Privacy Policy
GENERAL
CASPA respects your privacy and is committed to protecting your personal data. The CASPA Way includes building trust and being honest and open with our members and people who engage with us.
We will always be transparent about what we do with your personal information, and we will always ask permission before we collect, store, or otherwise process your personal information.
Our website was created in line with our main objective: to reach out to, and support autistic individuals, to advocate for our autistic community, and to celebrate autistic pride. We do not create profiles of our users to sell to third parties for targeted advertising.
Please take time to read our Privacy Policy to learn how CASPA (“we,” “us” or “our”) collects, protects and processes your data when you engage with us through our social media accounts, our website, emails and other means described here (“Sites”). This includes the options we provide for how you can control and access your data.
Who we are and important information
CASPA is the data controller.
This Privacy Notice explains in detail the types of personal data we may collect about you when you interact with us. It also explains how we’ll store and handle your (and your child’s) data and keep it safe.
We hope the following sections will answer any questions you have. If not, please do get in touch with us.
We need to update this Privacy Notice from time to time. We will notify you of any significant changes, but you’re welcome to come back and check it whenever you wish.
Our website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.
The data we collect about you.
Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:
Identity Data – this includes your first name, last name, marital status, title, date of birth, gender, image, your social media profile name, the profile information that you share publicly on social media and your children’s first name, last name, date of birth, gender and image. If you provide us with other documents such as your passport (for DBS reasons for example) it will also include place of birth, passport number, facial image and nationality.
Contact Data – this includes billing address, home address, email address and telephone numbers.
Financial Data – this includes bank account and payment card details.
Transaction Data – this includes details about payments to and from you and other details of products and services you have purchased from us. This is largely via a Third Party such as TeamUp, Enthuse, and JustGiving.
Technical Data – this includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access our website (our website is via third party hosting platform, WordPress).
Profile Data – this includes your purchases or orders made by you, your interests, preferences, feedback and survey responses.
Usage Data – this includes information about how you use our website, products and services.
Marketing and Communications Data – this includes your preferences in receiving marketing from us and our third parties and your communication preferences.
Interaction Data – this includes details of your interactions with us through email, social media, SMS, telephone or in person.
Health Data – this is restricted t any medical condition, disability or other educational needs that may impact your/your child’s experience at or with CASPA. We will collect data that is relevant to your/your child’s
membership and needs whilst at CASPA from you/other professionals involved with your child (with your permission).
We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature.
If we combine or connect Aggregated Data with your personal data that directly or indirectly identifies you, we treat the combined data as personal data.
Apart from the Health Data described above, we do not collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data). Nor do we collect any information about criminal convictions and offences in relation to our members/beneficiaries.
Children’s Data
At CASPA we only process your children’s data when it is necessary for us to do so. We may process your children’s data when it is provided (by you) in the course of using our services. Such data may include information provided to us from you on enrolling your child on a CASPA programme or club, holiday activity or other service, such as Identity Data (name and date of birth of your children) and Health Data.
The legal basis for us processing this is our legitimate interest in properly administering your children’s ability to use our services (e.g. making adjustments to your children’s experience at CASPA), to ensure that we provide a safe
environment for our visitors and employees and to protect your legal rights, our legal right and the legal rights of others.
We may also process your children’s data contained in any enquiry you submit to us regarding our services. Such data may be processed for the purposes of offering relevant services to you.
The legal basis for this processing is consent and our legitimate interests in properly administering your ability to use our services (e.g. confirmation emails).
How is personal data collected.
We use different methods to collect data from and about you including through:
Direct interactions. When you contact us by phone, email, contact form or otherwise to submit information to us, we process the information you provide to us to respond to your inquiry.
We keep contact form submissions and emails for six months strictly for customer service and analytical purposes, but we do not use the information submitted through them for marketing purposes.
- Memberships and Orders. When you choose to sign up to our membership scheme or buy an activity or any products available through our website, in addition to your name, address, email address, telephone number, and birth date (if applicable), we will process the following additional Personal Data in order to complete your transaction: details of order, price, payment card number or other payment information, shipping and billing address, any further details on the purchase transaction and optional account information like username and password. We may use this information for purposes such as to:
- Send you information about your account and order
- Respond to your requests, including refunds and complaints
- Process payments and prevent fraud
- Set up your account for our store
- Comply with any legal obligations we have, such as calculating taxes
- Improve our services and offeringsNo card payment information is stored on our servers.
