Privacy Policy

Last updated: 16 Apr 2024 13:19

1. Introduction.

ACC is a company limited by guarantee registered in England (company number 2791541) and a charity registered with the Charity Commission for England and Wales (register number 1018559) and the Office of the Scottish Charity Register (register number SCO39810).

We value your privacy very highly. Please read this Privacy Policy carefully before using the www.acc-uk.org Website (the "Website") operated by Association of Christians in Counselling and Linked Professions, a(n) Non-profit formed in England, with a registration number of 2791541 ("us," "we," "our") as this Privacy Policy contains important information regarding your privacy and how we may use the information we collect about you.

Your access to and use of the Website is conditional upon your acceptance of and compliance with this Privacy Policy. This Privacy Policy applies to everyone, including, but not limited to: visitors, users, and others, who wish to access or use the Website.

By accessing or using the Website, you agree to be bound by this Privacy Policy. If you disagree with any part of the Privacy Policy, then you do not have our permission to access or use the Website.

2. What information we collect and how we’ll use it.

We collect personal data so that we can operate effectively and provide you with the best possible service. The information we collect depends on the context of your interactions with us and with our website. It also depends on the choices you make, for example the functions you use and your privacy settings. You may choose not to provide certain information but if you do, and that information is necessary to provide a particular feature, then you may not be able to use that feature. We will only use your personal data where we have a valid lawful basis to do so.

The lawful bases for processing are set out in Article 6 of the UK GDPR. At least one of these must apply whenever personal data is processed:

(a) Consent: the individual has given clear consent for you to process their personal data for a specific purpose.

(b) Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract.

(c) Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations).

(d) Vital interests: the processing is necessary to protect someone’s life.

(e) Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.

(f) Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.)

The information below summarises what information we collect about you, explains how we intend to use it and what our legal basis is for using it. The information that we hold and process about you will depend upon whether you are:

“Visitor” to our website.

“Enquirer” through contact via e-mail or telephone.

“Purchaser” of services and products.

“Individual Member” - the data held will depend upon the membership category.

“Designated Contact for Affiliate Members”

“Members Referee” - some membership categories are required to provide a supervisor and Christian sponsor.

“Complainant” - an individual who has raised a concern or complaint about a member.

“Complaint Witness”

“Members of Other Bodies in Receipt of Sanctions from a Complaint Hearing”

“Service Providers”

“Marketing Contacts”

2.1 Visitor

What information will we collect about you?

Device and usage data including IP addresses and device identifiers,

Device event information including crash logs, hardware settings, browser type and browser language,

Information derived from cookies and similar technologies.

How will we collect information about you?

Automatically collected and stored in our server logs when you interact with our website, using Google analytics.

Why are we processing information about you?

To improve the user experience of our website, including to offer you tailored content, and to protect the security of our website.

To analyse the traffic to our website What is our legal basis for processing information about you?

As applicable, your consent and/or to pursue our legitimate business interests as, in particular to understand how our website is used, to improve the user experience of our website, and to maintain the security of our website.

2.2 Enquirer

What information will we collect about you?

Name, contact details, areas of enquiry.

How will we collect information about you? Provided by you.

Why are we processing information about you?

Your consent and/or in order to offer you services that may be of interest to you.

2.3 Purchaser

What information will we collect about you?

Name, contact details, payment details. Dependant on the purchase or service requested, it also may include dietary requirements, disability (for reasonable adjustment purposes) and emergency contact information.

How will we collect information about you?

Provided by you/allocated by us.

Why are we processing information about you?

To provide the product/service and to keep accounting records in-line with HMRC requirements.

What is our legal basis for processing information about you?

By consent and/or to pursue our legitimate interests, in providing services, products and information.

2.4 Individual members

What information will we collect about you?

Name, contact details, date of birth, demographic information, professional qualifications and accreditations, areas of practice, therapies offered, membership number, church membership, information provided as part of the joining, registration, accreditation and practice review processes and for the “Find A Counsellor” facility, information gathered as part of a complaint process and payment details.

Which of the details listed above are collected will depend upon the membership category that an individual does/has been a member of i.e. Registered Member, Student Member, Pastoral Care Member, etc.

How will we collect information about you?

Provided by you, allocated by us or provided by a third party as part of a joining, registration, accreditation, practice review or complaint process.

