EPIC Restart Foundation is committed to protecting the privacy and security of personal information.
This Privacy Policy explains how and why we use the information we collect about you and tells you what to expect when we collect personal information from you. It also explains how we will store, handle and keep your personal information safe, and what rights you have relating to it.
This Privacy Policy (together with our Terms and Conditions as set out at https://www.epicrestartfoundation.org/pages/epic-restart-foundation-terms-and-conditions applies to your use of any of the services accessible through the EPIC Restart Foundation, this including services accessed via our website or any other sites of ours including the EPIC Restart Online Community; and any events, mentoring and / or coaching services that you may attend online or in person (“Services”).
Please read the following carefully to understand our practices regarding your personal information and how we will treat it.
We keep our Privacy Policy under regular review to make sure it is up to date and accurate.
Important information about who we are:
We are the EPIC Restart Foundation, a UK registered charity (number 1192907). We provide practical support, mentoring and coaching and advice to those recovering from a gambling disorder. We are here to support you, to restore your confidence and self-belief and empower you to take the next steps in your journey of recovery.
Together with our partners and team we harness our collective experience to create innovative and transformational programmes that change lives. Our programmes will help you overcome the isolation felt after gambling addiction and provide you with practical tools to develop coping strategies to support your recovery.
EPIC Restart Foundation is the Data Controller for the personal information that we process, unless otherwise stated. We refer to ourselves in this policy as “we”, “us,” or “our”.
The Foundation’s Programme of activities aims to provide useful and constructive tools to support those who have suffered gambling harm - to build resilience, find new and meaningful opportunities, and so positively restart and rebuild lives in recovery.
EPIC Restart Foundation is registered with the Information Commissioners Office (ICO).
Our registration number is ZB045705.
You can contact us at:
Postal address: Suite 2, Northern Diver Building, Appley Bridge, WN6 9AE
Email: [email protected]
General Information.
We are committed to keeping your personal information safe and secure, and to meeting the requirements of the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018, the Privacy and Electronic Communication Regulations 2003 (“PECR”) and any other laws that might apply.
Changes to our Privacy Policy
We keep this Privacy Policy up to date to help you understand what we do with your personal information. Any changes we make to our Privacy Policy in the future will be posted on this page and, where appropriate, notified to you by e-mail.
Please check back frequently to see any updates or changes to our Privacy Policy.
Third-party Links
Our websites may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you.
We do not control these third-party websites and are not responsible for their privacy statements or policies. When you leave our website, we encourage you to read the Privacy Policy of every website you visit.
Your data and how we use it
What is personal information?
Personal information or personal data can be anything that identifies and relates to a living person. This can include information that when linked with other information, allows a person to be uniquely identified. For example, this could be your name, date of birth, telephone number, email address and / or contact details.
The law treats some types of personal information as ‘special’ because the information requires more protection due to its sensitivity. This ‘special’ information is referred to as Special Category Personal Data and consists of personal information which relates to your:
· Racial or ethnic origin
· Sexuality and sexual life
· Religious or philosophical beliefs
· Trade union membership
· Political opinions
· Genetic and bio-metric data
· Physical or mental health
· Criminal convictions and offences
We use “personal information” to refer to all information that from which an individual can be identified throughout this Privacy Policy. Personal information does not include data where the identity has been removed (anonymous data).
What information do we collect about you and how do we collect it?
We use different methods to collect information from and about you.
We may receive and store personal information when you use or access our services or our website. We may collect this information directly or you may give us information in other forms, including when you complete evaluation surveys.
You may provide basic information such as your name and email address to enable us to send you relevant information and provide updates.
We collect and process personal information to fulfil our charitable purpose and for the purpose of providing you with our services. When we collect your personal information, we aim to be clear about our reasons for doing so, and we will only use it as you would reasonably expect. In general we collect personal information when you:
- visit our website
- join our EPIC Restart Foundation Community
- communicate with us
- apply to take part in our programme
- take part in any research or evidence gathering or an event with us; and /or
- donate to us.
Personal information we may collect, use, store and transfer about you which we have grouped together, are as follows:
- Identity Data includes first name, last name, username or similar identifier, title
- Contact Data includes billing address, delivery address, email address and telephone numbers
- Financial Data includes bank account and / or payment card details
- Transaction Data includes details about payments to and from you and other details of products and services you have received from us
- Technical Data includes your browsing activities based on your interactions with our website and / or interactions with the EPIC Restart Foundation, which may include your internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access our websites
- Profile Data includes any username and password, your interests, preferences, feedback and survey responses
- Usage Data includes information about how you use our website, products and services
- Marketing and communications data includes your preferences in receiving marketing from us and our third parties and your communication preferences.
