Privacy Policy

Introduction
Upward Mobility (Upmo) as an organisation has a responsibility to protect and respect the privacy of individuals and to look after data provided to the organisation.

This privacy notice explains what data Upmo collects, how that data is used, where the information is stored, how long the data is stored for and how details are stored securely. For any questions about this privacy notice/policy, or for more details on how the organisation handles personal information, Upmo can be contacted at the address below.

Upmo as a data controller is responsible for deciding how it holds and uses personal information about a person. This notice explains what decisions we have taken in relation to that information.

Upmo may change this policy from time to time by updating this page. The last updated date will be displayed at the bottom of this page.

General data protection principles
In collecting and processing any personal information, Upmo will comply with the data protection law in force at the time. This requires that the personal information held about an individual must be:

  • used lawfully, fairly and in a transparent way,

  • collected only for valid purposes that we have clearly explained and not used in any way that is incompatible with those purposes,

  • relevant to the purpose explained and limited only to those purposes,

  • accurate and kept up to date,

  • kept only if necessary for the purposes explained, and kept securely.

For more information please read our General Data Protection Statement.

What information is being collected?
If consent is given by someone, Upmo may collect and store the following information while the person accesses the service online, by phone or in writing:

  • Information on students from themselves, their families, educational, social work and health care professionals and other outside agencies. Also, through ongoing contact with students, the organisation will update information required to support them to a high standard.

  • Information about employees throughout the period that an employee is working for us (for example, during recruitment & selection processes, ongoing appraisals, training and absence management)

  • Information from other sources, such as HMRC, DWP, PVG, and publicly available information (for example, social media, internet, news articles, etc) when assessing employees or partner organisations.

  • Information when someone visits the Upmo website, through the use of ‘cookies’ and other tracking technology, to understand how the person found the website, the pages viewed by the person, and the length of time the person viewed them, the type of device they use, their IP (internet protocol) address, and browser type. This allows Upmo to continue to improve website content and the online experience for users.

  • Information relating to any transactions carried out between a person and Upmo on or in relation to this website, including:

    • information related to any membership application,

    • training course bookings,

    • grant applications,

    • organisational development referrals,

    • newsletter subscriptions, such as email address and name,

    • noticeboard notices, and

    • contact forms.

  • Any other information a person chooses to send to Upmo.

Only Upmo staff, authorised contractors and approved volunteers can collect information on Upmo’s behalf.

Upmo may request specific information from a person to help the organisation confirm the person’s identity and ensure their right to access the information (or to exercise any of their rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

How will the information be used?
Upmo uses information submitted in the following ways, depending on the reason for which a person provided information to the organisation:

  • To provide individuals with services and information

  • To fulfil organisational legal and regulatory obligations

  • To manage the organisation’s relationship with a person

  • To process registrations and invoices for training courses

  • To provide organisational development and support services

  • To respond to requests from contact forms.

  • To publish noticeboards on the website

  • For the purposes of recruitment

  • To enable the organisation to review, develop and improve its website and the services offered

  • To process donations to the organisation

  • For other legitimate business purposes

Upmo will only use personal information when the law allows it to.

Who will information be shared with?
Upmo Mobility may share personal information with other companies who support us to deliver our service (eg, IT maintenance supplier, HR service supplier). Upmo will only provide these companies with the information they need to deliver the relevant service and will ensure that all personal information is treated with the same standards as if it was being handed by the organisation itself. Upmo does not allow third-party contacts to use someone’s data for their own purposes and require them to take appropriate security measures in respect of the personal information.

Upmo may also need to disclose someone’s personal information to regulatory or government bodies (eg, Care Commission, HMRC), the police or the organisation’s legal advisors.

Please note Upmo will NOT sell a person’s information to other third parties.

Does Upmo need someone’s consent to use particularly sensitive information?
Upmo does not require someone’s consent if their personal information is used in accordance with organisational written policy to carry out our legal obligations. In limited circumstances, Upmo may approach someone for their written consent to allow the organisation to process certain particularly sensitive information. If this is needed, Upmo will provide the person with full details of the information that it would like and the reason the information is needed, so the person can carefully consider whether they wish to consent.

What happens if personal information is not provided?
Upmo may be unable to provide the best service if someone does not provide certain information when requested. It may also prevent the organisation from complying with its legal obligations.

Change of purpose
Upmo will only use someone’s personal information for the reason it was collected, unless it reasonably considers that it needs to use the information for another reason and that reason is compatible with the original purpose. If Upmo needs to use someone’s personal information for an unrelated purpose, it will notify the person and explain the reasons for this so the person you can carefully consider whether they wish to consent.

How Upmo stores personal data
Upmo will take all reasonable steps to protect someone’s data in accordance with this privacy policy. The organisation has put in place appropriate measures to prevent personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

Electronic data is stored on secure computer systems and Upmo controls who has access to them. The organisation’s staff only have access to the data necessary for them to carry out their responsibilities.

All the information a person provides to Upmo is stored on encrypted servers within the European Economic Area (EEA). However, some of the organisation’s suppliers may run their operations outside the EEA or a person’s information may be transferred outside the EEA (eg, in relation to the provision of a services such as newsletter subscriptions). Although they may not be subject to the same data protection laws as companies based in the EEA, Upmo ensures that they provide an adequate level of protection in accordance with UK data protection laws.

