Policy.pdf

# Privacy and Data Protection Policy

## Introduction

This policy outlines SensationALL's commitment to protecting the privacy and data of its supporters, employees, volunteers, and other stakeholders. SensationALL is a Scottish charity dedicated to providing multisensory experiences for individuals with multiple support needs, regardless of diagnostic labels, age, or location.

## Scope

The policy applies to all staff, volunteers, supporters, job applicants, and event attendees associated with SensationALL.

## Statements

Data Controller: SensationALL is the data controller responsible for personal data collected from its supporters, including email subscribers, survey respondents, donors, volunteers, fundraisers, and website visitors.

Compliance: This policy adheres to the General Data Protection Regulation (GDPR) effective May 2018, as evidenced by the ICO registration number ZA154523.

Data Usage: SensationALL collects and uses personal data for specific purposes only, including event attendance arrangements, communication, and service improvement. Data is not traded for commercial gain.

Third-Party Providers: Sensational ALL utilizes service providers based in the European Economic Area to process supporter data securely.

## Data Collection and Use

- Email Subscribers: Automatically subscribed to receive updates; can opt out at any time. Contact preferences managed via Mailchimp, with plans to transition to a UK-hosted email service for enhanced privacy.
- Survey Respondents: Privacy policies specific to survey platforms are displayed; re-contact is permitted only with explicit consent.
- Donors, Volunteers, and Fundraisers: Information collected includes name, contact details, event-related data, source of awareness, and feedback. Used for communication, fundraising, and service evaluation.
- Website Visitors: Basic information like IP addresses may be collected for analytics; no personal identification is made without consent.
- Facebook Users: Data usage complies with Facebook's privacy policies; users can control their data through platform settings.
- Event Attendees: Personal details are collected for event planning and management, with participant consent.
- Employees and Job Applicants: Personal data is processed for recruitment and employment purposes in accordance with relevant laws.

## Your Rights

Supporters have the right to access, rectify, erase, or restrict processing of their personal data upon request. They can also opt out of marketing communications and exercise other rights as outlined by GDPR.