Privacy notice

What does Catch22 do?

Catch22 is a national organisation that works across England and Wales delivering services in a variety of settings. These include schools, colleges, social care, victim services, family support, prisons, apprenticeships and employment support.
We have been around for over 200 years and our focus is about making a difference to people by delivering our 3 ‘P’s – having good people around, having a good place to live/study/work, and having good purpose in life. Different services will focus on different aspects, but we aim to address those three elements to support people to thrive.

What does this service do?

Victim First is a free, independent and confidential support service for victims and witnesses of crime, in Leicester, Leicestershire and Rutland. We support victims and witnesses of all ages through offering emotional support, practical support, advocacy and signposting to
other support services for more specialist provision.

What information do we collect and why do we need it?

So that we can provide you with a service we will need to collect some information about you. Some things will be obvious but if you have any queries about any of the information we ask you for or why we need it then please ask us. The list below covers the key things we will ask for:

Full name
Date of Birth
Address
Contact number
Email address
Crime type
Crime details
Parent/Carer details (if you are 13 years old or under)

We may ask you to give us some more sensitive information (also known as ‘special data’) like your gender, age, ethnicity, sexual orientation, religion and/or any disabilities. We will explain to you why we need this information and you are free to refuse to give it if you do
not wish to do so.

We need your information for us to remain in contact with you and to keep accurate records of the support you are receiving from or through Victim First. The information we hold and process will be used by our staff for providing you with support and we will keep and use it to enable us to run the business and manage our relationship with you effectively, lawfully and appropriately. Your information is collected and used whilst you receive support from Victim First. We will hold your data for a period of time after your support ends with us unless you tell us otherwise. This is so that if you choose to return for further support you will not have to tell us all of the information again.

What law applies and sets out the legal basis for us to collect and hold your information?

The two main pieces of law that apply are:

The UK General Data Protection Regulation (also known as GDPR), and
The Data Protection Act 2018

We are able to process your data under law on the following three bases:

Individual Consent (GDPR Article 6.1.a)
Performance of a contract (GDPR Article 6.1.b)
Public Task (GDPR Article 6.1.e)

This means that we can only hold and use your information where you have either given us consent to do so, where our contract requires us to or where, as part of our compliance with the Victims Code or law, we are required to do so. We are not permitted to use your information for any other purpose than the ones that we tell you about and that fall under
the three legal bases described.

The exception to this is that we may be required, by law or for the purpose of protecting others, to share your data: Where you disclose information that poses a risk to yourself or others
In the interests of safeguarding children or vulnerable adults
Pursuant of the Terrorism Act 2000
Any information that threatens the security of the establishment
This information will be shared in compliance with legal obligation(s) and/or for your/others vital interests.

The ‘special data’ that we collect has to meet even more of a legal test and our legal basis for collecting this is:
We require your information in order for us to remain in contact with you and maintain accurate records of the support you are receiving from or through Victim First.

We will not share this information with others without your explicit consent.

We are able to process your data under law on the following three bases:

Individual Consent (GDPR Article 6.1.a)
Performance of a contract (GDPR Article 6.1.b)
Public Task (GDPR Article 6.1.e)

The exception to this is that we may be required, by law or for the purpose of protecting others, to share your data:

Where you disclose information that poses a risk to yourself or others
In the interests of safeguarding children or vulnerable adults
Pursuant of the Terrorism Act 2000
Any information that threatens the security of the establishment. This information will be shared in compliance with legal obligation(s) and/or for your/others vital interests.

Some of the information we will collect and use is termed ‘Special data’ and this requires us to be able to show a further legal basis to do that. In this case we will rely on: –

Explicit Consent (GDPR Article 9.2.a)
Law (GDPR Article 9.2.g)
Provision of health or social care (GDPR Article 9.2.h)

If you provide us with information about the suspect/offender as part of our service to you, we are able to process that under the Data Protection Act 2018 Part 2 (14) of Schedule 1 where the information is gathered and necessary for the provision of confidential counselling, advice or support to you.