We may additionally receive or verify information by contacting relevant third parties i.e. supervisor, training provider, church leader, etc.

Why are we processing information about you?

In order for you to become and remain a member of ACC, for maintenance of our public register and to enable ACC to perform functions that members have agreed to as part of membership joining and renewal and the Terms and Conditions of Membership and the requirements of the Professional Standards Authority.

What is our legal basis for processing information about you?

By consent and/or to pursue our legitimate interests as the operator of a public register and membership body.

2.5 Designated contact for organisational members

What information will we collect about you?

If you are the designated contact of the Affiliate Member, then we will hold name and contact details.

How will we collect information about you?

Provided by you/allocated by us.

Why are we processing information about you?

In order for the organisation to become and remain an affiliated member of ACC and to enable ACC to perform functions that members have agreed to as part of membership renewal and the Terms and Conditions of Membership.

What is our legal basis for processing information about you? To pursue our legitimate interests as the operator of a public register and membership body.

2.6 Members' referees

Some membership categories are required to provide supervisor and Christian sponsor information; these are referred in this document as “members’ referees”.

What information will we collect about you?

Name, and contact details.

How will we collect information about you?

Provided by the member for whom you are a “referee”.

Why are we processing information about you?

In order to meet the requirements for ACC membership and to be able to verify details provided by the member if needed.

What is our legal basis for processing information about you?

To pursue our legitimate interests as the operator of a public register and membership body.

2.7 Complainant

A person that raises a concern or complaint about an ACC member (individual or organisation) or ACC itself will be referred to in this document as a “complainant”.

What information will we collect about you?

Name, and contact details and all information that you have provided as part of the complaint process.

How will we collect information about you?

Provided by you, your representative or others who have been asked to provide information as part of the complaint process i.e. witnesses.

Why are we processing information about you?

To enable ACC to carry out the complaint process as part of our legitimate interests as the operator of a public register and membership body.

2.8 Complaint witness

As part of ACC’s complaint process ACC or those acting on behalf of ACC in this process may need to contact and hold data for individuals acting as witnesses or providing information relating to the complaint.

What information will we collect about you?

Name, and contact details and all information that you have provided as part of the complaint process.

How will we collect information about you?

Provided by you, the complainant or the member subject to a complaint.

Why are we processing information about you?

To enable ACC to carry out the complaint process as part of our legitimate interests as the operator of a public register and membership body.

2.9 Members of other bodies in receipt of sanctions from a complaint hearing

What information will we collect about you?

Name, and the information provided by the PSA Register holder relating to complaint sanctions.

How will we collect information about you?

Provided by the relevant PSA Register holder.

What is gathered from an ACC complaints process and an outcome.[/]p

Why are we processing information about you?

To pursue our legitimate interests as the operator of a public register and membership body in accordance with PSA requirements.

2.10 Service providers

ACC will engage the services of individuals to fulfil roles within the work of ACC, for example trainers, Assessors, Complaint Panel members and investigators, etc. and will be referred to in this document as “Service Providers”.

What information will we collect about you?

Name, and contact details, bank details, qualifications, CV.

How will we collect information about you?

Provided by you.

Why are we processing information about you?

In order to ensure that service providers are qualified and suitably experienced for the role and to make payments for services.

What is our legal basis for processing information about you?

To satisfy the requirements of contracting individuals to perform roles within the scope of ACC’s work.

2.11 Marketing contacts

What information will we collect about you?

Name, contact details.

How will we collect information about you?

Provided by you.

Why are we processing information about you?

To keep you informed of future events and products and information about ACC (if permission to retain the details has been provided by you).

What is our legal basis for processing information about you?

To pursue our legitimate interests, in providing services, products and information.

3. Change of purpose

We may only use your personal data for the purposes for which we collected it, or for another reason that is compatible with the original purpose. Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

4. Sharing of information

4.1 We may share your personal data with your consent or as necessary with selected third party service providers that support us in the performance of the activities set out above.

4.2 We may also share your personal data with other third parties, for example in the context of the possible restructuring of our activities or the transfer of some of our responsibilities to another organisation. We may also need to share your personal data with a regulator or otherwise to comply pursue a complaint process or to comply with the law.

