Privacy Policy

We collect or use the following information to provide services and goods, including delivery and third party referrals:

• Names and contact details
• Gender
• Addresses
• Date of birth
• Photographs or video recordings
• Health information (including medical conditions, test results, allergies, medical requirements and medical history)
• Dietary information (including allergies and health conditions)
• Information about care needs (including disabilities, home conditions, dietary requirements and general care provisions)
• Information about support requirements
• Criminal offence data
• Information about income and financial needs for funding or personal budget support
• Payment details (including card or bank information for transfers and direct debits)
• Website user information (including user journeys and cookie tracking)
• Equality, diversity and inclusion monitoring information
• Information relating to compliments or complaints

We also collect or use the following special category information to provide services and goods, including delivery and third party referrals. This information is subject to additional protection due to its sensitive nature:

• Health information

We collect or use the following personal information for service updates or marketing purposes:

• Names and contact details
• Marketing preferences
• Records of consent, where appropriate

We collect or use the following personal information to comply with legal requirements:

• Name
• Contact information
• Identification documents
• Safeguarding information
• Criminal offence data

We collect or use the following personal information for recruitment purposes:

• Contact details (e.g. name, address, telephone number or personal email address)
• Date of birth
• National Insurance number
• Copies of passports or other photo ID
• Employment history (e.g. job application, employment references or secondary employment)
• Education history (e.g. qualifications)
• Right to work information
• Details of any criminal convictions (e.g. Disclosure and Barring Service (DBS), Access NI or
• Disclosure Scotland checks)

We collect or use the following personal information for dealing with queries, complaints or claims:

• Names and contact details
• Correspondence

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.

Which lawful basis we rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:

• Your right of access – You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for. Read more about the right of access.
• Your right to rectification – You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete. Read more about the right to rectification.
• Your right to erasure – You have the right to ask us to delete your personal information. Read more about the right to erasure.
• Your right to restriction of processing – You have the right to ask us to limit how we can use your personal information. Read more about the right to restriction of processing.
• Your right to object to processing – You have the right to object to the processing of your personal data. Read more about the right to object to processing.
• Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you. Read more about the right to data portability.
• Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent at any time. Read more about the right to withdraw consent.

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.

Our lawful bases for collecting or using personal information to provide services and goods, including delivery and third party referrals are:

• Consent – we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
• Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
• Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
• Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability.

Our legitimate interests are:

ASTO has a legitimate interest in collecting and using personal information where necessary to deliver its services, activities, events, member organisation support, communications and training opportunities. This may include collecting contact details, organisational information, booking information, accessibility requirements and other information needed to administer participation in ASTO programmes and events.

ASTO also has a legitimate interest in sharing relevant personal information with carefully selected third-party organisations where this is necessary to facilitate the delivery of services requested by individuals or organisations, such as training providers. ASTO carefully balances these benefits against the privacy rights and interests of individuals. Only the minimum personal information necessary for the relevant purpose is collected and shared, access is restricted to those who need it, and appropriate security measures are in place to protect personal information. Information is not used in ways that individuals would not reasonably expect, and individuals retain their rights under data protection law, including the right to object to processing based on legitimate interests where applicable. ASTO considers that the benefits of this processing outweigh the limited privacy impact on individuals, as it is necessary to provide requested services and support the effective delivery of ASTO’s charitable activities while maintaining appropriate safeguards.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

• Recognised legitimate interests – our pre-approved purpose for collecting or using personal information to provide services and goods, including delivery and third-party referrals:
  • We need to respond to, or deal with, an emergency event or situation (the ‘emergencies condition’)
  • We need to protect the physical, mental or emotional well-being of people who need extra support, or to protect them from harm or neglect (the ‘safeguarding condition’).
• Vital interests – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. This includes an urgent need for life-sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability.

Our lawful bases for collecting or using personal information for service updates or marketing purposes are:

• Consent – we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

Our lawful bases for collecting or using personal information to comply with legal requirements are:

• Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
• Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
• Vital interests – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. This includes an urgent need for life sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability.

Our lawful bases for collecting or using personal information for recruitment purposes are:

• Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
• Consent – we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

Our lawful bases for collecting or using personal information for dealing with queries, complaints or claims are:

• Consent – we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

We collect personal data at different points including when you:

• Register for or participate in courses, programmes, or events
• Apply for bursaries, funding, or certification
• Request a DBS check or safeguarding-related service
• Contact us via email, phone, website or post
• Interact with our website or online forms
• Apply for a job with ASTO

We may also receive personal data from:

• Member organisations
• Employers
• Regulatory bodies (e.g. RYA or DBS)
• Service providers supporting our operations

ASTO may take photographs and video recordings at events, conferences, training sessions and other activities for promotional, educational, reporting and archival purposes. Where individuals can be identified from an image or recording, it will be treated as personal data and processed in accordance with applicable data protection legislation.

