Introduction

Only A Pavement Away respects your privacy and is committed to protecting your personal data. This privacy policy is to inform you how we collect, store and use your personal data and tell you about your privacy rights and how the law protects you.

This privacy policy is provided in a layered format so you can click through to the specific areas set out below.

If you are a child or young person, please look at the children and young people section below.

1. IMPORTANT INFORMATION AND WHO WE ARE
2. THE DATA WE COLLECT ABOUT YOU
3. HOW WE COLLECT AND OTHERWISE PROCESS YOUR PERSONAL DATA
4. DISCLOSURES OF YOUR PERSONAL DATA
5. INTERNATIONAL TRANSFERS
6. DATA SECURITY
7. DATA RETENTION
8. YOUR LEGAL RIGHTS
9. CHILDREN AND YOUNG PEOPLE

1) Important information and who we are

Purpose of this privacy policy
This privacy policy aims to give you information on how Only A Pavement Away collects and processes your personal data when you (i) contact us, (ii) work with us on, or make use of, our employment programme, (iii) make a donation, (iv) sign up to an event, (v) purchase a product from our online shop or (vi) sign up to our newsletter.

It is important that you read this privacy policy together with any other privacy policy or fair processing notice we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data.

Controller
Only A Pavement Away CIO (company number CE013890; charity number 1178082) is the controller and responsible for your personal data (referred to as “Charity”, "we", "us" or "our" in this privacy policy).

If you have any questions about this privacy policy, including any requests to exercise your legal rights, please contact us using the details set out below.

Third-party links
Our website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.

2) The data we collect about you

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

• Identity Data includes first name, last name, username or similar identifier, title, date of birth and gender.
• Contact Data includes postal address, email address and telephone numbers.
• Employment Data includes information about your education and qualifications, work history and recruitment information (including confirmation of right to work documentation, references and other information provided as part of the application process).
• Transaction Data includes details about payments to and from you, details of your tax payer status for GiftAid purposes and other details of products you have purchased from us or donations you have made to us.
• Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access our website.
• Account Data includes your username and password, your account settings and activity and any feedback you provide.
• Usage Data includes information about how you use our website, products and services.
• Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.

We may also collect, store and use the following more Sensitive Data:

• Information about your health, including any medical condition or disability.
• Information about your nationality.
• Information about unspent criminal convictions and offences (in accordance with the terms and conditions of our applications process).

We may also collect, use and share Aggregated Data such as statistical or demographic data for statistical analysis and research purposes. Aggregated Data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy policy.

If you fail to provide personal data
Where we need to collect personal data by law, or for the purposes of a contract with you, and you fail to provide that data when requested, it may not be possible to perform the contract with you or for you to enter into it (for example, to sell you goods from our online shop or offer you support). In this case, we may be unable to proceed, but we will notify you if this is the case at the time.

3) How we collect and otherwise process your personal data

3.1) When you contact us

There are numerous ways that you can contact us if you have an enquiry or want to provide feedback:

• By email: We will collect your Identity and Contact Data and any additional personal data that you choose to provide.
• Via the “Contact Us” page on our website: We will collect your Identity and Contact Data and any personal data that you include within your written enquiry.
• Via online media channels: The Charity maintains profiles on various media platforms, including Twitter, Facebook, LinkedIn, Instagram and YouTube. You can interact with us through these platforms, for example, by commenting on any information that we post. Links to our social media profiles can be found on our website. When you contact us in this way, we will collect your Identity Data and any other personal data that you choose to provide through your social media account settings.

We will use the data we receive to review, investigate and respond to any comment or question that you submit to us.
In such instances, our legal basis for processing your personal data is that it is necessary for our legitimate interests in operating the Charity.

3.2) When you work with us on our employment programme (non-participant)

If you are a representative of a charity or hospitality employer working with us on our employment programme, we will collect your Identity, Account and Contact Data.

We will use this data to work alongside you to:

• Help the candidates you support find vacancies (if you are a charity partner) or help you fill vacancies you wish to fill (if you are a hospitality employer partner);
• Provide online training to candidates; and
• Provide ongoing support to candidates who are successfully placed in a role.

We may also use this information in order to improve current and future delivery of our employment programme.
In such instances, our legal basis for processing your personal data is that it is necessary for our legitimate interests in operating the Charity.

3.3) When you use our employment programme (as a participant)

If you are receiving training or support services from us in connection with our employment programme, or if someone else has registered you as a candidate on our jobs board, we will collect your Identity, Contact, Account and Employment Data and, in some cases, Sensitive Data.

