If our lines are closed or busy call the 24-hour National Helpline on FREEPHONE 0800 027 1234

Privacy Policy

Edinburgh Women’s Aid Privacy Policy

What is a privacy notice?
Edinburgh Women’s Aid (“EWA”) wants to ensure you understand our processing of your personal
data. We are also required by data protection regulation to explain certain matters to you. This notice
sets out that information.

This privacy notice tells you what to expect when EWA collects personal information. It applies to
information we collect about:

  • People who use our services; including
  • People who contact us via social media
  • People who call our helpline
  • People who email us
  • Individuals applying for an EVOC grant and/or housing benefit as part of their service
    from us;
  • People who make a complaint to us; and
  • People who support our service.

If you are looking at this notice on our website, you can click on the link to see what to expect for
each source of information.

Our lawful basis for processing data:
The lawful basis upon which we collect and process personal data is legitimate interests. We need to
provide evidence of the work we have done to our funders and our data processing enables us to do
this effectively. People who use our services will reasonably expect that we need their name and
contact details in order to contact them and to continue the service, that we would retain support
and safety plans to monitor the progress of their service, and that we will retain any information
which is reasonably necessary for us to provide our services e.g. personal data which is provided in
order to assist us in making a benefit application on behalf of an individual. Data processing is
necessary to achieve this.

We also recognise individuals’ rights and freedoms and the added responsibility which processing
data on the basis of legitimate interests affords us. Therefore we will not refuse our services to a
service user who does not wish to provide us with personal information or who does not wish their
support sessions to be recorded, or to have a risk assessment completed or use a support or safety
plan. If a service user requests at any time that their personal data is deleted from our system we
will comply with their request. However, our ability to provide services may be negatively impacted
if we don’t have a service user’s personal data (e.g. their contact details).

People who use our services.
We have to hold the details of the people who have requested the service in order to provide it.
However, we only use these details to provide the service the person has requested and for other
closely related purposes.

Closely related purposes may include contacting people who have used our service to complete a
survey about their experience of our service, or to invite them to events or to meet with our funders
or regulators.

Limited personal information may be required by funders to evidence that public funds are being
used appropriately.

For all people who use our services we will collect and hold:

  • Personal information (such as name and address, telephone number, email address, national
    insurance number)
  • Characteristics (such as ethnicity, language, nationality)
  • Support information (such as support plan, safety plan, risk assessment, notes from
    meetings, group sessions attended)

Why we collect and use this information:
We use the data:

  • to monitor and report on progress
  • to provide appropriate support and care
  • to check the quality of our services
  • to report to funders on the work we carry out
  • to comply with the law regarding data sharing

We will hold personal data about people using our services for six years from their last point of

Some of the data that people using our services provide us with might include sensitive personal
data. This includes information about medical conditions or criminal activity. We will not process
any sensitive information about you without your express consent.

People who contact us via social media
We have various social media accounts, including but not limited to, Facebook , X (formerly known
as Twitter), Instagram and LinkedIn. Please be aware that these pages are public and if you contact
us via the public elements of these social media, the content of your enquiry will be public. We will
delete any individual messages sent to us on social media at the earliest opportunity and respond via
direct or private messaging. If you send us a private or direct message via social media the message
will be stored for three months. Messages sent by these methods are subject to the privacy notices
of the relevant companies running these services.

People who call our helpline
When you call EWA’s helpline we will collect personal information about you and will make notes of
the content of your call and will record these on our secure case management system. This is to
enable us to provide our service and allow call takers to work with you on future calls.

Our helpline also offers a translation service for customers when English is not their first language
and we do not have a member of staff available to provide support in the service user’s first
language. This is provided by a third party company. The company that provides this service does
not retain any information from the calls or record them.

People who email us
Email communication from service users and any replies that we make are copied into the service
users own file within our secure case management system and deleted from the email system within
three months. We only communicate by email with service users who have given permission for this
and who have informed us that their email address is safe.