4.3 We require all our third party service providers and all other companies within our group to take appropriate security measures to protect your personal data in line with our policies. We do not allow our third party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes in accordance with our instructions.

4.4 The following third-party service providers process personal data about you for the following purposes:

Okapi Technology Ltd: processes this data to manage the installation and configuration (systems, software, networks, internet, and more); to provide IT support and solutions; and preventive maintenance. Data processed by Okapi Technology Ltd on behalf of ACC should only ever be used for ACC’s purposes as specified and authorised by ACC.

Image+ Limited: processes this data to manage the installation and configuration (systems, software, networks, internet, and more); to provide IT support and solutions; and preventive maintenance. Data processed by Image+ on behalf of ACC should only ever be used for ACC’s purposes as specified and authorised by ACC.

Opayo and Sum up: processes this data to manage payments made to ACC for services and products. Data processed by Opayo/Sum up on behalf of ACC should only ever be used for ACC’s purposes as specified and authorised by ACC.

Sage Accounting: processes this data to manage ACC accounting records.

HMRC: processes this data to enable the claiming of Gift Aid in accordance with HMRC requirements. Data processed by HMRC on behalf of ACC should only ever be used for ACC’s purposes and HMRC purposes in accordance with tax legislation.

Other: From time-to-time ACC may hold events at third party venues. ACC may be required to provide data to enable registration/bookings at these venues and to meet their health and safety requirements. Data processed by such organisations on behalf of ACC should only ever be used for the specified purpose.

5. Keeping your information secure

5.1 All information that you provide to us is stored on secure servers. We have put in place appropriate measures to protect the security of your information.

5.2 The transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of the information transmitted to our site and you acknowledge that any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access or inadvertent disclosure.

5.3 You are responsible for keeping confidential any passwords that you have to access our services, including and used to log-in to our website. Please do not share your password(s) with anyone else. If you lose control of your password, you may lose control over your personal data. If your password has been compromised for any reason, please let us know by contacting us at: office@acc-uk.org or 024 76449694.

6. Your rights

You have the right under data protection laws to:

6.1 request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it. This right is subject to a number of exemptions which allow information to be withheld in certain circumstances. For example, subject access rights are excluded where compliance would involve disclosing information relating: to another individual; data which consists of information which is subject to legal professional privilege; negotiations or confidential references;

6.2 request correction or erasure of your personal data (unless we have the legal right to retain it, please see our Retention Policy. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing (see below).

6.3 object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on these grounds. You also have the right to object where we are processing your personal data for direct marketing purposes.

6.4 request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of personal data about you, for example if you want us to establish its accuracy or the reason for processing it.

6.5 request (in limited circumstances) the transfer of your personal data to another data controller.

6.6 change your data processing preferences at any time.

If you wish to exercise any of the above rights, then you may do so by contacting us at: office@acc-uk.org or 024 76449694.

8.2 If you have a user/member account with us, you can update your account settings by signing-in to your account on the website.

8.3. you should be aware that if you ask us to stop processing your personal data in a certain way or erase your personal data, and this type of processing or data is needed to facilitate your use of the website you may not be able to use the website as you did before. Similarly, if you decline to provide personal data which is necessary in order for us to provide services to you, then we will be unable to provide those services. This does not include your right to object to direct marketing, or your right to withdraw consent for any data processing which is based solely upon your consent. These rights may be exercised at any time without restriction.

7. Cookies

A cookie is a small piece of data sent from a website and stored on your device by your browser. This Website collects cookies. Please visit our Cookie Policy to learn more about what cookies we collect, why we collect them, and how to change your cookie settings.

8. Children's privacy

This Website is intended for use by a general audience and does not offer services to children. Should a child whom we know to be under 18 send personal information to us, we will use that information only to respond to that child to inform him or her that they cannot use this Website.

9. Analytics programs

This Website uses Google Analytics to collect information about you and your behaviors. If you would like to opt out of Google Analytics, please visit https://tools.google.com/dlpage/gaoptout/.

10. Storage of information

All information will be held and processed under the UK GDPR legislation and ACC will use the following Data Retention Policy for each type of data sets. Any information that is stored in the database, on any computerised system or paper based is relevant to the purpose it was collected for. Retention of data and refusal of right to erasure Under UK GDPR an individual has the right to ask for their data to be removed (right to erasure), this data should then be removed in a timely manner if not immediately. However, there are also approved reasons when removal can be refused:

To comply with a legal obligation for the performance of a public interest task or exercise of official authority. For public health purposes in the public interest. Archiving purposes in the public interest, scientific research historical research or statistical purposes. The exercise or defence of legal claims.