We will use this data to help you find work (including assessing your suitability and eligibility for work), provide you with online training and provide you with ongoing support if you are successfully placed in a role. We may also use this information in order to improve current and future delivery of our employment programme.

In such instances, our legal basis for processing your personal data is that it is necessary for our legitimate interests in operating the Charity. We will only process Sensitive Data about you in the course of our legitimate activities, with appropriate safeguards, or with your explicit consent, which can be withdrawn at any time. Should we need to share any of this data with third parties, we will only do so where there is a service need to do so, once we have obtained your consent unless there is a legal requirement to do so, to comply with the law or a court order, where there is a clear safety risk to you or someone else or (in exceptional circumstances) in order to establish, exercise or defend legal claims.  

3.4) When you make a donation

If you make a donation to us, whether online via JustGiving or directly (for instance, when you make a donation to us via online banking/ bank transfer or when you send us a cheque), we will collect your Identity, Contact, Transaction and Marketing and Communications Data and any additional personal data that you choose to provide through your “message of support”. We will not collect your bank account or payment card details (“Financial Data”). This will be collected and processed by JustGiving or your bank, as applicable. Please refer to the relevant third party’s privacy policy for further information on how your personal data is processed by them.

We will use this data to administer your donation, claim Gift Aid and manage our relationship with you.

In such instances, our legal basis for processing your personal data is that it is necessary for our legitimate interests in funding and operating the Charity or to comply with our legal obligations (for example, to process a Gift Aid declaration or carry out required due diligence on large donations).

3.5) When you sign up to an event

If you sign up to take part in one of our or our partners’ events, we will collect the personal data that you provide to us in the application form. Depending on the event, this is likely to include your Identity, Contact and Marketing and Communications Data and, in some cases, may include Sensitive Data.

If there is a fee or fundraising requirement for the event, we will also collect your Transaction Data. We will not collect your Financial Data. Who the payment or donation is being made to (i.e. to us or to our partner) and how it is being made (i.e. online via a payment processing partner, directly to us or the relevant partner) will determine who collects and processes your Financial Data. This may be the relevant partner, the payment processing partner appointed by us or the relevant partner or your bank. Please refer to the relevant third party’s privacy policy for further information on how your personal data is processed by them.

We will use this data to process your registration, organise the event and administer our relationship with you.

In such instances, our legal basis for processing your personal data is that it is necessary for our legitimate interests in funding and operating the Charity. We will only collect Sensitive Data about you where there is a clear reason for doing so, such as participation in a run or walk or similar fundraising event, or where we need to ensure we provide the appropriate facilities or support to enable you to participate in an event. Our legal basis for processing your Sensitive Data for this purpose is explicit consent.

3.6) When you shop with us

If you purchase an item from our online shop, we will collect your Identity, Contact, Transaction and Marketing and Communications Data.

We will use this data to process your order and to administer our relationship with you.

In such instances, our legal basis for processing your personal data is that it is necessary for entering into a contract or for the performance of a contract which we have entered into with you.

We will not collect your Financial Data. This will be collected and processed by our payments provider, Shopify. Please refer to Shopify’s privacy policy for further information on how your personal data is processed by them.

3.7) When you sign up for our newsletter

If you sign up for our newsletter via our website, or otherwise agree to receive updates on our work, we will collect your Contact Data. Following this, we will send you the newsletter and information about any events or opportunities that we think might be of interest to you.
Our legal basis for communicating with you is that you have provided your consent to the receipt of these communications from us.

Cookies
As you interact with our website, we will automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies and other similar technologies. Please see our cookie policy or further details.

Change of purpose
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

4) Disclosures of your personal data

We may share your personal data with selected third parties who provide a service to us or work with us, we owe reporting requirements to, or where otherwise required or permitted by law.

We may share your personal data with the parties set out below for the purposes set out in how we collect and process your personal data above.

• Service providers, including IT and data hosting providers, payment processors and analytics and search engine providers.
• Professional advisers including lawyers, bankers, auditors and insurers who provide consultancy, banking, legal, insurance and accounting services.
• The hospitality employers and charities that we work with to provide our employment programme.
• HM Revenue & Customs, regulators and other authorities who require reporting of processing activities in certain circumstances.
• Third parties to whom we may choose to transfer or merge parts of the Charity or our assets. Alternatively, we may seek to merge with other charities. If a change happens to our Charity, then the new trustees may use your personal data in the same way as set out in this privacy policy.

5) International transfers

We do not transfer your personal data outside the UK.

6) Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a legitimate need to know. Where they are our processors, they may only process your personal data on our instructions and they are subject to a duty of confidentiality. Where they are controllers in their own right, they will be subject to their own data protection obligations.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

7) Data retention

How long will you use my personal data for?
We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

In some circumstances you can ask us to delete your data: see your legal rights below for further information.

