Privacy notice

Updated September 2024

Who is Victim Support?

Victim Support is an independent charity for people affected by crime in England and Wales. Our specialist teams provide individual, independent, emotional, and practical help, to enable people to cope and recover from the effects of crime. Our victims’ services are free and available to everyone, whether or not the crime has been reported, and regardless of when it happened.

In some areas Victim Support may provide services to people that commit crime.  These services have the aim of reducing reoffending and helping perpetrators and offenders to be aware of or to understand how their crimes have affected their victims and others.

We are committed to protecting your personal information

Victim Support is committed to respecting and keeping safe any personal information you share with us or that we receive by referral from other agencies/organisations. This privacy notice sets out the basis on which we will process (collect, record, store and share) your personal information.

The contact details for Victim Support in relation to processing of personal information and for any questions regarding this privacy notice are:

Victim Support
Building 3
Eastern Business Park
Wern Fawr Lane
Old St. Mellons
Cardiff
CF3 5EA

Victim Support’s Data Protection Officer can be contacted on dpo@victimsupport.org.uk.

Victim Support will always aim to follow the seven principles of the UK General Data Protection Regulations (GDPR) as set out in the Data Protection Act 2018 which requires that personal data is:

  1. Processed lawfully, fairly and in a transparent manner
  2. Collected for specific, explicit and legitimate purposes; its purposes are limited
  3. Adequate, relevant and limited to what is necessary for the purposes for which they are processed
  4. Accurate and kept up to date
  5. Kept in a form that permits identification of individuals for no longer than is necessary for the purposes for which the personal data is processed
  6. Processed in a secure manner and,
  7. Where we are the data controller we are accountable and be able to show compliance with the above.

This privacy notice provides an overview in relation to all personal information that Victim Support processes.

Victim Support website

When someone visits www.victimsupport.org.uk we use a third-party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site. This information is processed in a way which does not identify anyone. We do not make, and do not allow Google to make, any attempt to find out the identities of those visiting our websites. If we do want to collect personally identifiable information through our websites, we will tell you about this. We will make it clear when we collect personal information and will explain what we intend to do with it.

Why we collect, record and store (process) your information

We process personal information to:

  • Enable us to provide services to people across England and Wales
  • Campaign for change in the Criminal Justice Sector on areas affecting people impacted by crime
  • Conduct research into how people are affected and impacted by crime
  • Keep in contact, communicate with, and get the views and input of our supporters
  • Fundraise to support our vital services
  • Support and manage our employees and volunteers

The types of information we collect, record and store

Personal information is any data that can identify you and includes:

  • Your name
  • Address or location
  • Date of birth
  • Email address
  • Telephone number
  • Any physical characteristics that could identify you

Special category data is personal information about you that is more sensitive or private. The types of information we may ask for your explicit consent to record includes:

  • Your racial or ethnic origin
  • Your political opinions
  • Your religious or philosophical beliefs
  • Information about your health
  • Your sexual orientation

It also includes data relating to criminal convictions and offences or related security measures. Victim Support ensures additional protection is implemented when processing any information relating to criminal convictions or offences. Our Appropriate Policy Document outlines the compliance measures and retention periods in place for criminal offence data.

We will also record details of your assessed and agreed needs and the support provided to you, including case notes.

Section One – Data protection information for service users

The legal basis for processing your personal information

We collect, record and store your personal information to provide a service to you. We only use your information for the purpose(s) it was intended for.

Victim Support will always ensure that there is a legal basis for any processing of personal information it undertakes. We may process the personal information of individuals on a variety of different legal grounds such as:

  • With the explicit consent of the individual
  • Performing a public task in relation to the exercise of official authority when delivering our services
  • A contractual obligation
  • For reasons of substantial public interest
  • Under a legal obligation
  • It is in the vital interests of an individual
  • We have a legitimate interest
  • For statistical purposes, this information is anonymous.

Depending on the service you are being provided with and the area you live in, the legal basis for processing your personal information may differ.  In most services we are processing your personal information with your consent or in the performance of a public task. Your local service can tell you about this.