This gives ACC the right to refuse a request for removal from current or previous members holding membership types that are subject to professional conduct investigations whether managed by ACC or another relevant party (e.g. a training organisation or other membership body). These include:

Register members Overseas Counsellor members Level 4 Students Counselling Affiliates Counselling and Training Affiliates Pastoral Care Sole Affiliates

Below are the retention policies relating to the groups of people and organisations for whom ACC gathers and processes data. Please see ACC's Privacy Policy for a definition of these roles.

a). Visitor

The personal data that we hold about you in our own systems will be processed and stored within the United Kingdom. Information held as you visit our website by web browsers and google analytics will be stored according to these third party's policies and processes. ACC will retain on our systems your personal data for as long as is necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting obligations. For example, we may need to retain some of your personal data for 6 years after you have made a purchase form us for legal reasons.

b). Enquirer

All information relating to an enquiry by email or telephone will generally be kept for as long as it is necessary to where it relates to running an Accredited Register of Counsellors and other professions and pastoral memberships. Examples include enquiries about joining ACC, questions from former members and concerns raised by members of the public or other third parties about a current or past member of ACC. General enquires from members of the public for assistance for example in finding a counsellor will be deleted as soon as they have been resolved.

c). Purchasers

This section sets out the timescales that ACC would keep information after each purchase of a service or product and what information will be retained.

Data relating to the purchaser will be kept for 6 years after the purchase has been made or (in the case of training events) the event has completed (whichever is the later). After this 6-year period personal data may be retained in the Marketing contacts area of the database if express permission has been given. All information apart from the marketing contacts (stored with express permission as above) will be removed after 6 years.

d) Members/designated contacts for organisational members

This lists the timescales that ACC would keep information for each of the membership types and what information will be removed on cessation of membership.

Individual Pastoral Care Members, Friends (including old Accord subscriptions), Pastoral Care Affiliated (Not Sole Affiliated), L2 Students, L3 Students, Fellows and Honorary Fellows and any other membership where complaints would not be heard.

On termination of membership all information will be kept for 6 years, this allows for any queries to be dealt with and to meet the requirements of any accounting policies. After 6 years all data held on or linked to the members record will be deleted unless the person has had an additional or linked membership which is or has been active during the six years.

This will include personal data of the Designated Contacts for Affiliate Members and personal data of the “Members Referees” e.g. supervisors, Christian sponsors.

After this 6-year period personal data for the member may be retained in the Marketing contacts area of the database if express permission has been given.

Retention Period

6 Years

e). Complaints

ACC keeps information for each complaint in line with the then current complaints policy. The complaints policy will follow these principles:

Have a clear statement for the parties and any participants, about what will be held and retained in each stage of the complaint process.

A separation of information held about a member in relation to any information that emerges from challenge/s from the courts or aggrieved clients.

What is held in the short and longer term. In the short term all records of the investigation and proceedings can

“All records will be held for a period of two years only, except for a summary of the complaint and the decision of the Panel. Complaints upheld against a member/registrant and related sanctions will be published on the website and notified to other appropriate agencies.

Complaint records will include all information gathered and recorded as part of the complaint process from:

the complainant

the member (individual or organization) against whom the complaint has been made and their representatives,

witnesses who have provided information / statements,

reports provided by investigators,

records of panel meetings

All complaint records will be kept separate from the membership record, but dates and the sanction awarded will be recorded on the electronic record. Any complaints regarding staff and volunteers of ACC will be kept in accordance with employment law or any other legislation that governs this area and will be removed in accordance with these procedures.

f). Members of other bodies in receipt of sanctions from a complaint hearing.

A protocol agreed by holders of PSA Accredited Registers means that certain sanctions imposed and removal the Register following a complaint process will be shared with all other PSA Accredited Register holders. This information will be kept indefinitely or until notified by the original provider that it should be deleted.

g). Personnel and service providers' records

This lists the timescales that ACC would keep personal/sensitive employment information and recruitment records for employees and other individual service providers contracted to ACC (i.e. trainers, assessors, complaint panel members and investigators)

Retention of employment records will conform to employment legislation.