In some circumstances we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

8) Your legal rights

Under certain circumstances, you have rights under data protection laws in relation to your personal data.

You have the right to:

• Request access to your personal data (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
• Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
• Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
• Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. In some cases, we may be able to demonstrate compelling legitimate grounds to continue to process your information. You also have the right to object where we are processing your personal data for direct marketing purposes.
• Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios:
• If you want us to establish the data's accuracy.
• Where our use of the data is unlawful but you do not want us to erase it.
• Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims.
• You have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
• Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
• Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

If you wish to exercise any of the rights set out above, please contact us.

No fee usually required
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

What we may need from you
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. To assist with our response, we may also contact you to ask you for further information in relation to your request.

Time limit to respond
We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Contact details
If you have any questions about this privacy policy or our privacy practices, please contact us in the following ways:

Name of legal entity: Only A Pavement Away CIO

Email address: workwithus@onlyapavementaway.co.uk 

Postal address: Wellers, 1 Vincent Square, London SW1P 2PN

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance so that we can try to resolve any issues.

Changes to the privacy policy and your duty to inform us of changes
We keep our privacy policy under regular review. This version was last updated on 12.09.2023.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

9) Children and young people

Who are we and what is a privacy policy?
We are Only A Pavement Away, a charity which helps people who are homeless - or could become homeless - to find jobs in the hospitality sector. The people we help are at a tough point in their lives.  Some of them have recently come out of the army or navy or they could be about to leave prison.  We have an employment programme to support people that also finds businesses that want to give them jobs, and we help make sure they have a place to stay while they get back on their feet.

Our privacy policy tells you what personal data we collect about you, how we use it and what you can do about it. This section of our privacy policy is designed to be read by children and young people. You might want to read it with your parents or guardians. You can also read our full privacy policy, which is set out above.

What personal data do we collect?
Personal data means information that can be used to identify you, like your name, address or picture.

The types of personal data we collect will depend on why we are collecting and processing your personal data (our ‘purpose’). To see examples of the different kinds of personal data we might collect and use about you please look at the data we collect about you section above.

How do we collect and process your personal data?
How we collect and process your personal data will depend on our purpose.

• If you get in touch with us to ask us a question or you want to find out more about the work we do and how you can support us, we might ask you to give us your name and contact details so that we can reply to your question or send you more information. We will collect this personal data from you (or your parent/guardian). We may ask for your (or your parent/guardian’s) permission (or, ‘consent’) to process the data or we may be able to rely on our legitimate interests to process it.
• If you sign up for one of our fundraising events, we might also need details about your health, including any medical condition or disability, so that we can provide appropriate adjustments and keep you safe during the event. We will collect this personal data from you (or your parent/guardian). As this is sensitive data, we will need your (or your parent/guardian’s) explicit consent to process it.
• If you are signed up to our employment programme, we will need to collect a lot more of your personal data. This will include information about your education, qualifications and employment history and other sensitive data about your nationality and, if applicable, your criminal record. We will collect this personal data from your referral charity. We will rely on our legitimate interests to process your personal data and will only process sensitive data about you in the course of our legitimate activities, with appropriate safeguards, or with your (or your parent/guardian’s) explicit consent.

If you are 13-18 then you can give us consent to use your data. If you are under 13, your parent or guardian will have to provide consent. You must be at least 16 to take part in our employment programme .

Who do we share your personal data with?
We may need to share your personal data with people outside of Only A Pavement Away. This could include companies who provide a service to us (for example, IT providers or professional advisors) or the organisations we work with to provide our employment programme (for example, hospitality operators with job openings and charity organisations referring candidates for jobs). We may also share your personal data where we need to by law.

We will not transfer your personal data outside of the UK.

How long do we keep your personal data for?
We will only keep your personal data for as long as we need it to help us carry out our work, maintain records or follow the law.

Your rights
You have the same ‘rights’ over to your personal data as adults do. These include the right to:

• Ask to see the personal data we hold about you.
• Ask us to change your personal data if it’s wrong.
• Ask us to stop holding your personal data when it’s not needed anymore.
• Ask us only to use your personal data in certain ways.
• Tell us you don’t want your personal data to be processed.  

For more information about your rights please look at the your legal rights section above.

If you want to use any of your rights, please contact us using the details set out below.

Get in touch
If you have any questions about this privacy policy or about how we handle your personal data, you can send us an email (workwithus@onlyapavementaway.co.uk) or write to us at the following address: Wellers, 1 Vincent Square, London SW1P 2PN.