Our data protection policy
Speech and Language UK is the operating name of I CAN Charity.
I CAN is committed to being transparent about how it collects and uses Personal Data and to meeting its data protection obligations. This policy sets out I CAN’s commitment and your obligations in relation to data protection, and individual rights and obligations in relation to Personal Data.
This Policy sets out how I CAN handles the Personal Data of our customers, suppliers, employees, workers, pupils and parents, and other third parties. This Policy applies to all Personal Data we process regardless of the media on which Personal Data is stored or whether it relates to past or present employees, workers, customers, clients or supplier contacts, shareholders, website users or any other Data Subject.
This Policy applies to all employees, workers, contractors, agency workers, consultants, directors and any others who process Personal Data on behalf of I CAN. Each employee must read, understand and comply with this Policy when processing Personal Data on our behalf and attend training on its requirements.
All directors, individual business areas, units, departments, manager, supervisors and other responsible parties are responsible for ensuring compliance with this Policy and need to implement appropriate practices, processes, controls and training to ensure such compliance.
I CAN has appointed Satswana as its data protection officer with responsibility to inform and advise I CAN on its data protection obligations. Questions about this policy, or requests for further information, should be directed to our data protection officer Satswana Limited, Pembroke House, St. Christopher’s Place, Farnborough, Hampshire, GU14 0NH, Tel 01252 516898 or email firstname.lastname@example.org
Failure to comply with this Policy will be regarded as serious misconduct and will be dealt with in accordance with I CAN’s disciplinary procedure.
Personal Data: any information that relates to an individual who can be directly or indirectly identified from that information. Personal Data can be factual (for example, a name, email address, location or date of birth) or an opinion about that person’s actions or behaviour, or an identification number, online identifier or location data.
Personal Data Breach: any act or omission that compromises the security, confidentiality, integrity or availability of Personal Data or the physical, technical, administrative or organisational safeguards that we or our third-party service providers put in place to protect it. The loss, or unauthorised access, disclosure or acquisition, of Personal Data is a Personal Data Breach.
Processing or Process: any activity that involves the use of Personal Data. It includes obtaining, recording or holding/storing the data, or carrying out any operation or set of operations on the data including organising, amending, retrieving, using, disclosing, erasing or destroying it. Processing also includes transmitting or transferring Personal Data to third parties.
Sensitive Personal Data: information revealing racial or ethnic origin, political opinions, religious or similar beliefs, trade union membership, physical or mental health conditions, sexual life, sexual orientation, biometric or genetic data, and Personal Data relating to criminal offences and convictions.
Data protection principles
I CAN processes personal data in accordance with the following data protection principles which require personal data to be:
- Processed lawfully, fairly and in a transparent manner
- Collected only for specified, explicit and legitimate purposes
- Processed only where it is adequate, relevant and limited to what is necessary for the purposes of processing
- Accurate and for I CAN to take all reasonable steps to ensure that inaccurate personal data is rectified or deleted without delay
- Kept only for the period necessary for the purposes of processing
- Processed in a manner that ensures its security using appropriate technical and organisational measures to protect against unauthorised or unlawful processing and against accidental loss, destruction or damage
I CAN tells individuals the reasons for processing their Personal Data, how it uses such data and the legal basis for processing in its privacy notices. It will not process Personal Data for other reasons.
I CAN will update Personal Data promptly if an individual advises that his/her information has changed or is inaccurate.
I CAN keeps full and accurate records of its processing activities in respect of personal data in accordance with the requirements of data protection legislation.
Protecting Personal Data
Personal Data must be secured by appropriate technical and organisational measures against unauthorised or unlawful processing, and against accidental loss, destruction or damage.
I CAN has developed, implemented and maintains safeguards appropriate to our size, scope and business, our available resources, the amount of personal data that we own or maintain on behalf of others and identified risks (including use of encryption and pseudonymisation where applicable). In particular we have devised specific processes to ensure the safeguarding of data relating to children (Please refer to the Safeguarding Policy for I CAN and/or the schools, as appropriate.
We will regularly evaluate and test the effectiveness of those safeguards to ensure security of our processing of personal data.
All employees are responsible for protecting the personal data we hold and must implement reasonable and appropriate security measures against unlawful or unauthorised processing of personal data and against the accidental loss of, or damage to, personal data. All employees must exercise particular care in protecting sensitive personal data from loss and unauthorised access, use or disclosure. All employees must comply with all security arrangements in place including information technology, such as password-protected files and screen savers, as set out in our IT Policy and other organisational arrangements including locks for drawers and filing cabinets and restricted access arrangements.
