Privacy Policy & Cookies Policy - The Society of St James

Privacy & Cookies Policy

Last updated 4 September 2026

1. Data Controller & General Information

The Society of St James (“we”, “us”, “SSJ” or “The Society of St James”) is a company limited by guarantee with company number 03009700, a registered charity with charity number 1043664, and a Housing Association with association reference LH4337. We are listed on the Information Commissioner's Office (“ICO”) register of data controllers with registration number Z5023915.

At SSJ, our aim is to be completely transparent about the data we collect when you communicate with us, use our services, work or volunteer with us, or support our charitable work. We take protecting your privacy very seriously and will always take all reasonable steps to ensure your information is safe.

This privacy statement applies across all SSJ services and operations, including our housing and homelessness support, care homes, floating support, recovery services, domestic abuse support, social enterprises (such as Jamie’s Computers and Café in the Park), venue hire, and fundraising activities.

2. Our Commitments to You

We will only collect information that is relevant and necessary.
We will use your personal information fairly and only for the specified purposes for which it has been given to us.
We will make sure your information is updated when you tell us about any changes.
We will not hold your information for any longer than necessary.
We will make it easy for you to exercise your rights under data protection law.
We will ensure sensitive special category data and criminal history data are handled with heightened technical and organisational safeguards.

3. Processing Client & Service User Data

Processing Client & Service User Data

As a provider of housing, residential social care, recovery support, and specialist interventions, SSJ processes personal and special category data relating to our clients and service users.

Categories of Data Collected

Identity & Contact Details: Name, date of birth, address history, phone number, and national insurance number.
Physical & Mental Health Data: Medical history, substance use records, care and support plans, risk assessments, occupational health notes, and therapy records.
Residential Care Home Specifics: Care Quality Commission (CQC) assessment records, Medication Administration Records (MAR charts), dietary/mobility needs, Deprivation of Liberty Safeguards (DoLS) documentation, and daily care logs.
Housing & Financial Circumstances: Tenancy records, financial circumstances, welfare benefit information, and rent account details.
Emergency Contacts: Next-of-kin, emergency contact details, and named advocates.
Criminal Offence & Safeguarding Data: Offence data, probation status, multi-agency risk assessment (MARAC/MAPPA) details, and statutory safeguarding assessments (where relevant to integrated offender management or floating support).

Summary of Lawful Bases for Client & Service User Processing

Safeguarding and Multi-Agency Sharing: We work in partnership with local authorities, NHS bodies, CQC inspectors, probation services, and emergency services plus other third sector agencies where appropriate. Information is shared on a confidential basis for care coordination. However, where a serious risk of harm or a statutory safeguarding obligation arises, relevant personal data may be shared without prior consent as permitted under UK privacy law and the NHS Information Governance Framework.

Retention Schedules: Client records are maintained for the duration of your tenancy or support placement, and retained following departure according to service type:

Housing, Floating Support, & General Client Records: Retained for 6 years post-exit in line with limitation periods and legal claims governance.
Residential Care Home Records: Retained for 8 years following departure or discharge in accordance with CQC requirements and the NHS Records Management Code of Practice (or longer where required by statutory duty).

4. Processing Job Applicant & Employee Data

When you apply for employment or work at SSJ, we process personal data necessary for recruitment, payroll, employer pension management, HR administration, and fulfilling statutory duties.

Job Applicants: We collect CVs, application forms, references, interview notes, right-to-work documentation, and Criminal Record/DBS checks where required for the role.
Lawful Basis: Taking steps prior to entering into a contract (UK GDPR Art 6(1)(b)), legal compliance (Art 6(1)(c)), and statutory duties under employment law for criminal/health data (Art 9(2)(b) / Data Protection Act 2018).
Retention: Unsuccessful applicant records are retained for 12 months following the recruitment outcome, after which they are securely deleted.
Current & Former Employees: Comprehensive HR, payroll, occupational health, and training records are governed by our internal Employee Privacy Policy, provided upon onboarding. This includes personal data such as name, address, date of birth, National Insurance number, medical history, bank details, next of kin, identity documents, and employment records (such as supervision notes and formal proceedings).
Retention: Following the termination of employment, ex-employee records are generally retained for 6 years to comply with statutory tax (HMRC) obligations and defend against potential legal claims, after which they are securely erased (unless specific regulations, such as health and safety surveillance records, require a longer statutory retention period).