The organisation has put in place procedures to deal with any suspected data security breach and will notify a person and any applicable regulator of a suspected breach where the organisation is legally required to do so.

How long does Upmo store the data?
Upmo will only store the information provided by someone for as long as is needed for the purpose it was originally obtained. This is dictated by legal and financial obligations as well as business requirements.

Upmo will hold someone’s personal information based on the following criteria:

  • For as long as it was reasonable business needs, such as managing the organisation’s relationship with a person and managing its operations

  • For as long as it provides goods and/or services to someone and then for as long as someone could bring a claim against the organisation

  • Retention periods in line with legal and regulatory requirements or guidance.

External web links
Upmo’s website may contain links to other websites and resources that someone may find of interest. Once a person leaves the organisation’s website, you should note that Upmo does not have any control over the external website. The organisation is not liable for someone’s protection and privacy on these external websites. A person should exercise caution and look at the privacy policies applicable to the website in question

A person’s rights
The General Data Protection Regulation 2018 provide a set of standardised data protection laws that aim to make it easier for people to understand how their data is being used and strengthens your rights.

  • The right to be informed about the processing of your personal information

  • The right of access to their personal information

  • The right to rectification – the right to have any incomplete or inaccurate information held about them corrected

  • The right to request erasure of their personal information

  • The right to request the restriction of processing their personal information

  • The right to data portability – the right to move, copy or transfer their personal information

  • The right to object to the processing of their personal information

  • Rights in relation to automated decision-making and profiling

Upmo have outlined more details on each of these rights below. If a person would like to exercise any of these rights or have any general queries about their personal information, they can contact the organisation (contact details at end of this notice).

Upmo will deal with these requests without undue delay and at the latest within one month of receiving the request. Where requests are complex and numerous, the organisation may need to extend the time limit for responding by two months.

If requests are excessive or repetitive, Upmo reserves the right to charge a fee to cover the administrative costs involved.

If a request is manifestly unfounded or excessive, Upmo may refuse to comply with the request and will provide the person who made the request with a justification for its decision.

The right for someone to access their personal information
A person has the right to request a copy of the personal information that Upmo holds about them. Upmo will aim to provide the information requested without undue delay and at the latest within one month of receiving the request.

The right to rectification – the right to edit and correct personal information
It is important to Upmo that it holds accurate information and the organisation will endeavour to ensure this is the case. A person has the right to request that inaccurate personal information is rectified or completed (if incomplete).

The right to request erasure of personal information
A person can request the deletion or removal of their personal information when there is no compelling reason for its continued processing. They do not have an automatic right to have their personal information deleted and each request will be dealt with on an individual basis. If Upmo is unable to comply with someone’s request, it will provide the person with a justification for its decision.

The right to request the restriction of processing personal information
A person has the right to request that Upmo suspends processing their personal information. In this case, Upmo may continue to hold the person’s information but will not process it any further. There may be circumstances where the organisation has an obligation to process the data and it would inform the person if that is the case before the restriction is lifted. Where possible, Upmo will endeavour to comply with a person’s request but, if that is not possible, it will provide the person with a justification for its decision.

The right to data portability – the right for a person to move, copy or transfer their personal information
A person has the right to receive a copy of their personal information or to ask Upmo to share their personal information with another organisation or individual. Upmo will endeavour to facilitate these requests, although they will be considered on an individual basis as it may need to seek agreement from all parties involved and assess technical feasibility.

If Upmo provides information directly to an individual or another organisation, it will take appropriate measures to ensure the information is transmitted securely and to the right destination. Upmo is not responsible for the security or subsequent processing that may be carried out by these parties after it shared someone’s personal information.

The right for someone to object to the processing of their personal information
A person has the right to object to the processing of their personal information - in particular, to data processed for direct marketing purposes. For example, if they no longer want to receive Upmo’s newsletter, they may choose to unsubscribe. In these circumstances, Upmo may continue to hold personal information to ensure it suppresses further communications to the person.

If someone objects to the processing of their personal information so that Upmo can provide them with a service, the organisation will consider the person’s request on an individual basis. There may be circumstances where Upmo have an obligation to process the data and would inform the person if that is the case before the restriction is lifted. Where possible, Upmo will endeavour to comply with a person’s request but, if that is not possible, it will provide the person with a justification for the decision.

Rights in relation to automated decision-making and profiling
Some organisations may make decisions about a person using only technology without their employees being involved (eg, applications for online loans or insurance policies). Upmo does not currently use any automated decision-making or profiling technology.

How to contact Upmo
Data Protection
Upward Mobility
15 Links Place
Edinburgh
EH6 7EZ

Telephone: 0131 661 4411
Email: info@upmo.org
ICO Registration Reference: Z5984382

The right to make a complaint
A person can raise a concern to Upmo about how the organisation handles their personal information (see contact details above). A person has the right to make a complaint to the Information Commissioner’s Office (ICO) if they are not happy with how Upmo processes their personal information, or how it has handled their request.

The ICO is the UK supervisory authority for data protection issues.

www.ico.org.uk/concerns
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Changes to the privacy notice
Upmo reserves the right to update this privacy notice at any time. The latest version of this policy will be available on the organisation’s website, If there is a major change to the privacy policy, Upmo will add a notice to its website and may contact individuals by email (where appropriate). From time to time, Upmo may also notify individuals in other ways about the processing of their personal information.

This privacy policy was last updated in November 2019.