We want everyone who engages with McPin to feel confident and comfortable with how any personal information you share with us will be looked after. This privacy policy sets out how we collect, use and store your personal information (this means any information that identifies or could identify you).
When dealing with your personal information we will always comply with the UK GDPR, Data Protection Act 2018 and any other applicable legislation.
The law requires us:
- To process data in a lawful, fair and transparent way
- To only collect data for explicit and legitimate purposes
- To only collect data that is relevant, and limited to the purpose(s) we may have indicated
- To ensure that data is accurate and up to date
- To ensure that data is only kept as long as necessary for the purpose(s) we have indicated
- To ensure that appropriate security measures are used to protect the data
The Privacy Policy may change so please remember to check back from time to time. This was last updated on 28/08/2024.
Who we are
McPin is a specialist mental health research charity with over ten years’ experience. Our research and involvement work covers mental health and adjacent areas, such as young people, housing, discrimination, and unemployment.
Our charitable objective is to place people with relevant lived experiences at the heart of research and evaluation. We are a registered charity in England and Wales no. 1117336.
The McPin Foundation is committed to protecting your personal information/data (i.e., where an individual can be identified from that data). We make every effort to ensure that your information is processed in a fair, open and transparent manner.
We are a “data controller”. This means that we are responsible for, and control the processing of, any personal information that you provide to us.
We also have a role as a ‘data processor’ in some of our projects. “Processing” data includes various operations that may be carried out on information, including collecting, recording, organising, using, disclosing, storing and deleting it. We often take this role where you have provided data to a research partner on a project that we have a data sharing agreement with.
For further information about our privacy practices, please contact our Data Protection Officer by:
- Writing to us at: McPin Foundation, Unit 1.4 The Green House, 244-254 Cambridge Heath Road, London E2 9DA
- Calling us on 0203 559 6311
- Emailing [email protected]
How we collect information about you
McPin collects information from you in the following ways:
When you interact with us directly: This could be if you ask us about our activities, register with us for training or an event, donate to us, ask a question, apply for or join an involvement group, complete a survey, interview a focus group or other research activity, apply for a job or register with our involvement bulletin. This includes when you phone us, visit our website, email us, or contact us through the post or in person.
When you visit our website: We gather general information which might include which pages you visit most often and which services, events or information is of most interest to you. We may also track which pages you visit when you click on links in emails from us. We also use “cookies” to help our site run effectively. More information on how we use cookies is given below. We may analyse website data to improve the value of the materials available online. Wherever possible we use anonymous information which does not identify individual visitors to our website.
From other information that is available to the public: In order to tailor our communications with you to your background and interests we may collect information about you from publicly available sources or through third party subscription services or service providers.
Why and how we use the information we collect
There are different reasons why we might need personal information from you. These include:
- To keep you up to date about the work we’re doing and ways you can get involved in mental health research
- To process your donations or other payments, to claim Gift Aid on your donations and verify any financial transactions
- When you apply for a group or job
- To support and communicate with you if you are a member of an involvement group
- As research data where you have explicitly consented to participate in a research study
- When you supply goods or services to us
- To provide the services that you have requested or reply to your enquiry
- When you engage with our social media channels
- When you attend an event or training session
- To update you with administrative messages about any events or services you have requested
- To keep a record of your relationship with us
- To meet our legal obligations, for example a contract or our obligations to regulators, government and law enforcement bodies
We will only contact you for the specific reasons you shared your data for.
The personal information we collect, and process may include:
- Your name, date of birth, email address, postal address, telephone number, bank details (if we are paying you for your services)
- The name, email and telephone number of an emergency contact where required for group membership or research participation
- Where you engage with our social media channels, your social media username and any content you share with either policy or via private message or tag us in
- Any information you provide in any communications between us
Profiling
We may contact you based on the information that we hold about you. This is called profiling. For example, if you have told us that you are interested in projects relating to a particular topic (e.g., psychosis), we may use this information to contact you about that topic.
