Last updated: October 2023
1. Introduction
During the course of our activities, Reprieve, Registered Charity Number 1114900 of PO Box 78292, London, E1W 9SS (“we” or “us”), as controller will process personal data (which may be held on paper, electronically, or otherwise) about people like you whom we assist.
We recognise the need to treat such personal data in an appropriate and lawful manner, including in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”). The purpose of this notice is to inform you of how we will handle your personal data.
2. Personal Data we collect
We may collect the following categories of personal data about you:
- personal details, including your name, contact information (including address, e-mail address, and telephone number), a copy of your passport/s and (if applicable) your visa/s, date of birth, physical description (including distinguishing features), details of family members and employers, lifestyle and social circumstances, education and employment details, personal and family photographs, behaviour, financial details, and details of financial dealings;
- legal details, including potentially legally privileged information relating to your case, details on the commission or alleged commission of any offence, any proceedings for any offence committed or alleged to have been committed, the disposal of those proceedings and the sentence of any court in those proceedings; and
- sensitive details, including medical and psychiatric records and details of assessments, racial or ethnic origin, political opinions, religious or philosophical beliefs, data concerning sex life or sexual orientation.
We may collect this personal data:
- directly from you; and
- from other sources, including through our activities in the course of your case, such as when we make investigations like raising freedom of information act requests and subject access requests. Such sources include:
- electronic sources, such as email, document management systems, and telephony systems;
- publicly available sources, including websites and newspapers; and
- third parties, including formal and informal partner law firms and lawyers, formal and informal partner non-governmental organisations and civil society, public authorities, governmental departments, foreign consuls, health professionals, current and former employers, family and friends.
If you do not provide us with the personal data we ask you for, this may have an impact on the support Reprieve can provide if it makes it more difficult or we are unable to assist you without such information.
3. Purposes and Legal Bases for Processing Personal Data
| Why do we process your personal data? | Which personal data do we process for this purpose? | What is the legal basis for processing? |
| Requesting access to and accessing any and all medical, occupational, financial or other records relating to you | Personal details | – Performing our contract with you to provide you with your services; or – To protect your vital interests |
| Legal details; sensitive details | – To establish, exercise or defend your legal rights; or – With your consent; or if you are physically or legally incapable of providing consent, where necessary to protect your vital interests | |
| Sharing information with Partner organisations and other organisations or individuals who we believe will support your case | Personal details | – Performing our contract with you to provide you with our services; or – To protect your vital interests |
| Legal details; sensitive details | – To establish, exercise or defend your legal rights; – To inform elected representatives about prisoners in the substantial public interest; or – With your consent; or if you are physically or legally incapable of providing consent, where necessary to protect your vital interests | |
| Managing press messages in relation to your case | Personal details | – Performing our contract with you to provide you with our services; – To further the legitimate interests of raising the profile of your case and raising awareness of human rights abuses; or – To protect your vital interests |
| Legal details; sensitive details | – To establish, exercise or defend your legal rights; – Journalistic publication in the public interest (or substantial public interest for sensitive details) in connection with unlawful acts or seriously improper conduct; or – With your consent; or if you are physically or legally incapable of providing consent, where necessary to protect your vital interests | |
| Managing campaigns and advocacy in relation to your case | Personal details | – Performing our contract with you to provide you with our services; – To further the legitimate interests of raising the profile of your case and raising awareness of human rights abuses; or – To protect your vital interests |
| Legal details; sensitive details | – To establish, exercise or defend your legal rights; – Journalistic publication in the public interest (or substantial public interest for sensitive details) in connection with unlawful acts or seriously improper conduct; – To inform elected representatives about prisoners in the substantial public interest; or – With your consent; or if you are physically or legally incapable of providing consent, where necessary to protect your vital interests | |
| Assessing your case in order to determine whether Reprieve can assist you | Personal details | – Our legitimate interest in determining the best use of our limited resources in order to achieve our charitable goals |
| Legal details; sensitive details | – To establish, exercise or defend your legal rights; or – With your consent; or if you are physically or legally incapable of providing consent, where necessary to protect your vital interests | |
| Complying with our regulatory and compliance obligations | Personal details | – This is necessary for us to comply with our legal obligations |
| Informing the public about Reprieve’s work with you and other victims of extreme human rights abuses, in order to raise awareness of human rights issues such as the death penalty and canvas support | Personal details; legal details; sensitive details | – Journalistic publication of the information in the public interest |
| Raising funds to assist in cases such as yours through public education and campaigning about your case | Personal details; legal details; sensitive details | – To further the legitimate interests of raising funds for Reprieve’s work Journalistic publication of the information in the public interest; or – With your consent |
4. Disclosure of Personal Data
We may share your personal data with the following organisations:
- third parties if we are under a duty to disclose or share that personal data in order to comply with any legal obligation, or to protect the rights, property, or the safety of us, our employees, volunteers, donors, those whom we assist, or others, such as:
- clinical psychiatrists who support our casework;
- UK local authorities; and
- the Foreign, Commonwealth & Development Office.