- Membership Registration. We process your login details if you choose to register for an Account so that we can communicate with you, provide the Services and provide you with a more personalized experience on our Site. You are not required to register for an Account, but if you choose not to do so, you may not be able to participate in some of the Services offered through the Site. In addition to this, we process all information you provide to us when logged into your Account, and also your usage data (e.g., login times, length of stay).If you create an Account, we will store your name, address, email and phone number. This information will be used to populate the checkout for future orders. We generally store information about you for as long as we need the information for the purposes for which we collect and use it, and we are not legally required to continue to keep it.
Automated technologies or interactions. As you interact with our website, Team Up, or social media, we may automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. Please see Section 5 below for further details on Cookies.
CCTV. Most of the premises in which CASPA operates have CCTV systems in operation for the security of our members, visitors and staff. These systems will record your image and the image of your children during your/their attendance.
- Analytics. CASPA uses a WordPress package to collect anonymous analytics data.
Third parties or publicly available sources. We may receive personal data about you from various third parties and public sources including Technical Data from the following parties: (a) analytics providers; (b) advertising networks; and (c) search information providers as well as Contact, Financial and Transaction Data from providers of technical and payment services such as Eventbrite, Gateway Ticketing, World Pay, PCI Pal & Paypal, Identity and Contact Data from data brokers or aggregates, Identity and Contact Data from publicly available sources such as Companies House or the Charities Commission.
Cookies
WordPress, our chosen web publishing software installs cookies by default. If you visit our login page, we will set a temporary cookie to determine if your browser accepts cookies. This cookie is a small text file that contains no personal data and is discarded when you close your browser.
Cookies allow our site to store and retrieve information to: (i) personalize our Services, such as remembering a User’s or Visitor’s information so that the User or Visitor will not have to re-enter it during a visit or on subsequent visits;
(ii) provide customized advertisements, content, and information; (iii) monitor and analyse the effectiveness of Services and third-party marketing activities;
(iv) monitor aggregate site usage metrics such as total number of visitors and pages viewed; and (v) track your entries, submissions, and status in any promotions or other activities on the Services.
When you log in, we will also set up several cookies to save your login information and your screen display choices.
You can remove cookies by clearing your search history and block cookies by configuring your browser. Please note that our website features may not function correctly and/or may impact your website experience if you disable cookies or withdraw consent.
For more information about Cookies you can go to www.allaboutcookies.org.
How we use your personal data
We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:
- Where we need to perform the contract we are about to enter into or have entered into with you (most likely to provide services as described by CASPA when you make initial enquiries and throughout your membership).
- Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
- Where we need to comply with a legal or regulatory obligation.
- Please see the table below to find out more about the types of lawful basis that we will rely on to process your personal data.Generally, we do not rely on consent as a legal basis for processing the personal data of our members.
Purposes for which we will use your personal data
We have set out below, in a table format, a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so.
We have also identified what our legitimate interests are where appropriate.
Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal basis we are relying on to process your personal data where more than one ground has been set out in the table below.
Purpose/Activity Type of Data Lawful basis for processing (includes ‘basis of legitimate
interest’)
To register you/your child as a new member Identity Contact Performance of a contract with you (our commitment to providing you with the services
as agreed).
To process and deliver services including:
- Manage payments, fees and charges
- Collect and recover money owed to us
Identity Contact Financial Transaction Marketing
Communications
Performance of a contract with you.
Necessary for our legitimate interest (to recover debts due to us).
To register you as a Newsletter/e-bulletin
subscriber
Identity Contact Consent. To monitor your/your child’s membership including:
Recording your / your
child’s attendance at
Identity Contact Interaction Health Performance of a contract with you. CASPA sessions and/or events.
Recording relevant safeguarding & health information about you/your child.
Emergency contact
details.
To manage our relationship with you which will include: Notifying you about changes to our terms or privacy policy
Asking you to leave a review or take a survey Dealing with your
enquiries & complaints
Identity Contact Profile Marketing
Communications
Performance of a contract with you.
Necessary to comply with a legal obligation.
Necessary for our legitimate interests (to keep our records updated, to maintain good relationships with our members and to study how members use
our services).
To ensure you and your child(ren) have the best experience at CASPA. Identity Health Performance of a contract with you.