We may collect and process personal data relating to children in connection with events, or programmes.
Where we process personal data relating to children:

• We ensure that appropriate safeguards are in place
• We obtain consent from a parent or guardian where required
• We only collect and use data where it is necessary for participation, safety, or safeguarding purposes

We recognise that children’s data requires additional protection and take extra care to ensure it is handled appropriately. We will not publish personal information relating to children or young people without appropriate written consent from parents or legal guardians.

The ASTO website uses cookies, which are small files downloaded to your computer to ensure the basic functionalities of the website and to enhance your online experience.

ASTO uses a number of trusted third-party service providers (known as data processors) to help us deliver our services. These organisations process personal information on our behalf and only in accordance with our instructions and applicable data protection legislation.

IT Systems, Cloud Storage and Email Services:

ASTO uses third-party providers, including Microsoft 365, to provide IT systems, cloud storage, email services and document management. Personal information may be stored and processed within these systems where necessary for the administration of ASTO’s activities, communications, membership services, events, training and other operational purposes.

Jotform:

ASTO uses Jotform to collect and manage information submitted through online forms. Jotform acts as a data processor on ASTO’s behalf and processes personal information in accordance with ASTO’s instructions and applicable data protection law.

Stripe:

ASTO uses Stripe to process online payments. When a payment is made, relevant personal and payment information will be shared with Stripe to facilitate the transaction, prevent fraud and meet legal and regulatory requirements. Stripe processes personal information in accordance with its own privacy notice and applicable data protection legislation.

Payroll Services:

ASTO uses Blue Spire South LLP (The Chichester Accountants) to provide payroll administration services. In order to administer salaries, pensions, tax, National Insurance contributions and other employment-related obligations, ASTO may share relevant employee and worker information with Blue Spire South LLP. This information may include names, contact details, salary information, tax information, National Insurance numbers, pension details, bank details and other employment records necessary for payroll processing.

Online Learning and Training:

ASTO uses Educare Learning to provide staff, trustees and volunteers of ASTO and our member organisations with access to online training courses and learning resources. Where an individual requests access, ASTO shares personal information, including their name and email address, with Educare Learning to create and administer a learner account and provide access to training materials.

ASTO uses RYA Interactive to provide access to online training courses and learning resources. Where an individual requests access, ASTO shares personal information, including their name and email address, with RYA Interactive to create and administer a user account and provide access to learning materials.

Disclosure and Barring Service (DBS) Checks: ASTO uses the RYA DBS checking service provided through EmploymentCheck to administer Disclosure and Barring Service (DBS) checks where these are required for staff, volunteers or others undertaking eligible roles for ASTO or our member organisations.

Where a DBS check is required, ASTO shares personal information including name, contact details, date of birth and other identity information necessary to verify an individual’s identity and process the DBS application. Information may be shared with the RYA, EmploymentCheck and the Disclosure and Barring Service for this purpose.

Others we share personal information with:

• Organisations we need to share information with for safeguarding reasons
• Emergency services
• Organisations we’re legally obliged to share personal information with
  Suppliers and service providers

Personal information will only be processed where necessary and in accordance with applicable safeguarding, employment and data protection legislation.

Some of our service providers may transfer your personal data outside the UK. Where we use service providers outside the UK, we check that they have appropriate protections in place to keep your data secure, such as:

• UK International Data Transfer Agreement (IDTA)
• UK Addendum to Standard Contractual Clauses
• Transfers to countries with adequacy regulations

In connection with events, courses, or activities, we may:

• Publish participant names, roles, or achievements
• Share photos or media for promotional purposes
• Include information in reports or communications

Where appropriate, we will:

• Seek written consent (particularly for images/video)
• Consider the impact on your rights before publication

We will always consider whether publication is necessary and proportionate, and will not publish information where it would unfairly impact your rights.

We retain personal data only for as long as necessary.

This depends on:

• The purpose for which the data was collected
• Legal and regulatory requirements
• The sensitivity and risk associated with the data

Typical retention periods include:

• Service and transactional data: up to 6 years
• Financial records: up to 6 years
• DBS application data: retained for 6 months
• Marketing data: until you opt out

We regularly review and securely delete or anonymise data when no longer required.

Further information is available in our Data Protection Policy (on request).

We take appropriate technical and organisational measures to protect your personal data, including:

• Secure IT systems and storage
• Access controls and restricted permissions
• Encryption where appropriate
• Staff training and internal data protection policies

We may use artificial intelligence (AI) tools to support our services, including administration, data analysis, and reporting.

Where these tools process personal data, we ensure that:

• processing is carried out in accordance with UK data protection laws
• appropriate safeguards are in place to protect your information
• any outputs are reviewed by staff where they may affect individuals

We do not use AI to make solely automated decisions that have legal or similarly significant effects on individuals. Where AI tools are provided by third parties, we ensure appropriate contractual and security measures are in place to protect your personal data.