Welcome to Community Alcohol Partnerships

The General Data Protection Regulation (GDPR) means that there are significant changes to requirements in the laws governing the way we manage your personal data. This is a high priority for CAP.

This privacy notice explains how we will process your personal information. It explains how we will protect your information and personal data, and the controls and safeguards we provide for this data. This includes understanding, at all times, precisely what data we are storing for and about you, who (if anyone) can see that data, and whether you give permission for that data to be shared with third-parties.

The processing of personal data, such as the name, address, e-mail address, or telephone number will always be in accordance with the General Data Protection Regulation (GDPR) and the Privacy and Electronic Communication Regulations (PECR).

By means of this privacy statement, we offset the nature, scope, and purpose of the personal data we collect, use and process. Furthermore, data subjects are informed of their rights by means of this privacy statement.

Topics

1. Who we are?

2. The information we collect about you, why we need it and who it’s shared with?

· Website Users

· Funders and supporters

· Prospective Funder

. CAP Coordinators 

· Complainants and enquirers

· Suppliers, contractors, consultants, service providers

· Employees

· Applicants

3. Your privacy rights explained

4. Changes to our privacy policy

5. How to contact us or make a complaint

 

1. Who we are

Community Alcohol Partnerships (CAP) is a Community Interest Company (CiC) whose aim is to prevent underage drinking and encourage responsible drinking among young adults. A combination of education, enforcement, education, engagement of the community and local businesses, and provision of appropriate positive activity for young people are integral parts of the CAP model. All our projects are run as locally managed multi agency partnership programmes with a clear role for alcohol retailers and licensees.

The single most important function of CAP is that it is a catalyst for effective local partnership work to reduce alcohol harm. We bring together a range of local stakeholders with a shared interest in preventing underage drinking and encouraging responsible drinking among young adults. Local partners, including retailers, must be willing to work in partnership to achieve objectives linked to reduction of underage drinking and associated harms. CAP partners vary but will typically include police, trading standards, relevant local authority departments such as public health, licensing, community engagement and youth services, schools, local charities, housing associations, resident associations and alcohol retailers/licensees.

Each local partnership identifies its own priorities (these might include reducing alcohol related anti-social behavior, alcohol litter, proxy purchase, sales to under 18s, parents supplying children with alcohol, vulnerability of children or young adults and/ or safeguarding of children from Child Sexual Exploitation where alcohol is a factor.)

Every scheme then carries out a baseline evaluation using a clear and easy to use evaluation framework linked to their chosen objectives.

Only then will partners proceed to launch the CAP and implement an action plan. The action plan is reviewed regularly (monthly for at least a year to 18 months) and key partners take responsibility for carrying out agreed actions.

At an early stage, every scheme will appoint a co-ordinator who agrees to chair meetings and lead the partnership – this role is commonly taken on by someone in police, trading standards or public health but could be performed by any partner and can be shared between two or more partners. CAP assigns a regional adviser to mentor and guide but it is important that ownership of the project lies with local partners.

After 12 -18 months, or when the action plan has been delivered, a further post-intervention evaluation using the CAP evaluation framework takes place to measure progress against key objectives.

After that, all CAPs are encouraged to join our CAP+ programme in which partners continue to meet regularly though less frequently and certain actions and evaluations continue to ensure that progress is maintained.

 

2. The information we collect about you, why we need it and who it’s shared with

· The information that we collect will only be used lawfully (in accordance with the Data Protection Act 1998 and the General Data Protection Regulation 2018).

· Unless required otherwise by law, your personal information will never be shared with any third party, other than other organisations and individuals who perform functions on our behalf or in partnership with us. These third parties are provided with personal information necessary to perform the task and may not use it for any other purpose

· To prevent unauthorised access to your information, we have put in place physical, electronic and managerial procedures to safeguard and secure the information we collect.

· We want to respect your wishes about how, and if, you are contacted - whether by post, by phone or by email. You may tell us you do not wish to be contacted at all.

 

Website Users

Basis of processing: legitimate interest

The CAP website does not collect personal data from you when you browse it although we do use Google Analytics to understand how the website is being used and how, or from where, people arrived at our website. This is collected using cookies. Cookies are text files placed on your computer to collect standard internet log information and visitor behaviour information. The cookies we use do not contain any personal information that can be used to identify you. You can configure your browser so that cookies are not used automatically but in a few cases, some of our website features may not function as a result.