Some of our services are provided on behalf of another agency or organisation and Victim Support is not the controller of your personal information.  We will tell you about this if it applies to the service you are accessing.

Most of our services require that we process adequate personal and special category information in order that we can legally, safely and fully provide the service(s) you need. Unfortunately without an adequate level of information we may not be able to provide you with a particular service or may need to withdraw that service.

Victim Support sometimes processes personal information about offenders/alleged offenders in relation to providing advice, emotional and counselling services to victims of crime.  This is supported in law by data protection legislation, the Domestic Violence, Crime and Victims Act 2004 and the provisions of the Victims Code of Practice.

Sharing your personal information

When delivering our services Victim Support will normally only share personal information with another agency/organisation with your explicit consent*. This will usually be to ensure you receive the wider services you require to meet your individual needs.  We will tell you who those agencies/organisations are and how they can support you before making a referral.

*In some areas of England and Wales, Victim Support delivers services as part of a commissioned group of victim service providers. This type of service delivery model often means one organisation receives all referrals for all victims into one central database and processes that data solely for the purpose of making an onward referral to the part of the group that can best meet your needs. Where this happens Victim Support and the other organisations that form the group are normally joint controllers of your data and/or the onward referral is made on the legal basis of public task and substantial public interest. Victim Support does not require your consent to make these onward referrals.

There are circumstances where we may have to disclose personal and special category information without your consent. These are:

  • If we believe that either you or someone else is at risk of significant harm
  • Under our safeguarding duty to report any issues relating to child protection or adult safeguarding services
  • Where there is another legal reason or requirement to disclose your personal information, such as a court order, serious case review, our work as part of a multi-agency safeguarding hub (MASH) or a multi-agency risk assessment conference (MARAC) or if you make an application for a firearms licence (or renewal) or are the victim of domestic abuse perpetrated by an individual who has made an application for a firearms licence (or renewal)
  • Where you have reported domestic abuse to us we have a legal duty under the Domestic Violence, Crime and Victims Act 2004 and the Domestic Abuse Act 2021 to work with wider specialist agencies to provide support and protection to you. This is vital in identifying and reducing the level of risk and any escalation of domestic abuse, regardless of the level of risk
  • When working with children and young people who may be at risk of harm, we have a duty to work with wider specialist agencies/organisations under the statutory guidance Working Together to Safeguard Children 2023
  • Some services such as offender and perpetrator services may require us to provide feedback to the Police or other agencies of the Criminal Justice System, for example, completion of or non-attendance at a victim awareness course which forms part of a conditional caution, deferred caution or as a community resolution.

We will only share the minimum amount of data necessary to ensure we protect your vital interests or to fulfil our legal or contractual obligations.

If we routinely share information with another organisation we will have an Information Sharing Agreement in place.  This outlines the scope of the information that can be shared and the legal basis for this.

Where does the personal information we hold about you come from?

You may contact Victim Support yourself, this is called a self-referral.

You may be referred by the police and by other agencies. These organisations pass personal information to Victim Support on the basis of performing a public task, a legal obligation, the consent of the individual the information is about or on the basis of substantial public interest when sharing sensitive data. Victim Support ensures it receives written confirmation from the agency as to the legal basis for the transfer of personal information that the agency is relying on.

The Victims’ Code of Practice issued under Section 32 of the Domestic Violence, Crime and Victims Act 2004 demonstrates that the provision of personal information to Victim Support for the purpose of services being provided to victims and witnesses of crime has a clear basis in law.  View the Victims Code of Practice

You can ask the police not to make a referral to Victim Support. The consequences be that you may not benefit or fully benefit from the services that are available to victims and witnesses of crime. You can still choose to refer yourself at a later date.

Victim Support does not receive referrals of personal information that comes from publicly accessible sources.

How we store your information

Victim Support has appropriate technical and organisational measures in place to protect the personal information of individuals. We use secure systems that permit the easy identification of the individual the personal information relates to. Victim Support’s own systems are all based in the UK.

