Privacy notice

Who We Are

Leicester, Leicestershire and Rutland (LLR) Office of the Police and Crime Comissioner (OPCC)

The OPCC is the Data Controller for the Victim First Service. The OPCC is responsible for commissioning the service and ensuring your personal information is handled safely and lawfully.

Catch22 Charity LTD.

Catch22 delivers the Victim First Service on behalf of the OPCC. Catch22 also acts as a Data Controller for the data it holds when providing support services, and a Data Processor when processing data strictly under OPCC instruction.
The service is jointly delivered with Leicester, Leicestershire, and Rutland Constabulary as part of the county’s victim support arrangements.

What does Catch22 do?

Catch22 is a national organisation that works across England and Wales delivering services in a variety of settings. These include schools, colleges, social care, victim services, family support, prisons, apprenticeships and employment support.

We have been around for over 200 years and our focus is about making a difference to people by delivering our 3 ‘P’s – having good people around, having a good place to live/study/work, and having good purpose in life. Different services will focus on different aspects but we aim to address those three elements to support people to thrive.

Where Catch22 determines the purposes and means of processing personal data in delivering support services, it acts as an independent Data Controller. Where Catch22 processes personal data solely on behalf of the OPCC and under its instructions, Catch22 acts as a Data Processor. Appropriate data sharing and processing agreements are in place between the parties.

What does this service do?

Victim First Service is a free, independent, and confidential support service provided to anyone in Leicester, Leicestershire and Rutland who has been affected by crime. We have a team of trained care co-ordinators to help you cope and recover from the impact of crime. This can include emotional and practical support, crime prevention advice, advocacy and support.

What information do we collect and why do we need it?

So that we can provide you with a service we will need to collect some information about you. Some things will be obvious but if you have any queries about any of the information we ask you for or why we need it then please ask us. The list below covers the key things we will ask for:

– Full name
– Date of Birth
– Address
– Contact details
– Crime type
– Crime details
– Needs assessment responses
– Safe or preferred contact method
– Parent/Carer details (if you are a young victim)

We may ask you to give us some more sensitive information (also known as ‘special data’) like your gender, age, ethnicity, sexual orientation, religion and/or any disabilities. We will explain to you why we need this information and you are free to refuse to give it if you do not wish to do so.

We need your information for us to remain in contact with you and to keep accurate records of the support you are receiving from or through Victim First Service.

We use your information to:
– Contact you and provide support
– Assess your needs and risks
– Record the support you receive
– Help you access other relevant services
– Meet statutory reporting obligations to the OPCC

What law applies and sets out the legal basis for us to collect and hold your information?

The two main pieces of law that apply are:

– The UK General Data Protection Regulation (also known as GDPR), and
– The Data Protection Act 2018

We do have to have a legal basis for processing your information and this is:

– Individual consent (GDPR Article 6.1a)
– Performance of a contract (GDPR Article 6.1b)
– Public task (GDPR Article 6.1e)

The ‘special data’ that we collect has to meet even more of a legal test and our legal basis for collecting this is:

– Explicit consent (GDPR Article 9.2a)
– Substantial public interest (GDPR Article 9.2g)
– Provision of health or social care (GDPR Article 9.2h)

If you provide us with information about the suspect/offender as part of our service to you, we are able to use that under the Data Protection Act 2018 Part 2 (14) of Schedule 1 where information is gathered for the provision of confidential advice or support to you.

The Information Commissioner’s Office has given further guidance that sets out when these conditions can be used as the legal basis for processing your information and this can be supplied to you if you wish to see it

Where do we get your data from?

The majority of the information we hold comes from you. Additionally though, we will hold information that has come from other organisations that may have referred you to our service with your consent, including:

– Leicestershire Police
– Other police forces if the crime happened outside of Leicestershire
– Action Fraud
– Local authority
– Other support organisations

It is important to note that we will only contact you where we know that that you have given your explicit consent to the referring agency before they passed on your information to us.

We will only share information about you to other organisations where we have a record that you have agreed for your details to be passed on to another service to provide you with further or additional support.

We may have to share information if we are legally obliged to do so, for example where we have serious concerns about your safety or that of someone else associated with you. In these cases we would share the relevant information with safeguarding organisations (Social Service, the Police or any other Emergency Service) if you or anyone else is at risk of harm.