We will collect personal data in the following cases:

· If you sign in to our ‘log in’ area, we log the date of signing in against your user id. We can also keep track of what documents are downloaded and viewed. Passwords are encrypted. Communication is over Hypertext Transfer Protocol (HTTP).

We do not share your details with any 3rd parties.

4. Our website includes links to other sites which may be of interest to you. This privacy policy only applies to the CAP website. We cannot and have not reviewed the sites linked to our site and cannot be held liable for their content. Users link to, and use, other sites at their own risk. As the internet uses an open system we cannot warrant that the site and downloads reach you virus-free. You must, therefore, take all appropriate precautions for your own safety

The legal basis for processing your data under this heading is 'legitimate interest'.

 

Funders and supporters

Basis of processing: legitimate interest

1. We collect business contact details when a business becomes a CAP funder. These contact details may include, but are not limited to, the business name and trading name, address, website address, telephone numbers, registered company number and VAT number (where applicable).

2. When a business becomes a CAP funder we also collect details of named contacts nominated by and within the business. This will include, but may not be limited to, a person’s name, work email address, work contact number(S) and job title.

3. We want to respect your wishes about how, and if, you are contacted. We record details of which mailing lists you are included in, newsletters you’ve requested to receive, along with other stakeholder benefits. You may also tell us you do not wish to be contacted at all, and we will respect your wishes.

All the information we collect is kept confidential and is processed to deliver our funder benefits and any other requests received, along with providing you with funder benefits and other information the CAP considers appropriate and relevant to your business. We only share your data with select 3rd parties as listed below.

Mailchimp – to provide our email mailing service. The information uploaded includes your name, email address, job title and organisation. Data uploaded to Mailchimp is updated at least fortnightly. Mailchimp are certified to the EU - U.S Privacy Shield Framework and the Swiss - U.S Priacy Shield Framework. Personal data entered into Mailchimp may be transferred from the EU to Mailchimp in the U.S. Mailchimp abides by the current GDPR regulations and their servers are in the EU. 

We do not share your data with other 3rd party services – Eventbrite; Survey Monkey. Data submitted via these service providers is submitted by you and falls under their relevant privacy statements.

· The legal basis for processing your data under this head is ‘legitimate interest’, so that we can send you information that we consider may benefit you as a funder or be of interest to you or the business.

· We update our funder contact details every 12 months. If a business ceases to fund CAP, this status will be reflected in the CAP funder list immediately. Any personal data held on staff contacts will be deleted immediately. If a business continues to fund CAP, but a staff contact leaves, their business contact details will be deleted immediately or as soon as CAP is informed. Failing that, they will be held for a maximum period of 12 months, after which point they will be deleted.

· After a company ceases to fund CAP we will keep data on that business indefinitely. Personal contact details for staff within that business will be deleted immediately, however we will keep a copy of the original agreement to fund CAP for a period of 6 years. This agreement will contain the main and invoice contacts at the time of commencing funding CAP, their email address, and telephone number and the applicant’s signature. After 6 years, we will keep the business name, joining and leaving date, and reason for leaving but destroy the funding agreement.

· Whilst in funding we want to ensure that your data is accurate and up to date, and that it reflects your preferences. To do this, we will normally contact the business not less than every 12 months, though this may be sooner if we believe that your data may have changed.

· We do not use your personal data for any automated decision making.

 

Prospective Funders

Basis of processing: legitimate interest

1. Prospective funders refer to businesses who are not currently funders of CAP and who CAP consider would benefit from funding CAP or at least knowing more information about the CAP.

2. We collect data about prospective funders when you register for an event, when you provide feedback to us and when you contact us for information and/or advice.

3. We gather information on prospective funders from various sources such as articles that we read, internet searches, coming across them ‘organically’ i.e. a search that leads to other searches, as a result of recommendations from current CAP funders and/or by attendance at CAP and non-CAP events and training courses.

4. The personal data we hold/collect may include, but not be limited to, your name, job title, company details, email address, phone number and mobile phone number.

5. We do not share non-funder details with any 3rd parties.

· The legal basis for processing your data is 'legitimate interest’, to respond to requests for advice and/or information and to provide you with information that we feel may benefit you by becoming a funder of CAP or be of interest to you or your business.

· We do not use any personal data of staff for automated decision making or profiling.