Where an individual has opted to receive further updates from Victim Support, from time to time we may use SurveyMonkey and similar tools for communicating with you and carrying out surveys that may collect personal data relating to you. Data entered on some of these tools may go outside the European Economic Area (EEA). Data provided through third-party giving websites may also be processed outside of the EEA. No other personal data is transferred outside of the EEA.

How long do we retain your information?

At Victim Support we ensure that personal information is not kept for longer than necessary.  You can find further information here. Full details of Victim Support normal retention periods for personal information can be requested using the contact details provided towards the top of this document.

Your rights in relation to your personal information

Data protection legislation mean that you have specific rights in relation to your personal information held by Victim Support.

The right to be informed

You have the right to be informed of how your personal information will be used, for how long it will be kept, how you can opt out of further processing, and that you have the right to lodge a complaint with a supervisory authority.

The right of access

You have the right to ask Victim Support to provide you with any personal information we currently hold about you this is known as a Subject Access Request.

Victim Support may reserve the right to seek further clarification about the specifics of the information to which you have requested access. Similarly, Victim Support may reserve the right to charge a reasonable fee for, or refuse to respond to, any request it deems manifestly unfounded or excessive. In these instances, we are obliged to let you know of this decision, why it was taken, and of your right to complain to the Information Commissioner’s Office.

Where it is not possible to comply with the request without disclosing information that identifies another individual we do not have to comply with the request.

The right to rectification

You have the right to request that Victim Support corrects any personal information the charity holds on you if it is factually inaccurate or incomplete.

The right to be forgotten

You have the right to request deletion or removal of your personal information in specific circumstances.

The right to restrict processing

You have the right to request Victim Support blocks or suppresses processing of your personal information.

The right to object

You have the right to object to Victim Support processing your information in certain circumstances.

You have a right to withdraw consent at any time where your personal information is being processed based on that consent.

You have a right to lodge a complaint with a supervisory authority in relation to the processing of your personal information

You have the right to lodge a complaint with the Information Commissioner’s Office in relation to the processing by Victim Support of your personal information. The Information Commissioner’s Office can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire SK9 5AF

https://ico.org.uk/for-the-public/

Some Victim Support services process personal information on behalf of another organisation.  This means we are not the controller of your personal information. We will let you know when this is the case and support you to exercise your rights from the controller.

Further information about your rights can be found on the ICO website or you can email Victim Support’s Data Protection Officer dpo@victimsupport.org.uk

How to exercise your rights

To exercise one of your rights as a data subject please contact the local team supporting you or email dpo@victimsupport.org.uk.

If you are a child or young person, your rights in data protection legislation are the same as adults as long as we can establish you are competent or mature enough to understand those rights. Please see our CYP Privacy Notice

You are not required to pay for any charges for exercising your rights unless your requests are manifestly unfounded or excessive. We normally have one month to respond to you (this may be extended if your request is complex).

Please note: where Victim Support is not the data controller of your personal information, your rights should be exercised through the data controller.  We will tell you who this is.

Complaints relating to the use of your data

If you would like to make a complaint regarding how we have used or processed your personal data you may:

  • speak informally to a Team Leader or Manager of the service you have been provided with. We will always aim to rectify any mistakes we have made informally in the first instance. If you are not satisfied with the response you receive you may:
    • make a formal complaint to the Victim Support Data Protection Officer at dpo@victimsupport.org.uk or to the address at the top of this document. If you feel the response was not satisfactory you may:
    • contact the Information Commissioner’s Office (ICO) on 0330 123 1113 or ico.org.uk

There are some useful documents to help you to make a complaint about the use of your personal information on the ICO website Make a complaint.

Automated decision making

None of the operations Victim Support performs on personal information constitutes “automated decisions”.

Section Two – Data protection information relating to other functions

Our service delivery is supported by a variety of other functions. With consent or where we have legitimate interests we process the personal information of:

Why we would share your information

Organisations/agencies we may share your personal information with in relation to other functions include:

  • Third-party providers that provide payment services to individuals who want to donate to or sponsor Victim Support, or who want to sign up to Victim Support’s weekly lottery, as well as fulfilment houses that ensure individuals who want to use our online shop receive the products and services they purchase
  • Third-party giving websites that provide a service to individuals who want to support Victim Support through websites
  • His Majesty’s Revenue and Customs where individuals who give to Victim Support have declared an amount eligible for Gift Aid

How secure is my data and where is it held?

