission) so that the support you receive is ‘joined up’.
- To ensure you and those around you are safeguarded and to communicate with safeguarding professionals if required.
- Anonymised information (information where you can’t be identified) is reported back to commissioners of services to ensure we are providing the service we are receiving funding for.
- Some of our services are research projects and will have specific needs for the purposes of research. This will always be made very clear at any initial contact with the service. We will never gather research data on a service user without their knowledge and consent.
When are we allowed to use your personal data?
A legal ground is necessary for processing personal data. Oasis Project collects and processes your personal data solely on the basis of the following legal grounds:
- Legitimate interest: As a Charity providing a range of important services to people, we are unable to offer an effective service without processing Personal and Sensitive (Special Category) data. As a charity with a number of funding streams, including grant payments, it is in our legitimate interest to supply potential and current funders with anonymised data relating to service use as part of our business plan.
- Compliance with legal obligations: Oasis Project has a legal duty to share information with other agencies where there is a legitimate safeguarding risk or to prevent a serious crime.
If you do not want Oasis Project to use your personal data for the above-mentioned purposes, you can make use of your right of objection as detailed below.
What rights do you have with respect to your personal data?
As a service user at Oasis Project, you have a number of rights with regards to data we hold about you:
- You have the right to access your personal data. You can therefore request to see data we hold on you. Please see our policy on this.
- You have the right to correct your personal data if it has been processed incorrectly or incompletely.
- You have the right to object to the processing of your personal data. Where possible we will endeavour to continue to offer you a service but it may be that we decide we cannot without certain information about you. A manager from one of our services can discuss this with you.
- You have the right to ask us to erase your personal data so that we have no record of you. Please see our policy on this.
If you wish to make use of any of the above-mentioned rights, you may inform us by any means, though for clarity it would be helpful if you complete the following Data Request form.
With whom do we share your personal data?
We will share data with supporting organisations that you identify as being helpful to you. You may decide there are organisations you do not want us to share personal data with. This is something we will regularly check-in with about you and we will never share without your prior knowledge.
We do not share data about you with other services users.
We do not share data about you with members of the public.
On some occasions Oasis Project will need to share personal data about you for the purposes of safeguarding or preventing a crime. In most cases we will do this in partnership with you.
Oasis Project ensures that data is shared with the utmost care using secure systems.
How long do we store your personal data?
Each service in Oasis Project will have different rules around storage, depending on the service offered and the duration of that service. As a baseline, Oasis Project retains data for 5 years after you have stopped receiving a service.How safe is your data at Oasis Project?
Each Service takes suitable technical and administrative measures to protect your personal data against loss and against any form of unlawful processing. We store your personal data on servers in a secure environment that provides protection against unlawful access, publication and use of the data by unauthorised persons inside or outside the organisation.
Paper-based recording is kept to a minimum and paper forms are usually scanned onto a secure system.
All Oasis Staff are trained in Data Protection, and Privacy By Design ensures that Data Security is considered at the beginning of all project developments.
Oasis Project has a Senior Information Risk Advisor sitting on the Board of Trustees with overall responsibility for data security.
Do you have questions about privacy within Oasis Project, or do you have a complaint?
Oasis Project operates a transparent and inclusive policy around queries and complaints. All complaints and queries will go to an appointed Data Protection Officer whose role it is to ensure the organisation is doing its utmost to care for your data.
If you feel that Oasis Project has been responsible for a Data Breach (where data has not been held safely) you may either notify us as a complaint or notify the Information Commissioner’s Office.
If Oasis Project is concerned there is a Data Breach we are obliged to notify to Information Commissioner’s Office for them to investigate.
Equalities?
As an inclusive organisation Oasis Project will seek to gather data on equalities. This data will be anonymised so that we can track levels of diversity and ensure no communities or groups of people are excluded from our services.
Modifications
We may modify this Privacy Policy from time to time and will publish the most current version on our website. If a modification meaningfully reduces your rights, we’ll notify people whose personal data we hold and is affected.