Any legitimate information sharing by email which contains any personal information about service
users between EWA and any third party is done through our Microsoft 365 email service.

Any email sent to EWA, including any attachments, may be monitored and used by us for reasons of
security and for monitoring compliance with office policy. Email monitoring or blocking software
may also be used. Please be aware that you have a responsibility to ensure that any email you send
to us is within the bounds of the law.

Individuals applying for an EVOC grant or Housing Benefit as part of their service from EWA
Any personal information that is provided in the applications for the above financial awards is used
only for the purpose of reviewing the application and the ongoing administration and management
of any finances that are awarded.

Once the application is submitted, it will be subject to the data privacy arrangements of the agencies

People who make a complaint to EWA
When we receive a complaint from a person we make up a file containing the details of the
complaint. This normally contains the identity of the complainant and any other individuals involved
in the complaint. This file is kept securely in a password protected file on our cloud server.

We will only use the personal information we collect to process the complaint and to check on the
level of service we provide. We compile and share statistics showing information such as the number
of complaints we receive, but not in a form which identifies anyone.

We usually have to disclose the complainant’s identity to whoever the complaint is about. This is
inevitable where, for example, the accuracy of a person’s record is in dispute. If a complainant
doesn’t want information identifying him or her to be disclosed, we will try to respect that. However,
it may not be possible to handle a complaint on an anonymous basis.

We will keep personal information contained in complaint files in line with our retention policy. This
means that information relating to a complaint will be retained for five years from closure to enable
us to assess any patterns of complaint over a period of time. It will be retained in a secure
environment and access to it will be restricted according to the ‘need to know’ principle.

Some of our services are regulated by the Care Inspectorate and we must share information with
them on complaints that we receive and this will include the complainant’s identity and any
individual the complaint is about. Information is shared with the Care Inspectorate via their secure
online portal and processed and retained by them in line with their retention policies.

EWA’s funders may require us to provide information about complaints we have received. In such
cases we will provide information in an anonymised format unless we have sought express
permission from the complainant to share their personal information.

Similarly, where enquiries are submitted to EWA, we will only use the information supplied to us to
deal with the enquiry and any subsequent issues, and to check on the level of service we provide.

People who support EWA
Any personal information that is provided by individuals to support EWA will be retained for the
following periods:

  • Individuals making one off donations – personal information will be retained for two years
    so that the donation can be acknowledged in the relevant annual report.
  • Individuals making regular donations – personal information will be retained for two years
    following the last donation so that the donation can be acknowledged in the relevant annual
  • Individuals offering support in the form of political or lobbying support – personal
    information will be retained for two years following the last active contact.
  • Individuals offering support in the form of volunteering – personal information will be processed as per our privacy statement for applicants, employees and volunteers.

Individuals Connected to People who use our services
We process the personal data of individuals connected to people using our service in order to
provide our service. We collect and retain this information from public sources, for example the
Sheriff and Crown courts in Edinburgh and we process it as part of our contract to provide
information and support to witnesses in criminal cases related to domestic abuse.

We also process the personal data of individuals connected to people using our service as part of our
role on multi agency risk reduction partnerships. We only process this information in order to
protect the lives of people using our service.

Your rights
You have certain rights in relation to the personal data which we process about you:

  • You have the right to be provided with clear, transparent and easily understandable
    information about how we use your personal data and your rights; this is why we are providing
    you with this privacy notice.
  • You can request to access your personal data.
  • You have the right to restrict some processing of your personal information, which means that
    you can ask us to limit what we do with it;
  • Subject to certain limitations (normally where there is a continuing need for us to process the
    data), you can object to the processing of your personal data, or you can request that it be
  • Where we hold data that is inaccurate, you can ask us to complete or rectify this.
    You also have the right to complain – please see below.

