Privacy Policy
Policy Statement
Rainbow Rogues is dedicated to safeguarding your personal data and respecting your privacy. This policy details how we collect, use, and store your information, whether you are a service user, parent or carer, sponsor, volunteer, counsellor, or supporter of our work. Rainbow Rogues is a registered Scottish charity (SC048699). We are also registered with the Information Commissioner’s Office (ICO) for data protection purposes. If you have any questions about this policy or how we handle your information, please contact:hello@rainbowrogues.org.uk Rainbow Rogues, Potterton Community Centre, Potterton, Aberdeenshire
Data Protection Responsibility
Under UK GDPR, Rainbow Rogues is not legally required to appoint a Data Protection Officer (DPO), as we are not a public authority, do not carry out large-scale monitoring, and do not process special category data on a large scale. Overall responsibility for data protection compliance sits with Rainbow Rogues’ management committee. All data protection enquiries should be directed to: Email: hello@rainbowrogues.org.uk
If a formal DPO is appointed in the future, this policy will be updated accordingly.
Notification of Change
Rainbow Rogues may update this policy occasionally to reflect changes in legislation or practice. The most recent version will always be available on our website.
Consent
By using our website, submitting forms, booking counselling sessions, donating, or engaging with us online, you agree that your data may be collected and used in accordance with this policy.
How We Collect Information
We may collect personal information when you:
• Complete a counselling, volunteering, or event registration form.
• Make a payment or donation.
• Subscribe to our updates or follow us on social media.
• Communicate with us by phone, email, or online forms.
• Are referred to us by schools, local authorities or community partners.
• We also collect limited, anonymous information about website usage via cookies to help us improve user experience.
What Information We Collect
Depending on your relationship with Rainbow Rogues, we may collect:
• Name, address, phone number, and email address.
• Emergency contact details.
• Relevant medical, wellbeing or support information.
• Donation and financial transaction records.
• Session notes, attendance records and support records (for counselling clients).
• Volunteer application details and PVG information.
All financial transactions are processed securely. We do not store payment card details.
Purposes for Processing Personal Data
We process personal data for the following purposes:
• Providing counselling, play, or family support services.
• Managing appointments, bookings, and attendance
• Communicating with you about services, events, invoices, or enquiries.
• Processing donations, payments, Gift Aid, and related administration.
• Meeting safeguarding, charity law, and financial compliance obligations.
• Recruiting, managing, and supporting volunteers and staff.
• Monitoring, evaluating, and improving our services and organisational effectiveness.
• Sending newsletters or updates where you have explicitly opted in.
We will never sell or rent your personal information to third parties. We do not use personal data for automated decision-making or profiling.
Lawful Bases for Processing
Under Article 6 of the UK GDPR, we rely on one or more of the following lawful bases when processing personal data:
Consent
Where you have given clear consent, we process your personal data for specific purposes such as newsletters, optional communications, or participation in non-essential activities. You may withdraw your consent at any time.
Contract
We process personal data where it is necessary to perform a contract with you, or to take steps at your request before entering into a contract. This includes booking counselling sessions, delivering agreed services, or managing volunteer roles.
Legal Obligation
We process personal data where required to comply with legal obligations, including safeguarding duties, charity regulation, employment law, and financial and accounting requirements.
Legitimate Interests
We process personal data where it is necessary for our legitimate interests as a charitable organisation, provided these interests are not overridden by your rights and freedoms. Our legitimate interests include:
• Managing and improving our services.
• Communicating with service users, volunteers, and supporters.
• Ensuring effective administration, governance, and safeguarding.
Where we rely on legitimate interests, we carefully consider and balance our needs against the impact on individuals.
Data Sharing
We only share personal data where necessary and appropriate. This may include sharing data with:
• IT and communication service providers, including Microsoft 365 and Calendly.
• Payment processing providers, including Stripe.
• Regulatory and oversight bodies, such as HMRC and the ICO, where required.
• Statutory authorities, including local authorities and safeguarding bodies, where we are legally required to do so.
All third parties are required to comply with UK GDPR and to process personal data securely and confidentially. We do not sell or rent your personal data to third parties.
International Data Transfers
Some of our service providers may store or process personal data outside the United Kingdom or European Economic Area. Where this occurs, we ensure appropriate safeguards are in place, such as UK adequacy regulations or approved standard contractual clauses, to protect your personal data.
Data Retention
We will keep your information only as long as necessary for the purpose it was collected, in accordance with our Data Retention and GDPR Policy.
• Counselling records: retained for 7 years after final contact.
• Volunteer records: retained for 3 years after leaving.
• Financial records: retained for 7 years for accounting compliance.
Your Rights
Under UK GDPR, you have the right to:
• Request access to the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Request erasure of your data, where applicable
• Request restriction of processing
• Object to processing based on legitimate interests
• Withdraw consent at any time for non-essential processing
Requests should be made in writing to: hello@rainbowrogues.org.uk
Providing Personal Data – What Is Required
Some personal data is required so that we can provide services or meet legal obligations:
• Contractual requirement: Contact details and relevant personal information are required to book counselling sessions, manage volunteer roles, or deliver services. If this data is not provided, we may not be able to offer the requested service.
• Legal requirement: Certain information must be collected to meet safeguarding, charity law, and financial obligations.
• Optional information: Some data, such as marketing preferences, feedback, or survey responses, is optional and will not affect access to our services. We will always make clear when information is mandatory or optional.
Cookies
Our website uses cookies to enhance your user experience. You can control or turn off cookies via your browser settings.
Security
All data is securely stored within encrypted systems (Microsoft 365 and Teams) and in locked cabinets where paper records are kept. Access is restricted to authorised staff only.
Contact and Complaints
If you have concerns about how your data is handled, please contact us first at hello@rainbowrogues.org.uk.
If you are not satisfied with our response, you may contact the Information Commissioner’s Office (ICO): 0303 123 1113 www.ico.org.uk