You can opt out of this activity at any time. Please email [email protected] with the subject line ‘Opt out of data profiling’, by writing to us at McPin Foundation, Unit 1.4 The Green House, 244-254 Cambridge Heath Road, London E2 9DA or calling us on 0203 559 6311.
Sensitive Personal Information (Special Category Data)
GDPR recognises that some categories of personal information are sensitive. Special Category Data can include information about a person’s health, race, ethnic origin, political opinions, sex life, sexual orientation or religious beliefs.
There may be times that we ask you about sensitive personal information or you share this information with us, this includes:
- When you contact us, including in emails, the telephone and via our social media
- When you apply to be a member of an involvement group
- In your role as a member of an involvement group
- When you consent to, and participate in research
- When you apply for a job (we never ask for sensitive data for job application in an identifiable format – we do this via an anonymous survey)
- When you write content, record a video or audio output for our communications
The most common type of sensitive personal data that McPin collects is related to lived experience – under GDPR information about your lived exigence often contains health status data.
The other types of special category data McPin may collect includes:
- Racial or ethnic origin
- Political opinions
- Religious or philosophical beliefs
- Data concerning a natural person’s sex life or sexual orientation.
- Criminal convictions and offences data (This is only processed for recruitment and employment purposes)
If you provide us with any special category data, we will treat that information with extra care and confidentiality. We will keep special category data in strict confidence – only those members of staff who need to see or report on this information will have access to it.
Wherever data does not need to be identifiable to you for the purpose it was collected – we will anonymise personal sensitive data.
We will only use this information for the purposes of dealing with your enquiry or for the activity you have signed up for.
Sharing your data with others
We will never sell your details to any third party.
There may be times we share your third party for us to undertake the agreed purpose you shared it. We will make sure we have entered into a data processing agreement with any third parties we use as a processor, so that they are bound to take care of your data in the same way we do. We will also keep an up to date register of these third parties.
On certain projects we might share personal data with a project partner, but in these instances, this will be made clear at the point of collection and will be supported by the explicit prior permission of the person whom the data belongs.
If you have made a Gift Aid declaration, we will disclose the information you have provided as part of the declaration to HMRC for the purpose of reclaiming gift aid on your donation(s). We may also share or disclose your personal information if we are required to do so by any law or court order.
We will not pass on your details to anyone else without your explicit consent except in exceptional circumstances. Examples of this might include anyone reporting serious self-harm or posing a threat to others or children contacting us and sharing serious issues such as physical abuse or exploitation.
Your data outside the European Economic Area (EEA)
There may be times that’s a third party or project partner is located outside the European Economic Area (EEA). The EEA includes all EU Member countries as well as countries that have received an Adequacy Decision.
We have put in place the necessary safeguards to ensure the data protection we share data outside of the EEA. These include but are not limited to, the data protection transfer Addendum in conjunction with EU Standard Contractual Clauses (SCCs), UK International Data Transfer Agreements (IDTAs) and relevant agreements for both Data Processors and those that may be Joint Controllers. All such transfers may be subject to Transfer Risk Assessments (TRAs).
Due to changing legislation related to transfers outside of the EEA this section may be updated more regularly than the rest of our privacy notice. The last update occurred on: 28/08/2024.
Legal basis for using your information
McPin processes data under the following legal basis:
- Consent: McPin relies on your consent when you have given us your consent for processing your personal data, which will be gathered freely and will not be a precondition to any service. For example, you have signed up to our involvement network or consented to participate in a research study, or to participate in surveys or events. You are free to withdraw consent any time
- Legitimate interests: The processing of your personal data may be necessary for the purposes of the legitimate interests pursued by us in our work as a research charity. Processing your information under ‘legitimate interests’ means that we account for your rights and interests and will not process your personal information if we feel that your rights and interests outweigh our own. It may be necessary for our legitimate interests to collect your personal data to enable us to manage certain operations effectively, such as bank account details to process payments or lived experience in involvement group recruitment. We also rely on this as a lawful basis to supply our services to you, to share your data with any relevant party and for safeguarding concerns.
