Confidentiality and Data Protection (GDPR Notice)
Your data is being collected in accordance with the Data Protection Act 2018 and GDPR. As such, we have outlined: who is collecting your and processing your data, what is being collected, why it is being collected and the legal basis for such collection and processing.
Who is collecting and processing my data?
You are signing up to participate in a free and confidential condom distribution scheme, which is commissioned by your Local Authority and is provided by a combination of provider(s), depending on where you live.
These providers will include, the lead organisation and any participating outlet(s) where you collect condoms from.
Where schemes are collaborating (e.g. Come Correct) and you are accessing services outside of the Local Authority where you registered (which requires your C-Card), the provider/outlet will be given limited access to your data in order to provide you with the service you are requesting.
The collection of this data is facilitated by THERAPYAUDIT Limited who are a Data Processor on behalf of your Local Authority.
What personal data is being collected?
Your data falls into two categories: personal data and special category data (as below):
- Personal Data
- Initial & Surname
- Date of Birth
- Gender
- Location (via postcode)
- Special Category Data
- racial or ethnic origin;
- sexual orientation
- health;
- sex life;
The exact data collected about you will be dependent on the services you use within the participating outlets/services.
Why do we need this data?
This data is collected in order to:
- allow you access to the c-card scheme and access services in any participating outlet
- identify you if you have forgotten your c-card so that you do not need to re-register every time you use the scheme
- justify the existence of the scheme and to target resources accordingly (e.g. activity reports)
How long will your data be kept?
Your data will be kept up to 12 months after you are no longer eligible for the scheme you are registering with; this will typically be 12 months after your 25th birthday, unless otherwise stated.
Some Local Authorities automatically remove your personal data after a period of 12 months of your account being dormant, although the c-card can be re-registered should you decide to start using the scheme again.
The Legal Basis
For the purposes of this online registration portal, the collection of your personal data and special category data is done so under the legal basis of explicit consent, which you may withdraw at any time, by replying to the activation email. Should you withdraw your consent all personal data will be anonymised in accordance with guidance from the Information Commissioner’s Office.
Should you wish to withdraw your consent after you have used your card this can be done by:
- Replying to the original activation email
- Contacting the lead provider
- Visiting an outlet
Safeguarding / Confidentiality
This is a confidential scheme, but there are some cases where, if the provider believes that you, or another young person, are at risk of serious harm they may need to follow safeguarding procedures. This will be discussed with you and they will work with you to protect you in the future.
Your Rights
- The right to be informed
- The right of access
- The right to rectification
- The right to erasure
- The right to restrict processing
- The right to data portability
- The right to object
- Rights in relation to automated decision making and profiling.
More information can be found at https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/.
Postal Registration
Local Authorities participating in postal registration may contact you via the email address you provide, in order to offer the option of having a C-Card posted to you.
By replying to the email with your postal address, you accept that the recipient may use this address for the purpose of sending you a CCard and in some cases further information regarding the services offered e.g. (a leaflet).
Once your card has been sent to you, the email containing your postal address will be deleted and no further postal communication will occur.
For data protection questions relating to Postal Registration, please contact the organisation/provider who is offering the service.