This statement was last updated August 2019.
Privacy Statement for Oasis Project Website Users
How we respect privacy when we deal with personal information collected via our website.
Please note, “we” and “us” in this statement refers to Oasis Project.
This Privacy Statement applies to the personal information we collect about individuals who visit our website. It explains what information we collect and how we use it.
If you are a service user of Oasis Project, or have made contact regarding your drug or alcohol use, the types of information we obtain about you and the ways in which that information is used is explained in our Privacy Statement for Oasis Project service users.
If you have any comments or questions about this statement, feel free to email us at info@brightonoasisproject.co.uk or write to us at 3 Globe House, Morley Street, Brighton, BN2 9RA.
Personal data that we process
We obtain personal information about you when you use our website.
If you contact us via email or phone about a job vacancy or volunteer opportunity you have seen on our website, we will read and store your message, your name and your email address so that we can respond in the way that you would expect (e.g. to send you an application pack).
If you make a donation to us via the ‘donate now’ button on our website, your name, email address and payment information is not held by us; it is collected by our third party payment processors, Charity Checkout and GoCardless. They specialise in the secure online capture and processing of credit/debit card transactions.
If you sign up to receive our newsletter, your name and email address will be collected and we will deliver you an email periodically via our third party email provider, MailChimp.
Information is automatically provided on your browsing behaviour through the use of cookies on our sites. This information does not enable us to identify you personally. However, it does allow us to track usage of our site so that we can improve it. There is more information about cookies below.
How we use your data
We will only use your data in a manner that is appropriate and in the way that you would expect. For example;
- We will reply to enquiries you send to us regarding a job vacancy or volunteer opportunity to provide you with the information you have requested and/or to send you an application pack.
- If you make a donation via Charity Checkout or GoCardless, we will send you an email to acknowledge your donation and say thank you.
- Where you have signed up to receive our newsletter, we will send you periodic communications by email relating to our work as well as Oasis Project events and opportunities which we think may be of interest to you.
When we share your data
If you have contacted us about a job vacancy, signed up to our mailing list or made an online donation, we will not share your data with another organisation or 3rd party without your prior consent.
If you are a service user of Oasis Project or have contacted regarding your drug or alcohol use, please refer to our Privacy Statement for Oasis Project service users, as there are circumstances under which we may share your data.
How long we keep your data
We take the principles of data minimisation and removal seriously and have internal policies in place to ensure that we only ever ask for the minimum amount of data for the associated purpose and delete that data promptly once it is no longer required.
Where data is collected on the basis of consent (e.g. when you sign up to our newsletter), we will seek renewal of consent at least every three years.
Rights you have over your data
You have a range of rights over your data, which include the following;
- Where data processing is based on consent, you may revoke this consent at any time and we will make it as easy as possible for you to do this (for example by putting ‘unsubscribe’ links at the bottom of all our marketing emails).
- You have the right to ask for rectification and/or deletion of your information.
- You have the right of access to your information.
- You have the right to lodge a complaint with the Information Commissioner if you feel your rights have been infringed.
A full summary of your legal rights over your data can be found on the Information Commissioner’s website here: https://ico.org.uk/
If you would like to access the rights listed above, or any other legal rights you have over your data under current legislation, please get in touch with us via email at info@brightonoasisproject.co.uk or in writing to 3 Globe House, Morley Street, Brighton, BN2 9RA.
Please note that relying on some of these rights, such as the right to deleting your data, will make it impossible for us to continue to deliver some services to you. However, where possible we will always try to allow the maximum access to your rights while continuing to deliver as many services to you as possible.
Cookies & usage tracking
A cookie is a small file of letters and numbers that is downloaded on to your computer when you visit a website. Cookies are used by many websites and can do a number of things, e.g. remembering your preferences, recording what you have put in your shopping basket, and counting the number of people looking at a website.