On termination of employment all records will be kept for 12 months from termination, after this time only the following information may be kept: name, known address, employment dates to and from, No of Sick days in the 12 months prior to termination, dates of and any disciplinary action taken, NI number for payroll purposes only, final salary details, job title on termination. All information will be destroyed after six years from which employment ceased.

If there has been a dispute e.g. tribunal claim or complaint, between the ex-employee and ACC within the 12 months after termination the personnel record will be kept for two years after the procedures of the dispute have been completed.

Recruitment records for those that are unsuccessful will be kept for 1 year after the post has been advertised after this time all records will be securely destroyed by confidential waste.

Service providers Information will be retained for 6 years after the last service provision.

h). Marketing contacts

This lists the timescales that ACC would keep information for all marketing contacts that are kept on the database, on the cloud-based storage system, personal computers off site, and what information will be removed after the following timescales.

All marketing contacts will be given the option to opt out of any direct marketing. Once they have opted out their record will be removed within 10 working days. However, data will be retained in-line with the retention policy of any of the items listed above if applicable to the marketing contact. If the contact has not opted out, then information will be kept indefinitely.

i). Financial accounts

This lists the timescales that ACC would keep information for all financial accounts and what information will be removed after the following timescales.

All financial transaction information is kept for 6 complete financial years after the year in which the transaction occurred in accordance with HMRC requirements.

Gift Aid information will be for 6 years after the most recent donation. After this time, all paper records will be disposed of securely.

All computer records will be securely archived after this time, as per the software requirements.

j). Offsite data storage

This lists the timescales for the removal of information that is kept by service providers working on behalf of ACC (i.e. as assessors, complaint investigators, complaint panel members), who may keep data on personal devices or in non-ACC email addresses that are not accessible to ACC.

Any data that has personal or sensitive information must be stored securely.

Any data that has personal information must be accurate and only used for the purpose of the service being provided.

Once the service being provided has come to its conclusion all data and information must be removed from personal devices or emails. Data and information that should be retained by ACC in line with its processes should be transferred to an ACC SharePoint site.

11. Direct marketing

We use the information that we collect about you for direct marketing purposes. Direct marketing is the act of selling products or services directly to consumers rather than through retailers. Residents of the European Union and/or the European Economic Area and the United Kingdom - You may, at any time, request that we cease to use your information for direct marketing purposes by emailing us at office@acc-uk.org.

12. Automated decision-making

We use the information that we collect about you for automated individual decision-making. Automated individual decision-making is making a decision solely by automated means without any human involvement.

Residents of the European Union and/or the European Economic Area and the United Kingdom only

The right to stop receiving unwanted direct marketing.

Applies To

Residents of the European Union and/or the European Economic Area only

14. Exercising your rights

You may exercise the rights specified above by submitting a consumer request to:

Heather Bennett
GDPR@acc-uk.org
02476449694
www.acc-uk.org

We will need to verify your identity prior to effectuating your request and may ask you to provide personal information to do so.

We will respond to most consumer requests within 30 to 45 days of receipt, depending upon where you reside. However, some requests may take longer. We will notify you in writing if we need more time to respond. We have the ability to deny your request(s) if certain exceptions in the law apply. If we do deny your request, we will provide you with the reasons for such denial.

15. Location of data processing

All data processing activities undertaken by us take place in United Kingdom.

16. Data Protection Officer

Heather Bennett is our Data Protection Officer and may be reached via email at office@acc-uk.org.

ACC is the data controller in respect of your personal data. This means that we are responsible for deciding how we hold and use personal data about you.

17. Third-party websites

This Website may contain hyperlinks to websites operated by parties other than us. We provide such hyperlinks for your reference only. We do not control such websites and are not responsible for their contents or the privacy or other practices of such websites. It is up to you to read and fully understand their Privacy Policies. Our inclusion of hyperlinks to such websites does not imply any endorsement of the material on such websites or any association with their operators.

We keep our privacy policy under regular review and will post any updates on this webpage. This privacy policy was last updated in March 2023.

Questions

If you have any questions about this Privacy Policy, please contact us at office@acc-uk.org.