We may need to share information with the police where they are conducting an investigation. In these cases, only the information required will be disclosed and will be done in line with the requirements of the Data Protection Act 2018.

A computer system supplied by Footwork Solutions is used to store your information and they are required to evidence the security they have for their system as part of our contract with them. Only our staff have access to your information when stored on the system.

Where appropriate, Catch22 may use approved AI-assisted transcription and note-taking technology to support the accurate recording of discussions between you and our staff. Audio recordings may be converted into written transcripts and summaries, which are reviewed by an authorised member of staff before being added to our case management systems. These tools are used to assist staff in producing accurate records and improving service delivery; they do not make decisions about you, assess your eligibility for services, or replace professional judgement.

Where such technology is used, personal data may be processed by the technology provider and its authorised sub-processors acting on Catch22’s behalf. All providers are subject to appropriate contractual safeguards, including data processing agreements, and may only process personal data in accordance with Catch22’s documented instructions and applicable data protection legislation.

Personal data processed through approved AI-assisted technologies is not used to train publicly available AI models. Audio recordings, transcripts and summaries are retained only for as long as necessary for service delivery and are subject to contractual, technical and organisational safeguards.

How long will we hold on to your information for?

Catch22 retains your personal information only for as long as it is necessary for the delivery of Victim First Service and to meet legal, contractual, and safeguarding requirements.

– While you are engaged with the service, your information will be held securely as an active record.

– Once our work with you has ended, your information will be archived and retained in line with Catch22’s Records Retention Schedule.

– Where AI assisted transcription services are used, recordings, transcripts and summaries may be retained for shorter operational periods by the technology provider before being securely deleted in accordance with contractual requirements and Catch22 retention policies.

– For Victim First Service, records are normally retained for seven (7) years from the end of the relevant contract, unless a longer retention period is required by law or instructed by the commissioning authority.

– Where information must be retained for a longer period (for example, due to statutory requirements, safeguarding concerns, or ongoing legal proceedings), this will be done lawfully, securely, and in accordance with applicable guidance.

At the end of the relevant retention period, records will be securely deleted or anonymised.

What happens if the information in the records is wrong?

You will need to be specific about what information you think may be wrong and why, along with what you think we should do to correct it. If you can prove the information is incorrect, we will change it. If we cannot amend your record in the way you would like, we will explain the reason for this. You will be able to see a copy of your amended record.

We do not undertake automated decision-making or profiling that produces legal effects or similarly significant effects on individuals.

Certain rights may be restricted where exemptions apply under the Data Protection Act 2018, including safeguarding, crime prevention, law enforcement and legal claims.

What rights do you have over the information that we hold on your behalf?

You have a number rights over your data that we are required by law to uphold. You have the following rights:

The right to be informed – How we will use your information
The right of access – How to access information we hold about you. This includes information generated through approved AI-assisted transcription tools where such information forms part of your record
The right to rectification – Request that information that is held about you and is inaccurate or incomplete be rectified
The right to erasure – Requests that under special circumstance information held on you may be removed or deleted
The right to restrict processing – Block or suppress processing of information about you
The right to data portability – Obtain and re-use information held about you for your own purposes across different services
The right to object – Object to processing of information about you
The right to withdraw consent – At any time where your information is being processed based on that consent, you can withdraw your consent and processing cease
The right to lodge a complaint with the Information Commissioners Office (ICO)

If you would like to request a copy of the information we hold about you, please contact DPO@catch-22.org.uk.

If you think the information we hold on you is wrong, please contact DPO@catch-22.org.uk.

If you have any questions about this privacy policy or of our treatment of your personal data, email dpo@catch-22.org.uk or write to:

Data Protection Officer
Catch22
27 Pear Tree Street
London
EC1V 3AG

For data protection enquiries relating to the Office of the Police and Crime Commissioner, please contact the OPCC via its published data protection contact channels.

If you feel that we have not processed your data correctly and in accordance with GDPR and the Data Protection Act 2018, you have the right to make a complaint to the Information Commissioners Office (body that regulates Data Protection). Please visit https://ico.org.uk/ or call 0303 123 1113 in order to lodge a complaint with the regulator.

Downloads

PDF

Victim First Privacy Notice (PDF, 266KB)

On this page