5. Processing Volunteer Data

Volunteers support SSJ across our projects, cafes, and administrative roles.

Data Collected: Name, contact details, emergency contacts, skills/experience, references, health/accessibility requirements (where relevant), and DBS check details where required for specific placements.
Lawful Basis: Legitimate Interests (UK GDPR Art 6(1)(f)): Coordinating volunteer placements, operational management, and ensuring site safety.
Legal Compliance / Official Authority (Art 6(1)(c) & Art 10): Processing DBS checks in accordance with Schedule 1 of the Data Protection Act 2018 where safeguarding laws require it.
Explicit Consent (Art 9(2)(a)): For any medical or disability information provided voluntarily to assist with reasonable adjustments.
Retention: Volunteer records are retained for the duration of your active volunteering period plus 6 years following departure to fulfil health, safety, and governance obligations, after which they are securely erased.

6. Processing Fundraising, Donor & Supporter Data

We collect personal data when you donate, join a campaign, respond to an appeal, or submit forms via our website. This enables us to process your support, manage donor relationships, and send relevant updates.

Categories of Data Collected: Name, contact details, donation history, Gift Aid declaration status, communication preferences, and records of your interactions or correspondence with us.

Marketing Communications & PECR Compliance

Email and SMS: We send direct marketing updates regarding campaigns, fundraising appeals, and events only where you have provided explicit opt-in consent (UK GDPR Art 6(1)(a)). You can opt out at any time via the unsubscribe link in any message or by emailing info@ssj.org.uk.

Post and Phone: We may send fundraising communications by post or contact you by phone under our Legitimate Interests (Art 6(1)(f)) to engage our supporter base. We screen telephone numbers against the Telephone Preference Service (TPS) prior to calling and will not contact you if you have opted out or registered with the TPS (unless you have given us explicit consent to call).

Financial Processing & Third Parties

Payment Processing: SSJ does not directly store credit or debit card details on our servers. Online payments are processed securely through certified payment gateways (e.g., Stripe). Third-party fundraising platforms (e.g., JustGiving) process data under their own privacy policies when you donate through their sites.

Gift Aid & Retention: Where you claim Gift Aid, HMRC requires us to retain your name, address, tax status, and donation history for 7 years from the date of your last donation (UK GDPR Art 6(1)(c) - Legal Obligation). General financial transaction records are retained for 6 years following the end of the financial year.

Legacies

Estate & Legacy Data: Where a donor leaves a gift in their Will to SSJ, we process identity details, correspondence, estate documentation, and executor information under our Legitimate Interests (Art 6(1)(f)) and legal duty to administer gifts.

Retention: Legacy administration records are retained for 12 years following the complete administration of the estate to resolve potential legal disputes, handle probate inquiries, and maintain statutory financial accounting.

7. Processing Other Stakeholder & Business Data

Suppliers & Contractors: We collect contact details, business information, banking details, and transaction histories to administer commercial contracts, manage procurement, and process payments (UK GDPR Art 6(1)(b) – Contract). Financial transaction records are retained for 6 years following the end of the financial year for tax and accounting compliance.

Venue Bookings (e.g., Quaker Meeting House): We process name, contact details, organisation name, and billing information to manage venue bookings, coordinate events, and issue invoices (Art 6(1)(b) – Contract). Records are retained for 6 years post-booking for financial accounting.