When personal data is destroyed this must be in accordance with secure destruction arrangements. Personal data must not be thrown into general rubbish bins. Particular care must be taken where it is necessary to take information away from I CAN’s premises. You should protect against accidental disclosure such as, for example, someone near to you being able to read information over your shoulder.
Never disclose personal data to other employees or a third party either orally or in writing without the prior consent of your Manager and until all appropriate checks and contractual arrangements have been made.
Individuals who have access to personal data are required:
- to access only personal data that they have authority to access and only for authorised purposes necessary for the performance of their role
- not to disclose personal data except to individuals (whether inside or outside I CAN) who have appropriate authorisation
- to keep personal data secure (for example by complying with rules on access to premises, computer access, including password protection, and secure file storage and destruction)
- not to remove personal data, or devices containing or that can be used to access personal data, from I CAN’s premises without adopting appropriate security measures (such as encryption or password protection) to secure the personal data and the device
- not to store personal data on local drives or on personal devices that are used for work purposes
Reporting a Personal Data Breach
Data protection law requires I CAN to notify any personal data breach to the applicable regulator within 72 hours and, in certain instances, the individual.
If you know or suspect that a personal data breach has occurred, do not attempt to investigate the matter yourself. Immediately contact the Director of Corporate Services. If you are in a school, you must copy this to the School Principal or the Director of Education. You should preserve all evidence relating to the potential personal data breach. Failure to do this may result in disciplinary action.
Individuals have a number of rights in relation to their Personal Data.
Subject access requests
Individuals have the right to make a subject access request. If an individual makes a subject access request, I CAN will tell him/her:
- whether or not his/her personal data is processed and if so why, the categories of Personal Data concerned and the source of the personal data if it is not collected from the individual;
- to whom his/her personal data is or may be disclosed, including to recipients located outside the European Economic Area (EEA) and the safeguards that apply to such transfers;
- for how long his/her personal data is stored (or how that period is decided);
- his/her rights to rectification or erasure of personal data, or to restrict or object to processing;
- his/her right to complain to the Information Commissioner if he/she thinks I CAN has failed to comply with his/her data protection rights; and
- whether or not I CAN carries out automated decision-making and the logic involved in any such decision-making.
I CAN will also provide the individual with a copy of the personal data undergoing processing. This will normally be in electronic form if the individual has made a request electronically, unless he/she agrees otherwise.
If the individual wants additional copies, I CAN will charge a fee, which will be based on the administrative cost to I CAN of providing the additional copies.
To make a subject access request, the individual should send the request to our data protection officer Satswana Limited, Pembroke House, St. Christopher’s Place, Farnborough, Hampshire, GU14 0NH, Tel 01252 516898 or email email@example.com. In some cases, I CAN may need to ask for proof of identification before the request can be processed. I CAN will inform the individual if it needs to verify his/her identity and the documents it requires.
I CAN will normally respond to a request within a period of one month from the date it is received. In some cases, such as where I CAN processes large amounts of the individual’s data, it may respond within three months of the date the request is received. I CAN will write to the individual within one month of receiving the original request to tell him/her if this is the case.
If a subject access request is manifestly unfounded or excessive, I CAN is not obliged to comply with it. Alternatively, I CAN can agree to respond but will charge a fee, which will be based on the administrative cost of responding to the request. A subject access request is likely to be manifestly unfounded or excessive where it repeats a request to which I CAN has already responded. If an individual submits a request that is unfounded or excessive, I CAN will notify him/her that this is the case and whether or not it will respond to it.
Individuals have a number of other rights in relation to their Personal Data. Under certain circumstances they can require I CAN to:
- rectify inaccurate data;
- stop processing or erase data that is no longer necessary for the purposes of processing;
- stop processing or erase data if the individual’s interests override I CAN’s legitimate grounds for processing data (where I CAN relies on its legitimate interests as a reason for processing data);
- stop processing or erase data if processing is unlawful; and
- stop processing data for a period if data is inaccurate or if there is a dispute about whether or not the individual’s interests override I CAN’s legitimate grounds for processing data
- transfer personal data to another party where processing is carried out by automated means.
To find out more about these rights, to exercise any of these rights, or if there are any questions or concerns about data protection at I CAN, individuals should contact our data protection officer Satswana Limited, Pembroke House, St. Christopher’s Place, Farnborough, Hampshire, GU14 0NH, Tel 01252 516898 or email firstname.lastname@example.org
Training and audit
I CAN will provide training to all individuals about their data protection responsibilities as part of the induction process and at regular intervals thereafter.
Individuals whose roles require regular access to personal data, or who are responsible for implementing this policy or responding to subject access requests under this policy, will receive additional training to help them understand their duties and how to comply with them.
We will regularly review all the systems and processes in place to ensure proper use and protection of personal data.