Where cookies are used to collect personal data, we list these purposes in section 1 above, along with other personal data that we collect. However, we also use some cookies that do not collect personal information but that do help us collect anonymous information about how people use our website. We use Google Analytics for this purpose. Google Analytics generates statistical and other information about website usage by means of cookies, which are stored on users’ computers. The information collected by Google Analytics about usage of our website is not personally identifiable. The data is collected anonymously, stored by Google and used by us to create reports about website usage. Google’s privacy policy is available at http://www.google.com/privacypolicy.html
Equality and diversity monitoring
As an inclusive organisation Oasis Project will seek to gather data on equalities. This data will be anonymised so that we can track levels of diversity and ensure no communities or groups of people are excluded from our services.
Modifications
We may modify this Privacy Policy from time to time and will publish the most current version on our website. If a modification meaningfully reduces your rights, we’ll notify people whose personal data we hold and is affected.
This statement was last updated August 2019.
Privacy Statement for Oasis Employees
How we respect privacy when we deal with employee data.
Please note, “we” and “us” in this statement refers to Oasis Project.
The wording in this document reflects the requirements of the General Data Protection Regulation (GDPR), which came into effect in the UK on 25 May 2018. Data controller: Oasis Project. This notice applies to current and former employees, workers and contractors.
If you have any comments or questions about this statement, feel free to email us at info@oasisproject.org.uk or write to us at 3 Globe House, Morley Street, Brighton BN2 9RA.
Data Protection principles
We will comply with data protection law. This says that the personal information we hold about you must be:
- Used lawfully, fairly and in a transparent way.
- Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
- Relevant to the purposes we have told you about and limited only to those purposes.
- Accurate and kept up to date.
- Kept only as long as necessary for the purposes we have told you about.
- Kept securely
The type of information we hold about you includes:
- Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
- The organisation collects and processes personal data relating to its employees to manage the employment relationship.
- The organisation is committed to being transparent about how it collects and uses that data and to meeting its data protection obligations.
- There are “special categories” of more sensitive personal data which require a higher level of protection.
Personal data that we process
We obtain personal information about you during your employment at Oasis.
- The organisation collects and processes a range of information about you. This includes:
- Your name, address and contact details, including email address and telephone number, date of birth and gender;
- the terms and conditions of your employment;
- details of your qualifications, skills, experience and employment history, including start and end dates, with previous employers and with the organisation;
- information about your remuneration, including entitlement to benefits such as pensions or insurance cover;
- details of your bank account and national insurance number;
- information about your marital status, next of kin, dependants and emergency contacts;
- information about your nationality and entitlement to work in the UK;
- details of your schedule (days of work and working hours) and attendance at work;
- details of periods of leave taken by you, including holiday, sickness absence, family leave and the reasons for the leave;
- details of any disciplinary or grievance procedures in which you have been involved, including any warnings issued to you and related correspondence;
- assessments of your performance, including appraisals, performance reviews, performance improvement plans and related correspondence;
We may also collect, store and use the following “special categories” of more sensitive personal information including:
- information about medical or health conditions, including whether or not you have a disability for which the organisation needs to make reasonable adjustments; and
- equal opportunities monitoring information, including information about your ethnic origin, sexual orientation, health and religion or belief.
Your personal information is collected via a number of methods. For example, data might be collected through application forms, CVs; obtained from your passport or other identity documents such as your driving licence; from forms completed by you at the start of or during employment (such as benefit nomination forms); from correspondence with you; or through interviews, meetings or other assessments.
In some cases, the organisation may collect personal data about you from third parties, such as references supplied by former employers and information from employment background check providers.
Data will be stored in a range of different places, including in your personnel file, in the organisation’s Payroll and HR management system, and in other IT systems (including the organisation’s email system).
Why does the organisation process personal data?