Physical Site Visitors & Event Guests: We collect basic visitor details (name, organisation, arrival/departure times) via guest sign-in logs to manage building safety, track emergency evacuations, and ensure site security (Art 6(1)(f) – Legitimate Interests). Visitor logs are retained for 3 months before destruction.

CCTV & Physical Site Visitors: Closed-circuit television (CCTV) operates at selected SSJ premises, residential care facilities, and social enterprises to protect property, prevent and detect crime, and ensure the safety of staff, service users, and visitors (Art 6(1)(f) – Legitimate Interests).

Clear signage is displayed at all camera locations to notify individuals when entering monitored areas.

Footage is automatically overwritten after 30 days, unless retained longer to investigate a safety incident, report a criminal offense, or respond to formal legal proceedings or Subject Access Requests.

8. Cookies & Website Tracking Technologies

Cookies are small text files stored on your device when visiting our website. They help us analyse web traffic and improve browsing experience.

Revised Cookie Consent Policy:

In compliance with the Privacy and Electronic Communications Regulations (PECR) and UK GDPR, non-essential cookies—such as analytics tools or marketing pixels—are disabled by default and will only activate if you explicitly give your consent via our Cookie Consent Banner. You can change or withdraw your consent at any time by clicking the "Cookie Settings" link in the footer of our website.

Strictly Necessary Cookies: Essential for the core operation of our website, enabling secure navigation, page load balancing, and session accessibility (Lawful Basis: UK GDPR Art 6(1)(f) – Legitimate Interests; exempt from PECR consent requirements).

Performance & Analytics Cookies (e.g., Google Analytics): Allow us to count visits and traffic sources so we can measure and improve the performance of our site. These tools help us understand which pages are most popular and how visitors navigate the site. All IP addresses are anonymised, and data is processed on an aggregated basis (Lawful Basis: UK GDPR Art 6(1)(a) – Explicit Consent).

Functional & Third-Party Cookies: Set by external services integrated into our site (e.g., embedded YouTube video players, interactive maps, or payment processing portals like Stripe). These enable enhanced features and personalised content (Lawful Basis: UK GDPR Art 6(1)(a) – Explicit Consent).

Managing Browser Cookies: In addition to our on-site Cookie Consent Banner, most web browsers allow you to manage or block cookies through your browser settings. Please note that blocking essential cookies may impact the functionality of certain areas of our website.

9. International Data Transfers

Where third-party service providers or cloud platforms store or process personal data outside the UK or EEA (such as cloud database providers or analytics services based in the United States), SSJ ensures legally compliant transfer mechanisms are implemented. These include UK International Data Transfer Agreements (IDTAs) or standard contractual clauses guaranteeing equivalent protection standards.

10. Your Data Protection Rights

Under data protection legislation, you have the following rights regarding your personal information:

Right to be Informed: To receive clear, transparent information about how your data is used (fulfilled via this notice).
Right of Access: To request a copy of the personal data SSJ holds about you (Subject Access Request).
Right to Rectification: To request correction of inaccurate or incomplete personal records.
Right to Erasure ("Right to be Forgotten"): To request deletion of your personal data where no legal override applies.
Right to Restrict Processing: To ask us to pause processing your data in specific scenarios.
Right to Data Portability: To receive your data in a structured, standard electronic format.
Right to Object: To object to processing based on legitimate interests or direct marketing.
Right to Withdraw Consent: Where processing relies on consent, you may withdraw it at any time.

All rights can be exercised free of charge. We aim to respond within one month of receiving your request.

Please contact our Data Protection Officer at info@ssj.org.uk.

Right to Lodge a Complaint with the Supervisory Authority:

If you are dissatisfied with how SSJ handles your data, we encourage you to contact us directly to resolve the matter. However, you also have the right to submit a formal complaint to the UK Information

Commissioner's Office (ICO):

Information Commissioner's Office

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Helpline: 0303 123 1113 | Website: www.ico.org.uk