Necessary for our legitimate interests (to ensure that appropriate arrangements are
in place for our members).
To enable you to participate in any prize draws, competition or complete a survey. Identity Contact Profile Usage Marketing
Communications
Performance of a contract with you.
Necessary for our legitimate interests (to stuffy how our members use our services, to develop them and grow our
organisation).
To use data analytics to improve to improve our website, products/services, marketing, member relationships & experiences. Technical Usage Necessary for our legitimate interests (to define types of members for our services, to keep our website updated and relevant, to develop our organisation and inform our growth & development
strategies).
To make suggestions and recommendations to you about services that may be of interest to you. Identity Contact Technical Usage Profile For our members – Necessary for our legitimate interests (to develop our organisation & effectively support our families).
For our Social Media / Newsletter subscribers who haven’t yet become members –
consent.
To obtain and maintain insurance coverage, manage risks, obtain professional advice and manage dispute. Identity Contact Interaction Health Necessary for our legitimate interests (protection and assertion of our legal rights, your legal rights and the legal rights of others). How we protect your personal data
All personal data we process is done so by CASPA staff and held on Microsoft’s cloud-based Sharepoint Platform. Access to CASPA’s Sharepoint is via password protected dedicated accounts assigned to CASPA Staff with access limited to the areas appropriate to perform their duties.
All CASPA hard drives are encrypted using high level security encryption software.
Personal Data is collected via TeamUp (and stored on their servers for access as and when required). We encourage you to read TeamUp’s Privacy Policy).
We have appropriate security measures in place to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.
In addition, we limit access to your personal data to staff, contractors and other third parties on a need to know basis. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.
We have procedures in place to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
How long will we keep your personal data
Whenever we collect or process your personal data, we will only keep it for as long as is necessary for the purpose for which it was collected.
At the end of that retention period, your data will either be deleted completely or anonymised, for example by aggregation with other data so that it can be used in a non-identifiable way for statistical analysis and strategic planning.
We are legally required to hold some types of information to fulfil our statutory obligations. Unless you request for your data to be deleted, we will keep it for a period of five years after your last interaction with us. For data relating to safeguarding children & vulnerable adults this will be 10 years.
Who we share your personal data with
Sometimes we will need to share your personal data with trusted third parties for statutory purposes (for example local authorities or the police in the case of safeguarding concerns or investigations of allegations against staff). We will never sell or rent out your personal data to third parties.
We will only disclose your personal data to CASPA staff to be processed, when necessary. For example: Order information that includes what you purchased, when it was purchased and where it should be sent, and Customer information like your name, email address, and billing and shipping information.
We also share site data with the following third-party providers who help us provide our orders and store services to you.
We accept payments through PayPal. When processing payments, some of your data will be passed to PayPal, including information required to process or support the payment, such as the purchase total and billing information.
Please see the PayPal’s Privacy Policies for more details.
Unrestricted Information
Any information that you voluntarily choose to include in a Public Area of CASPA’s Services, such as a public profile page, or via a chat room, forum, message board and/or other community function, will be available to any Visitor or User who has access to that content.
Remember that any information you disclose in these areas becomes public information and you should exercise caution when deciding to disclose your personal, financial or other information. Your use of such Public Areas and community functions is at your own risk
Your Rights
You may request the deletion of your/your child’s personal data at any time.
You may ask us to confirm whether we are processing your Personal Data and, if so, to provide you with a copy of that Personal Data (along with certain other details).
If the Personal Data we hold about you is inaccurate or incomplete, you are entitled to ask for rectification or completion.
You may ask us to restrict the processing of your Personal Data in certain circumstances, e.g. if you object to us processing it.
If we rely on your consent as legal basis for processing your Personal Data, you have the right to withdraw that consent at any time. This includes, but is not limited to, cases where we use your Personal Data for direct marketing purposes.
We are obliged to comply with these requests other than in the case of information relating to safeguarding concerns where we will take advice from statutory bodies and the ICO (Information Commissioner’s Office) if appropriate.
Contact and Complaints
If you have any questions about this Privacy Notice please contact us at
If you are not happy with our response you have the right to make a complaint at any time to the Information Commissioner’s Office, the UK supervisory authority for data protection issues (www.ico.org.uk). You can contact them by calling 0303 123 1113.