The organisation needs to process data to enter into an employment contract with you and to meet its obligations under your employment contract. For example, it needs to process your data to provide you with an employment contract, to pay you in accordance with your employment contract and to administer entitlements [benefit, pension and insurance]. In some cases, the organisation needs to process data to ensure that it is complying with its legal obligations. For example, it is required to check an employee’s entitlement to work in the UK, to deduct tax, to comply with health and safety laws and to enable employees to take periods of leave to which they are entitled:-
- where we need to protect your interests (or someone else’s interests);
- where it is needed in the public interest (or for official purposes).
In other cases, the organisation has a legitimate interest in processing personal data before, during and after the end of the employment relationship. Processing employee data allows the organisation to:
- run recruitment and promotion processes;
- maintain accurate and up-to-date employment records and contact details (including details of who to contact in the event of an emergency), and records of employee contractual and statutory rights;
- operate and keep a record of disciplinary and grievance processes, to ensure acceptable conduct within the workplace;
- operate and keep a record of employee performance and related processes, to plan for career development, and for succession planning and workforce management purposes;
- operate and keep a record of absence and absence management procedures, to allow effective workforce management and ensure that employees are receiving the pay or other benefits to which they are entitled;
- obtain occupational health advice, to ensure that it complies with duties in relation to individuals with disabilities, meet its obligations under health and safety law, and ensure that employees are receiving the pay or other benefits to which they are entitled;
- operate and keep a record of other types of leave (including maternity, paternity, adoption, parental and shared parental leave), to allow effective workforce management, to ensure that the organisation complies with duties in relation to leave entitlement, and to ensure that employees are receiving the pay or other benefits to which they are entitled;
- ensure effective general HR and business administration;
- provide references on request for current or former employees;
- respond to and defend against legal claims; and
- maintain and promote equality in the workplace.
Some special categories of personal data, such as information about health or medical conditions, is processed to carry out employment law obligations (such as those in relation to employees with disabilities).
Where the organisation processes other special categories of personal data, such as information about ethnic origin, sexual orientation, health or religion or belief, this is done for the purposes of equal opportunities monitoring. Data that the organisation uses for these purposes is anonymised. Employees are entirely free to decide whether or not to provide such data and there are no consequences of failing to do so.
If you fail to provide certain information when requested, we may not be able to perform the contract we have entered into with you (such as paying you or providing a benefit), or we may be prevented from complying with our legal obligations (such as to ensure the health and safety of our workers).
Change of purpose
We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. We may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
How long we keep your data
The organisation will hold your personal data for the duration of your employment. At the end of employment your data will not be kept longer than necessary for the purpose for which it was processed. For example, personal information of employees, including terms and conditions of employment, disciplinary records, reviews and annual leave records will be kept for 7 years after employment ends.
The organisation will keep hold of employees’ PAYE, Payroll records for 7 years after employment ends given the relevance to any pay disputes and as HMRC may request to see them in this time. Occupational Health records will be kept in a suitable form for a minimum of 40 years after the date of last entry. Further information can be found in the Companies ‘Data Protection’ policy.
Rights you have over your data
You have a range of rights over your data, which include the following:
- Where data processing is based on consent, you may revoke this consent at any time and we will make it as easy as possible for you to do this.
- You have the right to ask for rectification and/or deletion of your information.
- You have the right of access to your information.
- You have the right to lodge a complaint with the Information Commissioner if you feel your rights have been infringed.
A full summary of your legal rights over your data can be found on the Information Commissioner’s website here: https://ico.org.uk/
If you would like to access the rights listed above, or any other legal rights you have over your data under current legislation, please get in touch with us via email at info@oasisproject.org.uk or in writing to 3 Globe House, Morley Street, Brighton BN2 9RA.
Please note that relying on some of these rights, such as the right to deleting your data, will make it impossible for us to continue to deliver some services to you. However, where possible we will always try to allow the maximum access to your rights while continuing to deliver as many services to you as possible.