 

CAP Coordinators

Basis of processing: legitimate interest

We collect business contact details when an organisation becomes a coordinator of a local CAP. These contact details may include, but are not limited to, the name of the organisation and trading name (where applicable), address, website address, telephone numbers, registered company number and VAT number (where applicable).When an organisation becomes a coordinator of a CAP we also collect details of named contacts nominated by and within the organisation. This will include, but may not be limited to, a person’s name, work email address, work contact number(S) and job title.We want to respect your wishes about how, and if, you are contacted. We record details of which mailing lists you are included in, newsletters you’ve requested to receive, along with other stakeholder benefits. You may also tell us you do not wish to be contacted at all, and we will respect your wishes.All the information we collect is kept confidential and is processed to deliver our CAP coordinator benefits and any other requests received, along with providing you with benefits and other information the CAP considers appropriate and relevant to your organisation. We only share your data with select 3rd parties as listed below.

Mailchimp – to provide our email mailing service. The information uploaded includes your name, email address, job title and organisation. Data uploaded to Mailchimp is updated at least fortnightly. Mailchimp abides by the current GDPR regulations and their servers are in the UK.

CAP Database - hosted by Corporate Interactive Technology Ltd to keep up to date contacts details of CAP coordinators. The information uploaded includes your name, email address and telephone number. Corporate Interactive abides by the current GDPR regulations and their data is stored in the UK.

We do not share your data with other 3rd party services – Eventbrite; Survey Monkey. Data submitted via these service providers is submitted by you and falls under their relevant privacy statements.

 

Complainants and enquirers

Basis of processing: legitimate interest

1. We collect data about you when you register for an event, when you provide feedback to us and when you contact us for information and/or advice or to make a complaint.

2. The personal data we hold/collect may include, but not be limited to, your name, email address, phone number and mobile phone number.

3. We do not share your details with any 3rd parties.

· The legal basis for processing your data is 'legitimate interest’, to respond to requests for advice and/or information and/or to respond to your complaint and/or to provide you with any other information requested by you.

· We will keep data indefinitely. We want to make sure that your personal data is accurate and up to date. You may ask us to correct or remove information you think is inaccurate.

· We do not use any personal data for automated decision making or profiling.

Suppliers, contractors, consultants, service providers

Basis of processing: contract and legitimate interest

1. We hold information about suppliers, contractors, consultants and service providers to enable us to employ your services or offer them to CAP partners.

2. The personal data we hold may include, but not be limited to, your name, job title, email address, phone number, mobile phone number and bank details.

3. We will hold your personal data for 6 years after your last invoice to us, after which time we will either delete it or keep it if you have asked us to.

4. The information is only disclosed to employees of CAP and contracted processors e.g. processing BACS transfers, sending postal mail and emails.

· The legal basis for processing your data is ‘contract’ while we are your customer or ‘legitimate interest’ where you are offering services to CAP partners but have no direct contract with CAP. When you are no longer an active supplier, the legal basis for processing your data is ‘legitimate interest’ because we may want to employ your services again.

· We do not use your personal data for any automated decision making or profiling.

 

Employees, their families and dependents

Basis of processing: contract, consent and legitimate interest

1. We hold information about employees of CAP to enable us to employ, pay and manage your work. We also hold information about your next of kin in case of emergencies and about your family and dependents in relation to optional employee benefits.

2. While you work at CAP we hold information about your recruitment, about training and development, and about your performance. We keep information about any disciplinary proceedings.

3. Next of kin information and information about your family and dependents is destroyed when you stop working for CAP. Other records are held for longer, including the dates of your employment so that we can provide references.

4. This information is not normally disclosed to anyone except the Chief Executive and the Head of Corporate Services.

5. In case of a dispute, or for legal purposes, we may need to disclose this information to the authorities or to other legal professionals.

· The legal basis for processing your data is 'contract' whilst you are an employee, sometimes 'legal requirement' in case of certain records, such as payroll. Where we hold next of kin and family and dependent information, it is based on 'consent'. The legal basis for storing your data after your employment has ceased is ‘legitimate interest’.

· We do not use your personal data for any automated decision making or profiling.

 

Applicants

Basis of processing: legitimate interest

1. As part of any recruitment process, CAP collects and processes personal data relating to job applicants.

2. CAP collects a range of information about you. This includes your name, address and contact details, including email address and telephone number; details of your qualifications, skills, experience and employment history; information about your current level of remuneration, including benefit entitlements; whether or not you have a disability for which CAP needs to make reasonable adjustments during the recruitment process; and information about your entitlement to work in the UK.

