Street Presence Privacy Policy.
Who are we?
Street Presence exists to express the love of Jesus Christ by means of offering care, compassion and appropriate practical and spiritual help to anyone in need. Street Presence is based in Norfolk, UK, and is a not-for-profit company limited by guarantee registered in England and Wales. Street Presence primarily works with people encountered on the streets of Norwich.
This privacy policy was prepared to be as comprehensive as possible, but it does not include an exhaustive list of every aspect of our collection and use of personal information. However, we would be happy to provide any further information or explanation about our practices.
If you have any questions about this policy, please contact us using the details in the ‘How to Contact us’ section below.
What do we collect?
You are not required to give any personal information to Street Presence if you do not wish to do so. This applies even if you wish for our help although any help we may be able to provide may be limited by what information you feel able to share but many people Street Presence helps provide no personal identifiable information.
Street Presence collects data and most of it is needed for the legitimate interests of our purposes such as our volunteer information, what training they have had, professional support contacts and information provided by regular contacts. On occasion this information may be personally identifiable. We may also collect and process data to comply with the law, a persons vital interests or to perform a task in the public interest.
For example, if we have health information of a regular contact such as that they have an allergy, we may keep that information which is legally termed “special category” information if it is appropriate for us to do so on the basis of the reason that the person has given it to us or, because it is consistent with our legitimate activities as a Christian-ethos, not-for-profit organisation for internal use only. If that person had some adverse reaction which may be as a result of the allergy then we would be legally allowed to pass the name and health information to a third party such as health professional, e.g. ambulance staff, as it would be considered “vital interest” under law.
Occasionally, due to the nature of email addresses in organisations, we will collect an email address that identifies an individual in that organisation such as if it included in a cc or as a contact of legitimate interest in an email sent to us. We may also collect information that is already public.
On occasion we may ask for consent to pass on information to carry out a request made by you or your consent to obtain information such as from another agency in order to carry out your request. You do not have to provide this consent if you do not wish to do so. You may also withdraw or change any consent given if you wish by contacting us using any of the contact methods below or on our contact page or in person.
The above are lawful as identified in Article 6 & 9 of the GDPR.
How do we use it?
Information collected by Street Presence is used for it’s standard practices of the organisation. For the most part this is merely to facilitate communication but can include recruitment and staff management. At some times we will use information to inform current contacts of any changes within the organisation that may affect them or to contact them regarding changes to their organisation that is in the public domain.
Street Presence do not collect information for:
Any automated processing;
Unsolicited direct marketing except under consent (Article 6(a)) or legitimate business interest (Article 6(f));
Automated profiling;
Sharing with third parties unless with explicit freely given consent OR for legal reasons OR in a persons vital interest OR it has already been made public by the data subject (Article 9(2)).
Data Protection
Street Presence use a number of methods to ensure that they manage data in a responsible manner. We use a combination of private networks, secure access, logging, monitoring and detection on our services. Street Presence staff are constantly keeping aware of security changes, best practices and threats so that they are able to act in a responsible and appropriate manner.
Sharing/Disclosure with 3rd Parties
Street Presence does not share any personal information with third parties for the purposes of processing or automated profiling.
Street Presence does not share lists or other data for the purposes of direct marketing.
Street Presence may share with third parties with explicit freely given consent OR for legal reasons OR in a persons vital interest OR if it has already been made public by the data subject (Article 9(2)).
Privacy Rights
The rights of any individual whose name, or other data, may be collected in the course of our normal activities, listed above, will be honoured at all times. You can contact us regarding the exercising of, or information relating to, your rights at any time using the information in ‘contact us’ below. These rights include (but may not be limited to):
Transparency: We will let you know what data we have collected;
Collection: We will let you know, to the best of our ability, where the data was collected from;
Access: We will let you access the data as long as it does not conflict with the vital interests of another (Article 6 (d)), the legitimate interests of another party whose interests outweigh yours (Article 6(f)), the right to legal processing (Article 6(c)), the rights determined by a private contract with you (Article 6(b));
Changes: If you think any of the data we hold is incorrect we will correct such information on your request;
Deletion: Except where it is required under Article 6(b), 6(c), 6(d) and 6(f) above we will honour your right to be forgotten and to delete information that you do not wish us to hold;
Restriction of Processing: You have the right to restrict any processing that you believe is being performed except those required under Article 6(b), 6(c), 6(d) and 6(f) above;
Communication: We will attempt to keep you apprised of any of your above rights, and to carry out your data rights requests except where the cost of such an action outweighs the data stored or the risk. This does not affect your statutory rights but allows a financial limit to be set so that we cannot be disproportionately affected by any request following the guidance of Recital 13. We will keep you informed of any decisions made and our reasoning and give you the right to submit a reasonable objection to any decision;
Portability: Wherever possible we will allow you your right to move the data we have on you to another location except where it is commercial data which we have legally obtained and may retain or delete. This does not affect any of your rights;
Profiling: You have the right to refuse any profiling of data we hold about you;
Automated Decisions: You have the right to refuse any automated decisions based on information we have on you. You have the right to request decisions are made by a natural person.