Victim Support has appropriate technical and organisational measures in place to protect the personal information of individuals. We use secure systems that permit the easy identification of the individual the personal information relates to. Victim Support’s own systems are all based in the UK.

Where an individual has opted to receive further updates from Victim Support, from time to time we may use SurveyMonkey and similar tools for communicating with you and carrying out surveys that may collect personal data relating to you. Data entered on some of these tools may go outside the European Economic Area (EEA).

Information provided through third-party giving websites may be processed outside of the European Economic Area (EEA). The main third-party giving websites that Victim Support receives some donations through are JustGiving and Virgin Money Giving. Both JustGiving and Virgin Money Giving note that some personal information may be processed outside of the EEA; further details can be found in JustGiving’s Privacy Policy and Virgin Money Giving’s Privacy Policy.

No other personal information in relation to processing of personal information by Victim Support is transferred outside of the European Economic Area (EEA).

How long do we retain your personal information for?

At Victim Support we ensure that personal information is not kept for longer than necessary.  You can find further information here. Full details of Victim Support normal retention periods for personal information can be requested using the contact details provided towards the top of this document.

Your rights in relation to your personal information

You have the following rights in relation to your personal information held by Victim Support.

The right to be informed

You have the right to be informed of how your personal information will be used, for how long it will be kept, how you can opt out of further processing, and that you have the right to lodge a complaint with a supervisory authority.

The right of access

You have the right to ask Victim Support to provide you with any personal information we currently hold about you.

The right to rectification

You have the right to request that Victim Support corrects any personal information the charity holds on you if it is inaccurate or incomplete.

The right to be forgotten

You have the right to request deletion or removal of your personal information in specific circumstances.

The right to restrict processing

You have the right to request Victim Support blocks or suppresses processing of your personal information.

The right to object

You have the right to object to Victim Support processing your personal information in certain circumstances.

Victim Support in turn may reserve the right to continue processing in specific circumstances. However, there is no circumstance under which the processing of personal information for direct marketing purposes can continue if an objection is received.

Victim Support is under a legal obligation to provide you with the opportunity to object to processing at any time. This is why if you choose to opt into further updates from Victim Support, such communications will offer you an unsubscribe request.

The right of the individual the personal information is about to withdraw consent at any time where the individual’s personal information is being processed based on that consent

The right of the individual the personal information is about to lodge a complaint with a supervisory authority in relation to the processing of their personal information

You have the right to lodge a complaint with the Information Commissioner’s Office in relation to the processing by Victim Support of your personal information. The Information Commissioner’s Office can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire SK9 5AF

https://ico.org.uk/for-the-public/

How to exercise your rights

If you are a fundraiser for, or supporter of, Victim Support and want to access the personal information that we hold about you for this purpose, please contact fundraising@victimsupport.org.uk.

To ask for a copy of your information or for your information to be corrected or deleted, to update your contact preferences, or to object to our processing of your personal information – or if you have any questions about this privacy notice, please contact dpo@victimsupport.org.uk.

Automated decision making

None of the operations Victim Support performs on personal information constitutes “automated decisions”.

Section Three – Data Protection Information for Employees, Volunteers and Applicants

Victim Support processes the personal data of its employees, volunteers and employment and volunteering applicants in accordance with data protection legislation.  We are required to process some personal data for legal and contractual purposes, we may require your consent to process sensitive data and we may process personal data for our legitimate interests.  In emergency situations we will share information about you to protect your vital interests.  Please follow the links below to access the relevant privacy notice:

Employee Privacy Notice [Downloads PDF 210KB]

Volunteer Privacy Notice [Downloads PDF 72KB]

Privacy Notice for Employment and Volunteering Applicants [Downloads PDF  97KB]

Changes to this policy

In line with internal procedures, changing providers, best practice, or changing legal requirements, Victim Support reserves the right to make changes to this privacy notice and other aspects of its websites at any time. Please check this page regularly for any changes.