3. CAP collects this information in a variety of ways. For example, data might be contained in application forms, CVs or resumes, obtained from your passport or other identity documents, or collected through interviews or other forms of assessment. CAP may also collect personal data about you from third parties, such as references supplied by former employers. CAP will seek information from third parties only once a job offer to you has been made and will inform you that it is doing so.

4. Data will be stored in a range of different places, including on your application record, in HR management systems and on other IT systems (including email).

5. The information is not normally disclosed to anyone except those on the hiring panel and the Head of Corporate Services.

6. In case of a dispute, or for legal purposes, we may need to disclose this information to the authorities or to other legal professionals.

7. For unsuccessful candidates, we retain application data for up to 6 months after the recruitment exercise.

· The legal basis for processing your data is ‘legitimate interest’. CAP has a legitimate interest in processing personal data during the recruitment process and for keeping records of the process. Processing data from job applicants allows CAP to manage the recruitment process, assess and confirm a candidate's suitability for employment and decide to whom to offer a job. CAP may also need to process data from job applicants to respond to and defend against legal claims.

· We do not use your personal data for any automated decision making or profiling.

Children and young people 

Basis of processing: Legitimate interest 

CAP is an accredited centre for the RSPH Young Health Champion framework. CAP Adviser Matthew Knight is the guardian for all resources and the only person within CAP to have access to the RSPH Centre Area.

As a centre, CAP is required by the RSPH to keep the following documents stored securely for up to three years - this information is kept and accessed only by Matthew Knight:

  • Learner records Information relating to any appeals
  • Information relating to reasonable adjustment and special considerations
  • Paperwork relating to internally verified assessments (if applicable)
  • Evidence that used examination papers have been securely destroyed
  • Information relating to malpractice allegations
  • Examiner and invigilator CVs
  •  Examination seating plans

Each school or organisation that leads on the qualification must complete a registration form that contains personal details on candidates including their name, date of birth and ethnicity. This information along with the information required to be kept by the RSPH is stored securely by Matthew Knight in a password protected area on his computer that is not accessed by anyone else inside of CAP. The information is stored for up to five years in case there are any queries or if a student is needed to be traced in the future.

Matthew has access to RSPH Centre Area, who have confirmed that they are GDPR compliant. Any candidate results are sent through via the Centre Area only and any personal data sent to them is done so only through password protected documents.

The information collected will not be used for any other purposes than that laid out in this document.

 

3. Your privacy rights explained

At any point while we are in possession of or processing your personal data, you, the data subject, have the following rights:

· Right of access – you have the right to request a copy of the information that we hold about you free of charge.

· Right of rectification – you have a right to correct data that we hold about you that is inaccurate or incomplete.

· Right to be forgotten – in certain circumstances you can ask for the data we hold about you to be erased from our records.

· Right to restriction of processing – where certain conditions apply, to have a right to restrict the processing.

· Right of portability – you have the right to have the data we hold about you transferred to another organisation.

· Right to object – you have the right to object to certain types of processing such as direct marketing.

· Right to object to automated processing, including profiling – you also have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or that significantly affects you.

· Right to judicial review – if CAP refuses your request under rights of access, we will provide you with a reason as to why. You have the right to make a complaint as outlined below.

All of the above requests will be forwarded on should there be a third party involved in the processing of your personal data.

4. Changes to our privacy policy

We keep our privacy policy under regular review and we will place any updates on this web page. This privacy policy was last updated on 14th May 2018.

5. How to contact us about your rights or make a complaint

If you wish to exercise your rights or make a complaint about how your personal data is being processed by CAP (or third parties above) you should contact CAP in the first instance. If you wish to complain about CAP’s processing of your data, or how your complaint has been handled, you have the right to lodge a complaint directly with the ICO and CAP’s data protection representative:

CAP

[email protected]

International Wine & Spirit Centre,

39-45 Bermondsey Street,

London,

SE1 3XF

Tel: +44 (0) 20 7089 3861

Information Commissioner’s Office

www.ico.org.uk

Information Commissioner's Office,
Wycliffe House,
Water Lane,
Wilmslow,
Cheshire,
SK9 5AF

Tel: 0303 123 1113 (local rate) or 01625 545 745 (national rate)

The Reading Community Alcohol Partnership is clearly very active around the town and it’s good to hear that its multi-agency approach is aiming to tackle underage drinking through direct engagement with young people, enforcing the law with regard to underage consumption and proxy purchasing, and maintaining a constructive dialogue with businesses and retailers.

Rob Wilson MP
Reading East