The Information Commissioner’s Office has given further guidance that sets out when these conditions can be used as the legal basis for processing your information and this can be supplied to you if you wish to see it.

Where do we get your data from?

The majority of the information we hold comes from you. Additionally though, we will hold information that has come from other organisations that may have referred you to our service with your consent, including:

Leicestershire Police
Action Fraud
Sentinel
British Transport Police

It is important to note that we will only contact you where we know that that you have given your explicit consent to the referring agency before they passed on your information to us.

We will only share information about you to other organisations where we have a record that you have agreed for your details to be passed on to another service, to provide you with further or additional support.

We may have to share information if we are legally obliged to do so, for example where we have serious concerns about your safety or that of someone else associated with you. In these cases, we would share the relevant information with safeguarding organisations. (Social Service, the Police or any other Emergency Service) if you or anyone else is at risk of harm.

We may need to share information with the Police where they are conducting an investigation. In these cases, only the information required will be disclosed and will be done in line with the requirements of the Data Protection Act 2018.

We may share information about you with:

Safeguarding organisations (Social Service, the Police or any other Emergency Service) if you or anyone else is at risk of harm
Referral agencies (with your explicit prior consent)

How long will we hold on to your information for?

We will only hold on to your information for as long as permitted according to the basis it was gathered under in order to provide you with a service. There may be legal reasons that require us to hold on to your information for a specified period of time. We can provide you
with details of what information is held and how long for if you wish to have it.

Your information is held on the HALO – our case management system. Only Victim First has access to this information.

Your information will be held for the period of time that your case is ‘live’ with us. We then hold the information for up to 6 years in case you return to the service for further support and to be able to report to our commissioner on the work that we have carried out.

Sometimes there may be legal reasons we have to retain the information for a specified period of time and there may also be circumstances where it is appropriate within legal and best practice requirements to retain the information for longer, but we will inform you of this.

What happens if the information in the records is wrong?

You will need to be specific about what information you think may be wrong and why, along with what you think we should do to correct it. If you can prove the information is incorrect, we will change it. If we cannot amend your record in the way you would like, we will explain
the reason for this. You will be able to see a copy of your amended record.

What rights do you have over the information that we hold on your behalf?

You have a number of rights over your data that we are required by law to uphold. You have the following rights:

The right to be informed – How we will use your information
The right of access – How to access information we hold about you
The right to rectification – Request that information that is held about you and is inaccurate or incomplete be rectified
The right to erasure – Requests that under special circumstance information held on you may be removed or deleted
The right to restrict processing – Block or suppress processing of information about you
The right to data portability – Obtain and re-use information held about you for your own purposes across different services
The right to object – Object to processing of information about you
The right to withdraw consent – At any time where your information is being processed based on that consent, for example where Victim Support is sharing your information based on consent
The right to lodge a complaint with the Information Commissioners Office (ICO)

If you would like to request a copy of the information we hold about you, please contact DPO@catch-22.org.uk.

If you think the information we hold on you is wrong, please contact DPO@catch-22.org.uk. If you have any questions about this privacy policy or of our treatment of your personal data, email DPO@catch-22.org.uk or write to:

Data Protection Officer
Catch22
27 Pear Tree Street
London
EC1V 3AG

If you feel that we have not processed your data correctly and in accordance with GDPR and the Data Protection Act 2018, you have the right to make a complaint to the Information Commissioners Office (body that regulates Data Protection). Please visit https://ico.org.uk/ or call 0303 123 1113 in order to lodge a complaint with the regulator

Data controller

Victim First is a service delivered by Catch22. Catch22’s data protection registration number is Z1473239.

Contact

If you have any questions about this privacy policy or of our treatment of your personal data, email victimfirst@catch-22.org.uk or write to:

Victim First, Leicestershire Police Force Headquarters, St Johns, Enderby, Leicester, LE19 2BX

Downloads

PDF

Victim First Privacy Notice (PDF, 232KB)

On this page