Third Party Sites, Communications and Services
Street Presence currently do not use third party sites or systems to store personal information. However some other parties may store logs such as phone numbers for billing by a telecommunications company etc.
Email: Street Presence maintains its own email service in the UK running regularly updated open source software. The data is not shared. Email uses TLS Transport Layer Security with AES encryption keys, SPF Sender Policy Framework and can use DKIM Domain Keys Identified Mail if required although Zen outgoing mail servers based in the UK may be used without DKIM. Staff may log in via SSH Secure Shell from any location worldwide but the data is maintained in the UK.
Signal: Street Presence uses Signal for communications where appropriate which provides end to end encrypted voice, video, text and picture messaging. You may contact our mobiles using Signal. Standard SMS messages, geolocation data and missed call alert information may be collected by Dishfire the NSA/GCHQ global mass surveillance project and processed via their Prefer analytics system to extract information so Street Presence gives you the option of saving them the bother.
Website: Street Presence maintains its own website in the UK running regularly updated open source software. The website forces SSL Secure Sockets Layer encryption. You may leave an anonymous message on the site via comments. All comments are moderated and not published if sensitive or otherwise inappropriate to do so. Staff may log in via SSH Secure Shell from any location worldwide but the data is maintained in the UK. For staff login sessions where cookies are stored which contain no personal data and are deleted when the browser is closed. When you log in, we will also set up several cookies to save your login information and your screen display choices. Login cookies last for two days, and screen options cookies last for a year. If you select “Remember Me”, your login will persist for two weeks. If you log out of your account, the login cookies will be removed. If you edit or publish an article, an additional cookie will be saved in your browser. This cookie includes no personal data and simply indicates the post ID of the article you just edited. It expires after 1 day. Street Presence do not use cookies on the website for normal usage unless you leave a comment and opt-in to saving your name, email address and website in cookies. These are for your convenience so that you do not have to fill in your details again when you leave another comment. These cookies will last for one year. Comments left do have an IP address recorded which technically could be a source of identity information particularly geolocation so hide your true IP if you do not want to risk this with any websites. Leaving a comment also records your browser user agent string to assist in combating spam. As with many other websites, the site currently uses HTML5 fingerprinting which can technically uniquely identify your computer if combined with other data which may or may not be available but you can reject this and Street Presence have never used it for that purpose. The websites current theme originally used some google fonts but these have now been disabled as technically they may be usable by google to determine which other sites you visit or even who you are depending on how much other information they have gathered about you from elsewhere. There are no third party analytics on the site. Street Presence reports comment spam and illegal email activities to relevant authorities, web hosts, email providers and blacklists.
VOIP: Street Presence uses Soho66 based in the UK as a provider for VOIP phone operation so calls on our anytime number can be put through to a relevant person where available. The system also accepts SMS, voicemail and faxes which are sent on as emails.
Radio: Street Presence may use radios on patrol to communicate between team members. These would not be used in a manner that could reveal sensitive information. They are normally encrypted as an added precaution although this is not strong encryption and could be decoded by a determined individual with the time and necessary equipment.
Data Storage: As updates are performed and improvements made, Street Presence evaluates the most appropriate means to process and store data available to them. This currently includes portable advanced encrypted storage volumes designed to avoid water marking attacks.
Paper: Street Presence may make use of paper notes. These are normally pseudonymised unless consent is given. If they contain easily identifiable personal information it is typically a contact number for letting a friend or relative know about a persons well being or to pass information to emergency personnel of suitable capacity such as appropriately qualified and vetted first aiders, ambulance service personnel or hospital staff. Such paper notes are kept on person whilst traveling until a suitable safer more secure storage can be reached if there may be a legitimate need to keep them but normally they are destroyed.
Data Retention
Street Presence retains data for as long as is required to fulfill the task for which it was acquired unless deleted because the data subject withdraws consent although a conflict with the vital interests of another (Article 6 (d)), the legitimate interests of another party whose interests outweigh the subject (Article 6(f)), the right to legal processing (Article 6(c)), the rights determined by a private contract with the subject (Article 6(b)), may cause the data to be held and processed for a longer period.
Contacts databases will be regularly purged of old information.
The rights of any data subject will be upheld in accordance with the above statements.
International Retention
Street Presence does not hold data in any international location.
How to Contact Us
You can contact Street Presence on Data Protection by writing to:
Data Protection
Street Presence
2 Fletcher Way
Acle
Norwich
NR13 3RH
By telephone on 01603 340999
By email using contact (at) streetpresence (dot) org using the subject line “Data Protection”
How to make a complaint
If you are unhappy with how your Personal Data is processed by Street Presence you have the right to complain to us using the contact address above. If you remain unhappy, following our response to your complaint, you have the right to lodge a further compliant with our Supervisory Authority, The Information Commissioner’s Office (ICO).
The ICO’s address is:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF.
You can also contact them by telephone on 01625 545 745 or via their website www.ico.org.uk.
Published 24th May 2018. Edited 8th September 2018 to add radio encryption. Edited 7th October 2018 for disabled traceable fonts.