Duty to inform us of changes
It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your working relationship with us. Under certain circumstances, by law you have the right to:
- access and obtain a copy of your data on request;
- require the organisation to change incorrect or incomplete data;
- require the organisation to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing; and
- object to the processing of your data where the organisation is relying on its legitimate interests as the legal ground for processing.
- Request the transfer of your personal information to another party.
- If you would like to exercise any of these rights, please contact the HR department. If you believe that the organisation has not complied with your data protection rights, you can complain to the Information Commissioner.
What if you do not provide personal data?
You have some obligations under your employment contract to provide the organisation with data. In particular, you are required to report absences from work and may be required to provide information about disciplinary or other matters under the implied duty of good faith. You may also have to provide the organisation with data in order to exercise your statutory rights, such as in relation to statutory leave entitlements. Failing to provide the data may mean that you are unable to exercise your statutory rights.
Certain information, such as contact details, your right to work in the UK and payment details, have to be provided to enable the organisation to enter a contract of employment with you. If you do not provide other information, this will hinder the organisation’s ability to administer the rights and obligations arising as a result of the employment relationship efficiently.
Who has access to data?
Your information may be shared internally, including with members of the HR team (including payroll), your line manager, managers in the business area in which you work and IT staff if access to the data is necessary for performance of their roles and where required by law. The organisation shares your data with third parties in order to obtain pre-employment references from other employers and to obtain employment background checks from third-party providers. The organisation may also share your data with third parties in the context of a sale of some or all of its business. In those circumstances the data will be subject to confidentiality arrangements. The organisation also shares your data with third parties that process data on its behalf, in connection with payroll, the provision of benefits and the provision of occupational health services.
We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.
How does the organisation protect data?
The organisation takes the security of your data seriously. The organisation has internal policies and controls in place to try to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by its employees in the performance of their duties. This includes:-
- An Internet facing firewall to prevent outside penetration of the organisations network. Policies allow mail to be delivered into the mail server from a specific set of addresses (our external spam filter) but no other access is allowed. This firewall also maintains a list that prevents access to malicious sites on the WWW.
- Spam filtering. All our mail passes through a spam filter which looks for unsolicited mail, malicious software and dangerous links.
- Local firewalling. All our machines are individually protected by firewalls. This prevents problem software proliferating through the network and unauthorised access from one machine to another e.g. only the IT department can remotely connect to a Company laptop.
- Local anti-virus to prevent any malicious software getting through the firewall or spam filters or be brought in by other means. Every machine in the Company has anti-virus software installed which is constantly updated via a server on the network. This software also maintains a web blacklist to prevent access to malicious sites.
- File access controls. Access to data on the servers is controlled based on need. Management authority is required before any changes of access are made.
- Encryption. All Company emails are encrypted when the recipient supports encryption.
- Additional controls. The ERP system, HR systems, Payroll system and the document management system are also controlled as above.
- Filing cabinets. Data kept in employee’s personnel files are stored in lockable cabinets and secured in a restricted office.
- Archive room. Data kept at the end of an employee relationship is stored in a locked archive room with restricted access.
- IT Policy. This policy is to ensure that all information technology users within the organisation or its networks comply with rules and guidelines related to the security of the information stored digitally at any point in the network or within the organisations boundaries of authority.
- Social Media Policy. This policy is aimed educate employees and minimise risks when using social media which can impact the organisation and employees.
Where the organisation engages third parties to process personal data on its behalf, they do so on the basis of written instructions; these parties are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data.
Equality and diversity monitoring
As an inclusive organisation Oasis Project will seek to gather data on equalities. This data will be anonymised so that we can track levels of recruitment, promotion, training opportunities by diversity and ensure no communities or groups of people are excluded.
Modifications
We may modify this Privacy Policy from time to time and will publish the most current version on our website. If a modification meaningfully reduces your rights, we'll notify people whose personal data we hold and is affected.
This statement was last updated February 2021.
Get in touch
We’ve been doing this for over 20 years, so we really know what works. We see everyone as an individual, and make sure we can get them the right help at the right time.