Privacy policy
Section 1 – Information
We care about your privacy. This Privacy Notice explains how we collect and use your personal data. Please read it carefully. If you have any questions about this Privacy Notice, or if you want to enforce your rights, please contact CS Disabled Holiday Ltd’s Privacy Officer Joanna Lees at info@csdisabledholidays.co.uk
Please note that we can only respond to you once we have received your letter
safely, and that our response may therefore be slower if you use post.
CS Disabled Holidays Ltd is a Charity based in England and Wales.
Our Registered Address is Hunters, 9 New Square, Lincoln’s Inn, London WC2A 3QN.
Our administration is conducted from 12 Cambria Street, London SW6 2EE and our financial matters are managed from The Grange, Folly Hill, Itchen Stoke, Alresford, Hampshire, SO24 9TF.
The controller of personal data collected through our Website and offline is CS
Disabled Holidays Ltd at 12 Cambria Street, London SW6 2EE. "Personal data" in this Privacy Notice has the same meaning as in the EU General Data Protection Regulation 2016/679/EU (GDPR). Essentially, it means information which is connected to a living individual who can be identified from that information, either by itself or when combined with other data likely to come into our possession. Personal data can include information collected by certain cookies or tracking technologies if it builds up a profile of you.
We collect and use personal data in order to carry out a business which provides Charitable services. Any other activities and processing which we carry out is to support this primary aim. Our purposes and lawful grounds for processing your personal data vary, depending on our relationship with you and on the activity in question.
We will never sell your personal data.
We will only keep your personal data for as long as necessary to fulfil the purposes for which we collected and continue to process it, and to satisfy any legal, accounting or reporting requirements.
Section 2 - What Data we collect and how we use it
Visitors to our websites
When someone visits www.csdisabledholidays.co.uk we use a third party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site. This information is only processed in a way which does not identify anyone. We do not make, and do not allow Google to make, any attempt to find out the identities of those visiting our website. If we do want to collect personally identifiable information through our website, we will be up front about this. We will make it clear when we collect personal information and will explain what we intend to do with it.
Use of cookies by the CS Disabled Holidays Ltd
You can read more about how we use cookies on our Cookies page.
Search engine
Our website search and decision notice search is powered by ????????. Search
Queries and results are logged anonymously to help us improve our website and search functionality. No user-specific data is collected by either CS Disabled Holidays Ltd or any third party
WordPress
We use a third party service, WordPress.com, to publish our blog,. We use a standard WordPress service to collect anonymous
information about users' activity on the site, for example the number of users
viewing pages on the site, to monitor and report on the effectiveness of the site
and help us improve it. WordPress requires visitors that want to post a comment
People who email us
We monitor any emails sent to us, including file attachments, for viruses or
malicious software. Please be aware that you have a responsibility to ensure that any email you send is within the bounds of the law.
People who make a complaint to us
When we receive a complaint from a person we make up a file containing the details of the complaint. This normally contains the identity of the complainant and any other individuals involved in the complaint.
We will only use the personal information we collect to process the complaint and to check on the level of service we provide. We do compile and publish statistics showing information like the number of complaints we receive, but not in a form which identifies anyone. We usually have to disclose the complainant’s identity to whoever the complaint is about. This is inevitable where, for example, the accuracy of a person’s record is in dispute. If a complainant doesn’t want information identifying him or her to be disclosed, we will try to respect that. However, it may not be possible to handle a complaint on an anonymous basis. We will keep personal information contained in complaint files in line with our retention policy. This means that information relating to a complaint will be retained for two years from closure. It will be retained in a secure environment and access to it will be restricted according to the ‘need to know’ principle. Similarly, where enquiries are submitted to us we will only use the information supplied to us to deal with the enquiry and any subsequent issues and to check on the level of service we provide.
Individuals applying for a grant under the CS Disabled Holidays Ltd
Grants Programme
We process personal data about individuals who apply under CS Disabled Holidays Ltd grants programme, including individuals who apply on behalf of those individuals, their carers, the professionals who support those applications and individuals linked to the holidays that they are interested in undertaking..
This section includes information about both current and past clients.
What information do we ask for, and why?
We do not collect more information than we need to fulfil our stated purposes and will not retain it for longer than is necessary.
We may collect the following kinds of information about you where relevant.
The information we ask for is used to assess your suitability for a grant. You don’t have to provide what we ask for but it might affect your application if you don’t.
Grant Applicants
How do we use your personal data and on what lawful bases?
We do process 'special category' data as a matter of course and we are very careful to maintain your privacy. This is of utmost importance to us. All data that is moved between member of the Board is done so in an anonomised form. Forms are received by the Administrator as sent in by the Applicant. All emails are screened by an anti virus software, but individuals are reminded that it is their responsibility to ensure that email contents are lawful. They are filed on a manual filing system as the most secure and private system.
Applications are then anonomised by the Administrator before being scanning and sent to the Grants committee for review. All Applications are allocated a numeric code by which members of the Applications Committee or the Board of Directors / Trustees can discuss them.
Purpose Type of Data Lawful basis for processing
All other contacts
How do we use your personal data and on what lawful bases?
We do not process special category of data as a matter of course for this category of individuals. We are however very careful to to maintain your privacy.
This is of utmost importance to us.
Opting Out
You can ask us to stop sending you messages at any time by contacting us at info@csdisabledholidays.co.uk.
Data Security
In order to prevent unauthorised access, distortion or disclosure of your personal data we have put in place appropriate physical, technical and organisational measures. Our service providers are required to do the same.
We regularly review our procedures with regards to the IT standards that are in place including the use of passwords, where items are stored and how our IT is being managed.
Our finance department processes all other transaction types via an external cloud based provider which is compliant with all required security standards.