Complaints or queries
EWA tries to meet the highest standards when collecting and using personal information. For this
reason, we take any complaints we receive about this very seriously. We encourage people to bring
it to our attention if they think that our collection or use of information is unfair, misleading or
inappropriate. We would also welcome any suggestions for improving our procedures.

This privacy notice was drafted with brevity and clarity in mind. It does not provide exhaustive detail
of all aspects of EWA’s collection and use of personal information. Our data protection policy and
privacy notices do not advise women using our services that their data will be shared with AI or
plagiarism services and our staff code of conduct makes it clear that personal email addresses are
not to be used for EWA business.

We are happy to provide any additional information or explanation needed. Any requests for this
should be sent to the address below.

If you want to make a complaint about the way we have processed your personal information, you
can contact us at info@edinwomensaid.co.uk . If you are unhappy with our response, you can
complain to the ICO in their capacity as the statutory body which oversees data protection law

Access to personal information
EWA tries to be as open as it can be in terms of giving people access to their personal information.
Individuals can find out if we hold any personal information by making a ‘subject access request’
under the GDPR. If we do hold information about you we will:

  • give you a description of it;
  • tell you why we are holding it;
  • tell you who it could be disclosed to; and
  • let you have a copy of the information in an intelligible form.

To make a request to the EWA for any personal information we may hold you please put the request
in writing marked for the attention of the Data Controller and sent to the email or postal address
provided below. Personal information can be requested verbally, but we may need to verify your
identity before releasing your information. If you request your information verbally we may ask you
to confirm your identity and a member of staff will record the process of confirmation.

If you agree, we will try to deal with your request informally, for example by providing you with the
specific information you need over the telephone.

If we do hold information about you, you can ask us to correct any mistakes either verbally or by
sending an email or letter to the Data Controller at the addresses set out below.

Disclosure of personal information
Sometimes it is helpful for us to share the information you give us or to obtain information about
you from other services. However, we will not pass on any or collect information without your
consent, other than in the following circumstances:

  • Where we have a statutory duty to do so in order to protect you, prevent harm to someone
    else, for example a child, or prevent or detect a crime. If we have to share information in
    these situations, we will only share information that will improve your and/or your
    child[ren]’s safety. We will always try and tell you when information is being shared unless it
    is not safe for you or someone else or we can’t contact you. Further information is available
    in our Child and Adult Protection Policies about the factors we consider when deciding
    whether information should be disclosed.
  • Service users’ names and dates of birth may also be shared with our funders’ monitoring
    officers as evidence of legitimate use of public funds.
  • EWA is regulated by the Care Inspectorate and monitoring officers from this agency may
    require access to case files during monitoring visits to review EWA’s practice. No personal
    information will be processed or removed during monitoring visits by the Care Inspectorate,
    unless there is a statutory requirement for this. The Care Inspectorate may also require
    EWA to provide details of reportable incidents. Any personal data shared with them will be
    limited to that which is necessary for the Care Inspectorate to investigate the incident and
    will be shared only through the Care Inspectorate’s secure portal.

Right to be forgotten
You have the right to have the personal data that we retain about you erased under the following

  • The personal data is no longer necessary for the purpose which we originally collected or
    processed it for;
  • If you object to the processing of your data, and we don’t have an overriding legitimate
    interest to continue this processing. An example of an overriding legitimate interest would be
    if you were staying in refuge and we required your personal data to process housing benefit
    or to administer the rent and bills that we receive from you.
  • If we have processed your personal data unlawfully.
  • If we are legally obliged by you to do so

Links to other websites
This privacy notice does not cover the links within this site linking to other websites. We encourage
you to read the privacy statements on the other websites you visit.

Changes to this privacy notice
We keep our privacy notice under regular review. This privacy notice was last updated on 6 May

How to contact us
If you have any questions or concerns about any information in this privacy notice, you should
contact our representative on data privacy issues, namely Linda Rodgers at EWA, 4 Cheyne Street,
Edinburgh, EH4 1JB, lindarodgers@edinwomensaid.co.uk, 0131 315 8111.