When we rely on this as a lawful basis, we aim to carry out a balancing test (Legitimate Interest Assessment).
- Performance of contract: The processing of your personal data may be necessary in relation to the contract we have entered into with you or an organisation you represent, to provide McPin’s services to you, or because you have asked for something to be done so you can enter into such contract.
- Legal Obligation: Processing is necessary for compliance with a legal obligation to which McPin is subject to.
Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your personal information. If you wish to understand under which specific basis your data is being processed, please contact us. - For any special categories of data processed by McPin, we rely on legitimate interest, read with substantial public interest and additional conditions from the Data Protection Act, recorded in our ROPA and Appropriate Policy Document.
How we keep your information safe
We will take precautions and have appropriate organisational and technical security measures in place to prevent the loss, misuse or unauthorised alteration of details you provide us. We limit access to your personal information to those who have a genuine business need to know it. Those processing your information have had relevant training and will only access data in an authorised manner and are subject to a duty of confidentiality.
We may send communications to you by email. Email is not a fully secure means of communication, and whilst we do our best to keep our systems and communications protected, we cannot guarantee this.
We make no representations about any other websites, and when you access other websites through a link on our website (including social media sites). Please note that these sites are independent from McPin, and we are unable to know how that website uses or collects your personal information.
We encourage you to read the relevant privacy policies on those websites to find out more about how your personal information is collected and used.
How long we hold information for
We only keep information for as long as is reasonable and necessary for the relevant activity, which may be to fulfil statutory obligations (for example, the collection of Gift Aid). Our Register of Processing Activities includes retention periods, and this Register will indicate the types of data concerned and clearly indicate the period it will be retained. We also have a separate Data Retention Policy.
These documents are both reviewed annually. At the end of the retention period, data will either be deleted or anonymised. In some cases, personal data may be kept in perpetuity. If you have any questions about how long we will retain your data please contact us.
Your rights relating to your personal information
- Access to your personal information: You have the right to request access to a copy of the personal information that we hold about you, along with information on what personal information we use, why we use it, who we share it with, how long we keep it for and whether it has been used for any automated decision making. You can make a request for access free of charge. Please make all requests for access in writing and provide us with evidence of your identity.
- Right to object: You can object to our processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your situation which makes you want to object to processing on this ground.
- Consent: If you have given us your consent to use personal information (for example, for marketing), you can withdraw your consent at any time.
- Rectification: You can ask us to change or complete any inaccurate or incomplete personal information held about you.
- Erasure: You can ask us to delete your personal information where it is no longer necessary for us to use it, or you have withdrawn consent, or where we have no lawful basis for keeping it.
- Portability: You can ask us to provide you or a third party with some of the personal information that we hold about you in a structured, commonly used, electronic form, so it can be easily transferred.
- Restriction: You can ask us to restrict the personal information we use about you where you have asked for it to be erased or where you have objected to our use of it.
- No automated-decision making: Automated decision-making takes place when an electronic system uses personal information to decide without human intervention. You have the right not to be subject to automated decisions that will create legal effects or have a similar significant impact on you, unless you have given us your consent, it is necessary for a contract between you and us or is otherwise permitted by law. You also have certain rights to challenge decisions made about you. We do not currently carry out any automated decision-making.
In certain circumstances (for example where required or permitted by law) we might not be able to provide you with access to some of your personal information, if so, we will explain the reasons for this.
If you wish to exercise these rights, please contact us on the details below.
Complaints
If you feel that data has been handled incorrectly by McPin, we welcome you contacting us directly so that we can rectify it. You can contact us by:
- Writing to us at: McPin Foundation, Unit 1.4 The Green House, 244-254 Cambridge Heath Road, London E2 9DA
- Calling us on 0203 559 6311
- Emailing [email protected]
You can also make a complaint to the Information Commissioner’s Office (ICO) which regulates the use of information in the UK. This can be done here: www.ico.org.uk/concerns.
You can also call them on 0303 123 1113.
