Privacy and Data Protection Policy

1. Who we are

KSAAS is a registered charity (No. 1017581) providing support to anyone affected by rape, sexual abuse, or sexual violence.

We offer counselling and therapy, helpline services, outreach and advocacy, training and education, fundraising, and volunteer opportunities.

‍

2. Our commitment to data protection

We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We ensure that your personal information is processed fairly, lawfully, and transparently, and that it is stored securely.

‍

3. What information we collect

We may collect and process the following types of personal data:
‍
Contact information
Name, address, phone number, email
‍
Personal details
Age, gender, date of birth

‍Health and wellbeing information
Information shared in counselling or support sessions, health status, experiences of violence or abuse

Service use data
Notes from sessions, referral details, support plans

Supporter and donor data
Contact details, donation records, Gift Aid forms

Volunteer/staff information
Applications, references, DBS checks, training records

Website and technical data
IP address, browser type, site usage (see Cookies section)

‍

4. How we collect your information

• Directly from you – when you contact us, use our helpline, attend counselling, fill out forms, donate, volunteer, or attend events.
• Through referrals – from other agencies or professionals, with your consent.
• Automatically – via cookies or website analytics (where applicable).

‍

5. How we use your information

We only use your information for specific purposes, such as:

• Providing counselling, therapy, and emotional support
• Operating our helpline and outreach services
• Managing appointments and service records
• Responding to enquiries or requests for information
• Recruiting and supporting volunteers and staff
• Organising training sessions, fundraising, and awareness events
• Claiming Gift Aid or meeting our legal and regulatory obligations
• Monitoring and improving our services (using anonymised data)

‍

6. Our legal basis for processing

We use one or more of the following lawful bases:

• Consent – when you have given us permission to process your data (e.g. during counselling or for email updates).
• Contract – where processing is necessary to deliver agreed services.
• Legal obligation – where we must process data to comply with laws or regulations.
• Vital interests – where it is necessary to protect someone’s life.
• Legitimate interests – where processing is needed for our administrative or service improvement purposes.

For special category data (e.g. information about health, trauma, or sexual history), we rely on your explicit consent or on legal bases such as those relating to health or social care support, safeguarding, or managing legal claims.

‍

7. Sharing your data

We treat all personal data as confidential. We will only share it when necessary and lawful, such as:

• With your consent, to other professionals or agencies directly supporting you
• With statutory or safeguarding bodies, if there is risk of serious harm to you or others
• With trusted service providers (e.g. IT or case management systems) under secure data agreements
• With regulators or funders, if required for audit or reporting

We never sell or rent your information.

‍

8. How we store and protect your data

• All paper records are stored in locked cabinets within secure premises.
• Electronic data is stored on encrypted, password-protected systems.
• Access is restricted to trained staff and volunteers who need it to perform their roles.
• We regularly review our data security practices and provide staff training on confidentiality and GDPR compliance.

‍

9. How long we keep your information

We retain personal information only as long as necessary for the purpose it was collected, or as required by law and professional standards.

For example:

• Counselling records are typically kept for a minimum of 7 years after your last contact (or longer if required by insurance or safeguarding regulations).
• Donor and financial records are kept for 6 years for accounting and audit purposes.
• Volunteer and staff records are retained according to HR and legal requirements.

After these periods, data is securely deleted or anonymised.

‍

10. Your rights

You have the right to:

• Access your personal data
• Request correction of inaccurate information
• Request deletion of your data (where lawful)
• Withdraw consent at any time
• Restrict or object to processing in certain circumstances
• Receive a copy of your data in portable format
• Complain to the Information Commissioner’s Office (ICO)

To exercise your rights, contact us at info@ksaas.org.uk or write to:
Kent Sexual Assault and Abuse Services KSAAS, PO Box 353, Canterbury, CT2 9WA.
‍

If you are unsatisfied with our response, you can contact the Information Commissioner’s Office (ICO): https://ico.org.uk/concerns/ or call 0303 123 1113.

‍

11. Cookies and website information

Our website uses small text files called cookies to help it function properly and to understand how visitors use it.

Types of cookies we use:

• Essential cookies – required for basic site functionality.
• Performance cookies – help us understand how visitors use the site (e.g. pages viewed, visit duration).
• Preference cookies – remember choices such as accessibility settings or language.

You can control or delete cookies through your browser settings. Most browsers allow you to block or delete them entirely. Please note that blocking all cookies may affect how the site functions.

‍

12. Changes to this notice

We may update this Privacy Notice from time to time. The latest version will always be available on our website and will include the revision date at the top of this page.

‍

13. Contact details

Kent Sexual Assault and Abuse Services KSAAS
PO Box 353,
Canterbury,
CT2 9WA
01227 451753
ksaas@ekrcc.org.uk
Registered Charity No. 1017581