This list is not exhaustive, and, in specific instances, we may need to collect additional data for the purposes set out in this Privacy Policy. We may also collect personal information from third parties who have your consent to pass your details to us, or from publicly available sources.
We will do our best to keep your information up to date. Please let us know if your details change.
Information we collect:
When you use our Services, including when you join the EPIC Restart Foundation Community and our website we collect the following:
Account information
To access our EPIC Restart Foundation Community some personal information will be required. Where you wish to join our EPIC Restart Foundation Community you will have the option to download a mobile application which facilitates this access. You will be asked to provide some personal data including your name, and email address.
Information we receive from the use of our Services
When you access any of our Services via your device, your device syncs with our software, and data may be transferred from your device. This information is used to improve your experience and ensure that you are able to join in with the Services, we may also process information such as your browser type, settings and information about how and when you used our service, information about the type of device and/or operating system you are using, and which videos you have watched, what content you like or share and which adverts you saw and responded to.
We collect, use and share aggregated data such as statistical or demographic data for any purpose. Aggregated data could be derived from your personal information but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your activity within the website to calculate the percentage of users accessing a specific feature.
However, if we combine or connect aggregated data with your personal information so that it can directly or indirectly identify you, we treat the combined data as personal information which will be used in accordance with this Privacy Policy.
Health and other special categories of personal information
To the extent that the information we collect is health data or another type of special category personal information subject to data protection laws, we may ask you for your explicit consent to process this data.
Payment information
We may process your personal information to process any donations made to us or to facilitate any payments. The information may include information for identification and verification, such as your name, credit, debit or other card number, card expiration date, and CVV code. Any payment transactions carried out by us, or our chosen third-party provider of payment processing services will be kept secure and encrypted where possible.
Information received from third parties:
We may have partnered with third parties, for example, external organisations for presentations and workshops or to facilitate mentoring. In these circumstances, the third party may have provided us with personal information including your name and email address or similar information, so we can invite you to participate in further workshops or follow-up activities or for the purposes of offering you mentoring services.
Any data obtained from third parties will be kept in accordance this Privacy Policy, and with any additional restrictions imposed by the third party that shared your personal information with us.
You may also link your Facebook or Twitter (or other social media) account to our webpage which allows us to obtain information from those accounts (like your friends or contacts).
We may also use your IP addresses and information relating to what pages have been viewed or searched for (e.g. using cookies as described further below).
Childrens’ personal information.
Our website and our Services are not intended for children and our website does not knowingly collect data relating to children. If you are using our services and you are under 18, please let us know immediately.
If you fail to provide personal information
Where we need to collect personal information by law, legitimate interest or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the requested services. In this case, we may have to cancel a service you have with us, but we will notify you if this is the case at the time.
How we use the information we collect
We want to be open, honest, and fair in the way that we use your information.
The law on data protection sets out a number of different reasons for which we may collect and process your personal information.
We will only use your personal information when the law allows us to do so. Most commonly we will use your personal information in the following circumstances:
- Where you have consented before the processing
- Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests
- Where it is necessary to protect your vital interests where you are physically or legally incapable of giving consent, for example in an emergency if you are incapacitated
- Where we need to comply with a legal or regulatory obligation
Whenever you have given us your consent to use your personal information, you have the right to change your mind at any time and withdraw that consent. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent.
We strive to provide you with choices regarding certain personal information uses, particularly around marketing and advertising.
If you have given your consent to receive marketing emails you can withdraw this at any time, or if we are relying on our legitimate interests to send you marketing you can object. In either case, just let us know. If you have received a direct marketing email from us and no longer wish to do so, the easiest way to let us know is to click on the unsubscribe link at the bottom of our marketing emails.
Sharing information with other third parties
We sometimes share your personal information with trusted third parties. We will never sell the personal information of our mentees, mentors, coaches, donors or sponsors or any other data processed.
The reasons we may share your information with third parties are:
- to provide you with our services and connect you to a mentor or coach
- in circumstances where we believe there to be an imminent danger or a safeguarding issue is raised. For example, the mentor may share the mentee’s details with emergency services or appropriate authorities
- if we are under a legal or regulatory duty to do so
- if it is necessary to do so to enforce our terms of use or other contractual rights
- to lawfully assist the police or security services with the prevention and detection of crime or terrorist activity
- where such disclosure is necessary to protect the safety or security of any persons, and/or
- otherwise as permitted under applicable law.