- third parties who help us to provide our services to you where this is in your best interests and is legally permissible and we have a legal basis as set out in section 3, such as:
- lawyers acting on behalf of an individual whom we assist;
- trusted partners who we are working alongside;
- members of the general public on our supporter database;
- media outlets in the UK or the US; or
- politicians and government officials in the UK, the US, or another jurisdiction.
We may sometimes find it necessary to transfer personal data outside the United Kingdom, including to countries which do not have strict data protection laws. However, we will only transfer your personal data to a third party outside the UK:
- where the third party is located within the European Economic Area or in a country which has been assessed by the European Commission (or an equivalent UK body) as ensuring an adequate level of protection for personal data; or
- on the basis of an agreement designed to protect personal data in the appropriate form approved for this purpose by the European Commission (or an equivalent UK body) – please contact the Data Compliance Lead using the contact details in section 8 below if you would like to see a copy of any of these agreements; or
- where you have given consent to the transfer taking place.
5. Retention of Personal Data
We will delete or permanently anonymise personal data when it is no longer needed for the purposes for which it was collected.
6. Security
We will take appropriate technical and organisational security measures to protect the personal data that we process against unauthorised or unlawful processing and accidental loss, destruction or damage. We will ensure that these measures provide a level of security appropriate to the nature of the data concerned and the risks associated with unauthorised or unlawful processing and accidental loss, destruction or damage. In assessing the required level of security we will take account of the security measures available and their cost.
7. Rights in relation to Personal Data
You have the following rights with respect to your personal data:
- to be provided with a copy of any personal data that we hold about you at any time;
- to request that we, without undue delay, update or correct any of your personal data which is inaccurate or incomplete;
- to object to our processing of your personal data; and
- where the processing is carried out on the basis of your consent, to withdraw your consent to such processing. To do this, please contact us using the contact details provided in section 8 below.
You may also have the following rights:
- to request that we, without undue delay, delete any of your personal data;
- to request the restriction of our processing of your personal data; and
- to (a) receive the personal data you have provided to us, in a structured, commonly used and machine-readable format; and (b) transmit it to another data controller.
If you wish to exercise any of these rights, please contact us using the contact details provided in section 8 below.
If you consider that this notice has not been followed, please contact the Data Compliance Lead or your case worker as set out in section 8 below. Any breach of applicable law will be taken seriously. You can also raise complaints or concerns about our processing of your personal data with the Office of the Information Commissioner, which regulates data protection in the UK. Details are available at www.ico.org.uk.
8. Contact us
If you have any questions about this notice, please contact the Data Compliance Lead:
- Deputy Director, Legal and Governance: [email protected]
- or, to the extent that this is not possible, your case worker, who can liaise with the Data Compliance Lead on your behalf.
9. Changes to this Privacy Notice
We may change this Privacy Notice from time to time. Please check our website regularly for any updates.
إشعار حماية البيانات الخاص بمنظمة ريبريف
فيما يتعلق بالأشخاص الذي نساعدهم
تاريخ آخر تحديث: نوفمبر 2020
مقدمة
في سياق ممارستنا لأنشطتنا، سوف تقوم منظمة ريبريف، المسجلة كمؤسسة خيرية تحت رقم 1114900 والتي عنوانها البريدي هو PO BOX 72054, London, EC3P 3BZ (والتي يُشار إليها هنا بالضمير “نحن” أو “ناء الفاعلين/المفعولين/المتكلمين”)، بصفتها مراقب البيانات، بمعالجة البيانات الشخصية (التي قد يتم الاحتفاظ بها على الورق أو إلكترونيًا أو غير ذلك) الخاصة بالأشخاص مثلك الذي نقدم لهم المساعدة. ونحن ندرك الحاجة إلى معالجة هذه البيانات الشخصية بطريقة مناسبة وقانونية، بما في ذلك وفقًا للائحة العامة لحماية البيانات (لائحة الاتحاد الأوروبي) 2016/679 (“GDPR”). يتمثل الغرض من هذا الإشعار في إعلامك