Administration is conducted on a MacBook which is protected by Bitdefender Antivirus for Mac which is run on a daily basis and kept up to date. Up dates are run on a daily basis to prevent security breaches.
We will make any legally-required disclosures of any breach of the security, confidentiality, or integrity of your electronically stored personal data to you either directly or by posting a clear notice on our Website without undue delay
Data Retention
We only keep your personal data for as long as necessary to fulfil the purposes for which we collected and continue to process it, and to satisfy any legal, accounting or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
If you would like more information on our retention of the different aspects of your personal data please contact our Privacy Officer Joanna Lees at
info@csdisabledholidays.co.uk
Your Rights
If you are based in the United Kingdom of Great Britain and Northern Ireland you have a number of rights under the GDPR. These rights apply to any processing carried out by CS Disabled Holidays Ltd. Please see more information below on what we will require from you before we can respond to such requests.
Right to object to direct marketing
You have the right to ask us not to process your personal data for marketing purposes, including profiling (eg. tracking your usage of our Website) to the extent that it is related to direct marketing. Within a reasonable time after receipt and consideration of your objection we will no longer process your personal data for direct marketing purposes. You can exercise your right to prevent such processing by ticking certain boxes on the forms we use to collect your personal data, or by contacting us at any time.
Access to Information
The GDPR gives you the right to find out whether we are processing your personal data and, where that is the case, to receive a copy of the personal data we process and information on:
• why we are processing it;
• the categories of personal data we process about you;
• the recipients or categories of recipient to whom the personal data has been or will be disclosed;
• where possible, how long we plan to keep your personal data or the criteria we use to determine that period;
• information on your rights under the GDPR;
• information on where we received your personal data from if we did not receive it directly from you, and
• if we transfer your personal data outside of the UK, details of the appropriate safeguards we have used to protect your personal data and uphold your personal data protection rights.
• We will not charge you for complying with your request and providing you with a first copy. Any further copies may be subject to a reasonable administrative fee. Where your personal data is inseparable from the personal data of others, we reserve the right to redact or withhold it if it will infringe the rights of those third parties. We also reserve the right to withhold your personal data if permitted by relevant provisions in applicable local laws such as the UK's Data Protection Bill 2017-2019 (which will become the UK's Data Protection Act 2018 once made law).
The right to withdraw your consent to the processing of your personal data
If we process your personal data on the grounds of your consent, you have the right to withdraw your consent at any time. This will not affect the legality of our processing of your personal data up until the point at which you withdraw your consent. Please also note that we may still need to process your personal data on other grounds, for example to fulfil a contract with you or as required by law.
The right to object to processing of your personal data
You have the right to object to our processing of your personal data if we are using the lawful grounds 'legitimate interest' or that the processing is in the public interest. When we receive your objection we will assess our legal grounds for processing and will stop processing the personal data if we cannot demonstrate compelling legitimate grounds to continue processing the personal data.
The right to request the restriction of your personal data
You have the right to ask us to restrict our processing of (ie. stop using) your personal data if you think that it is inaccurate, that we are processing it illegally, or that we no longer need it for the purposes for which it was collected. While we consider your request we will stop processing your personal data within a reasonable time from the date we receive your request. We will notify you of our decision and any justifications for continuing to process your personal data as soon as we can.
The right to request amendment or erasure of your personal data
You have the right to request the amendment of your personal data at any time if it is inaccurate. If it is incomplete, you have the right to have the information completed, taking into account the purposes of processing. You also have the right to require us to delete your personal data as soon as possible where one of the following applies:
• the personal data is no longer necessary for the purposes for which they were collected or otherwise processed;
• you withdraw your consent to us processing your personal data and we have no other legal grounds for processing it;
• the personal data has been unlawfully processed;
• the personal data must be erased for compliance with a UK obligation on us;
• the personal data relates to a child under 16.
The right to personal data portability
You have the right to receive personal data which you have provided to us in a structured, commonly used and machine-readable format and have the right to transmit those personal data to another personal data controller, if we are processing it on the grounds that you have consented to that processing or because it was necessary in order to perform a contract with you, and if we have no other legal bases for processing it. This will not apply to most of our processing of your personal data, but we mention it for completeness.
The right to complain to the Supervisory Authority
If you feel that we have processed your personal data unfairly or unlawfully, you have the right to complain about us to the relevant Supervisory Authority,
although please contact us first so that we can put things right.
In the UK the Supervisory Authority for personal data protection is the
Information Commissioner's Office. You can contact the Information
Commissioner's Office on +44 (0)303 123 1113.
How to exercise your rights
You can exercise your rights at any time by contacting our Privacy Officer, Joanna Lees, at info@csdisabledholidays.co.uk
Please include in your email:
• A clear statement on which rights you are seeking to enforce;
• A full description of the information or type of information that you are writing about; and
• Details which will confirm your identity, such as a scan of your passport or
driving licence and a recent utility bill.
This is so that we can keep your personal data secure and respond to you as
quickly as possible. If you are asking for a large range of personal data we may ask you to be more specific, so that we can manage your request as quickly andefficiently as possible.
No fee usually required
You will not usually have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.
Time limit to respond
We aim to respond to all legitimate requests within one month. Occasionally may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
Links to External Websites and Files
Our Website sometimes contains links to external files and websites. The fact that we link to a file or website is not an endorsement, authorisation or representation of our affiliation with it. We do not exercise control over third party files or websites.
These other websites may place their own cookies or other files on your computer, collect data or solicit personally identifiable information from you.
Other websites follow different rules regarding the use or disclosure of the personally identifiable information you submit to them. We encourage you to read the privacy policies or statements of the other websites you visit.
Changes to this privacy policy
Any changes we may make to our Privacy Notice in the future will be posted on this page. This version of this Privacy notice is dated 10 January 2021