We may also share your personal information to help us improve our services, including our website and other engagement platforms. We have contracts with companies who provide us with services such as IT support, data storage, payment processing and email automation services. We also may share information when you attend one of our programmes, for example, this could be to make sure that you are not served food that you are allergic to or to send you information about a course being delivered by one of our partners.
We only use carefully chosen partners and suppliers, to help us deliver our programme. Our contracts with our partners and suppliers require them to only act on our instructions, to keep your data secure and to comply with data protection laws. We protect your personal information and will never sell it to anyone. We always keep control of your data. If asked by the police, or other regulatory or government authority, we may be required by law to pass on your personal data to them, and we might not be allowed to tell you if this happens
Where your information may be processed
Your personal information will be stored on systems with appropriate technical and organisational security measures and controls in place.
If we do transfer your information outside of the UK, we will make sure that it is protected in the same way as if it were being used in the UK. We will use appropriate safeguards. If we propose to make a transfer in response to a lawful and legitimate request, we will normally tell you in advance unless there are compelling reasons, such as law enforcement or, reasons of safety which justify not doing so.
Profiling and/or automated decision-making
Unless otherwise agreed with you, we will not use any of your personal information for automated decision-making or profiling.
How long we will retain your personal information
We will only retain your personal information for as long as is necessary for the purpose or purposes for which we have collected it.
In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions, and they are subject to a duty of confidentiality.
In some circumstances, we will anonymise your personal information (so that it can no longer be associated with you) for analytical or statistical purposes, in which case we may use this information indefinitely without further notice to you.
The rest of this Privacy Policy goes into more detail about what we do with your personal data depending on your relationship with us.
When you visit our website
We collect personal information when you use this website. Some of the personal data is freely provided by users, whilst some of it is collected automatically.
This information is collected anonymously unless you have also given us your personal details through another action on our site (like filling in a contact form).
We need to collect this data to help us to keep our systems secure, and to keep improving our website.
COOKIES
Cookies are small files that are put onto your device when you visit websites like ours. We use cookies to collect information that helps us improve your user experience.
The cookies we use are not used to identify you personally. They are called ‘Technical Cookies’ and are used to improve the performance of our website. We will not sell your information to any third parties, and you are able to decline the use of these cookies, however, this may impact the performance of our website, For more information you can see our Cookie Policy.
We use cookies to see which of our pages you visit and allow you to share our pages through social networks such as Facebook. You can disable cookies in Chrome or refuse to accept cookies by using the settings in your browser.
If you take part in our research or evidence-gathering
We may ask for your personal information if you take part in any of our research or evidence-gathering activities. For example, completing an online survey or participating in a Q&A online session. We do this to learn how we should shape our programme to help people in the future and to learn more about the needs and interests of people recovering from gambling harm and to enable us to create activities that are directly relevant for them. We might also ask for an email address to contact you and find out if you are interested in taking part in our programmes in the future.
We will keep your personal data given to us in research or evidence-gathering safe and will not publish it unless anonymised.
If you take part in our programmes
We may be given some of your personal information by someone who refers you to our Programmes. This information is usually only given to us with your consent and includes your name and email address. We use this information to contact you and find out if you are interested in taking part in our programmes.
If you apply to take part in our programmes, we will need you to fill in an application form. We will gather personal information directly from you during this process and throughout the course of your relationship with us. If you join our programme, we collect your contact details as we will need to send you essential information about our activities.
Sometimes we or our delivery partners might ask you to complete a medical form before you take part in any outdoor or physical programme activities. We might collect this data from you online or on paper. This might include collecting personal information including:
- date of birth
- emergency contact
- gender
- medical information, including allergies and medical conditions
- dietary information
- any other information you decide to tell us that helps us look after you.
We treat this information as confidential, and we take extra care with it. We only use it to keep you and those around you safe and well.
We may need to send you essential information about our programme.
During or after your course we may also collect:
- Any feedback you give us
- your responses to any evaluation questions
This information is used to help us keep improving our Programme and the way we work with you and others or to evaluate and report on the impact of our work. We normally anonymise personal information. We will always ask your permission if we want to use your name in any of our evaluation reports or marketing material.
We may also keep a record of your meetings with your mentor and /or coach. This is to enable your coach and /or coach to support you and help you get the most out of our programme.
If you have previously taken part in one of our programmes
We will keep an archive of our programmes, so we may have records of:
- your name, age, and other basic information about you at the time
- photographs of you when you took part in our programme
- other paperwork from the programme which may have your personal data
- the Coaching notes on Lamplight, our case management system
Exactly what information we hold will vary. For further information please contact us.
If you are a donor or a prospective donor
If you have donated to us, the personal information we hold on you may include:
- your name and contact details·
- your preferences on how to contact you
- your history of donations to us
- invoicing or Request for Donation information
- your job title and other information about the company you work for
- general information about your interests and business activities
- records of events you have attended with us
- your history of support for us
- records of your written communications with us.
We usually gather or generate this information while setting up or fulfilling your donation
agreement with us. If you are not yet one of our donors, we might have obtained information from publicly available sources through our prospect research. This information is used in line with our legitimate interest as a charity reliant on fundraising.
You always have the option to opt out of any messages we send you, and you can request at any time that we stop processing your data or delete it
Security
We take the security of your personal information very seriously. We use a combination of technical, administrative, and physical controls to maintain the security of your personal information and protect against accidental, unlawful or unauthorised destruction, loss, alteration, access, disclosure or use.
All information you provide to us is stored on our secure servers or within secure filing systems. Some of the controls we have in place to protect your personal information include technological controls such as firewalls, user verification, strong data encryption. We operate Clean Screen and Clean Desk policies, and Our staff undergo data protection training to support the handling personal data. We always retain overall control of your data.
We have put in place procedures to deal with any suspected personal information data breach and will notify you and any applicable regulator when we are legally required to do so.
Your data rights
You have the following rights relating to your personal information. If you want to exercise any of your data rights, just contact us using the details below. We may need to check that you are who you say you are, to keep your data safe.
Your right to be informed
We aim to be transparent within our Privacy Policy and provide you with information about how we use your personal information.
Your right to object
In some circumstances you can stop the processing of your personal information for reasons connected to your individual situation. We must then do so unless we believe we have a legitimate overriding reason to continue processing your personal information.
Where your details are used for marketing, you can opt out at any time. You are able to unsubscribe from marketing on each contact or you can contact us to object to any processing.
Your right to rectification
You have the right to request the correction of your personal information when it is incorrect, out of date or incomplete. If you notify us that the personal information, we hold is complete or inaccurate we will correct or complete the information as soon as possible.
Your right to erasure or the right to be forgotten
You have the right to request that your personal information be deleted; including if we no longer need it for the purpose we collected it, you withdraw your consent or you object to its processing.
Following your request, we will erase your personal information without undue delay unless the continued retention is necessary and permitted by law. If we make the personal information public, we shall take reasonable steps to inform other data controllers processing about your erasure request.
Your right to restrict processing
You have the right to request that we restrict the processing of your personal information. This can be done in circumstances where we need to verify the accuracy of the information, if you do not wish to have the information erased or you have objected to the processing of the information, and we are considering this request. Once the processing is restricted, we will only continue to process your personal information if you consent, or we have another legal basis for doing so.
Your right to access
You have the right to access the personal information we hold about you. Any access request will usually be free of charge and responded to within one month. We will endeavour to provide information in the format requested, but we may charge you a reasonable fee for additional copies.
Your right to data portability
You have the right to receive a copy of your personal information which you gave to us. The copy will be provided in a commonly used and machine-readable format. You can also have it transmitted directly from us to another data controller, where technically possible.
The right not to be subject to automated decision making and profiling
You have the right to not be subject to solely automatic decisions (i.e., decisions that are made about you by computer without any human input) in relation to any processes that have a legal or similarly significant effect on you.
You will be notified if we make a solely automated decision which produces a legal effect or significantly affects you.
When you request to exercise your rights
You will not have to pay a fee to exercise any of the rights listed above. However, we may charge a reasonable fee if your request is clearly unfounded or excessive, including where requests are repetitive. Alternatively, we could refuse to comply with your request in these circumstances.
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal information or to exercise any of your other rights. This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
Contact us
Please get in touch if you have any questions about this policy, would like us to stop sending you messages or using your data, or if you would like to exercise any of your personal data rights.
Email: [email protected]
Registered Office: Suite 2, Northern Diver Building, Appley Bridge, WN6 9AE
Our Data Protection Officer is Sharon Parr, Chief Executive Officer
Email: [email protected]
For further information on data protection please visit the Information Commissioner Office (ICO) website.
The Information Commissioner Office regulates data protection. If you feel that your data has not been handled correctly, or you are unhappy with our response to any requests you have made to us regarding the use of your personal information, you have the right to lodge a complaint with the Information Commissioner’s Office.
You can contact them by calling 0303 123 1113 or visit the website.
