Privacy Policy

Achieve360 Ltd GDPR POLICY & PROCEDURES including Social Media Policy (Appendix 1)

The purpose of this document is to ensure that individuals working with or using the services of Achieve 360 Ltd (client/worker/school), have a clear understanding of the requirements of the GDPR May 2018; most importantly, the recording, processing and storing of all personal information that passes to and through Achieve360 Ltd on a day to day basis.

GDPR requires that appropriate measures to implement the Data Protection Principles and safeguard an individual’s rights are put in place. As an organisation we will integrate Data Protection into all our processing activities and working practice from the referral stage through to the end of our work with a client. All applicable information re Clients will be documented under Article 30 (2) of the GDPR. We will conduct regular reviews of the personal data we process and update our documentation appropriately. We recognise that completing a Data Protection Impact Assessment (DPIA) before any new project is Good Practice and will help identify & minimise any Data Protection Risks.

Data Protection Officer - Nicki Livesey MD Achieve360 Ltd.

‘Consent’ - the Lawful Basis for all data processing carried out by Achieve360 Ltd

Referral Procedures & Privacy Notice

Achieve360 Ltd will be acting on the lawful basis of ‘consent’ for all their data processing and storage of personal information. Most of the information is obtained from 1:1 or group discussion with a child or children by a qualified Counsellor or Therapist.

  • A paper Referral Form with Privacy Notice to be given to the Parent/Guardian/Carer and completed and signed before Counselling/Therapy sessions begin in school/home. The Parent/Guardian/Carer is requested to ‘opt in’ to give written permissions for the session/s to take place by signing and dating the form, and for any photographs to be taken of the child. The photograph/s will be used by Achieve360 Ltd for their own marketing/advertising purposes and/or website only
  • The Parent/Guardian/Carer on signing and dating the form also ‘opts in’ to all personal information re their child/children being electronically processed and stored in writing by Achieve360 Ltd
  • The completed and signed paper Referral Form to be given to and stored securely by Nicki Livesey MD Achieve360 Ltd
  • Regular record keeping can be in a paper format or uploaded to the Achieve360 Ltd database; records will be kept to a minimum and only the initials of the child’s name are to be used
  • When all the agreed sessions are completed, an electronically produced report will be sent to the Headteacher of the school or directly to the Parent/Guardian/Carer and the original Referral form destroyed
  • All electronically stored information/files/ paper records regarding the child, will be securely deleted

The GDPR has replaced the Data Protection Act 1998 but continues to aim to promote higher standards in the handling of personal information therefore protecting the individual’s right to privacy.

GDPR Policy - The Principles

  • To respect the rights of our data subjects
  • To use lawful, fair & transparent data processing for specified and legitimate purposes
  • To keep adequate, relevant and limited data processing information
  • To ensure the data processing is accurate, up to date and secure
  • To ensure accountability and keep accurate records
  • Ensure data subjects are informed (see Privacy Notice on Referral form)
  • Ensure all records are accessible to subjects if requested
  • Rectify personal data if required or requested
  • Erase personal data if requested by subject
  • Increased awareness of secure transfer of personal data (if required) and any communication issues
  • Data Security including storage; disposal and use of
  • Data Breach notification
  • The implementation of the GDPR Policy ‘GDPR Policy Procedures’

There is stronger legal protection for more sensitive information, such as:

  • Ethnic background
  • Political opinions
  • Religious beliefs
  • Health
  • Sexual health
  • Criminal records

Contact Details

  • Achieve360 Ltd Head Office Address: 2, Bellevue Street, Winnington, Northwich Cheshire CW8 4GL
  • Managing Director: Nicki Livesey
  • Data Protection Officer: Nicki Livesey
  • Contact Nicki Mob: 07760220306 email: nicki@achieve360.co.uk
  • Website: www.achieve360.co.uk

Achieve360 Ltd - Processing & Recording Personal Data

  • Achieve360 works primarily with children & young people from the age of 4 years to young adults, in school during school hours; arrangements can be made to work in the child’s home out of school hours if requested. A Risk Assessment should be completed before delivery of any work in the client’s home and the Lone Working Policy & Procedures followed
  • We deliver Counselling Therapies including Animal Assisted Therapy. Risk Assessments to be completed for any work with Dog(s), Horses & Guinea Pigs
  • The qualified Counsellors/Therapists ‘Consultants’ are self - employed using their own transport and Public Liability Insurance. They obtain their work daily from Achieve360 Ltd
  • The consultants use their own personal mobile phones and lap-tops/tablets
  • During the sessions with the children/young people, the consultants record electronically or on paper the main details of the session, using the initials of the child/young person, to protect identification. The information is then stored securely by the consultant/or on the Achieve360 database. This information can be seen at any time by Nicki Livesey MD and Sue Earnshaw (Policy & Compliance Manager)
  • At the end of the sessions, the Consultant’s produce a report for the individual Headteacher(s) using the child/young person’s full name which is sent direct to the school via encrypted e-mail; any records are then deleted securely. The original Referral Request (paper copy) is also destroyed by Nicki Livesey MD
  • Consultant/Worker Details held by Achieve360 Ltd include: Name, address incl. postcode, Mobile Phone No., Emergency Contact Name and Tel. No; Copy of enhanced Disclosure & Barring Service Certificate (DBS); Public Liability Insurance Details; Details of Car Insurance (with Business Ins) and MOT if applicable; Details of Qualifications in Counselling Therapies; Copy of CV; Copy of References; Copy of a signed Achieve360 Consultant’s Agreement
  • The above documents are stored on a secure PC; the details are processed and managed for Achieve360 Ltd by Sue Earnshaw (Policy & Compliance Manager)
  • Information collected, processed and stored by Achieve360 Ltd is for the sole intention of producing a report for the individual Headteacher(s) and is kept to a minimum. Sessions may last up to 12 weeks
  • Achieve360 Ltd has technical support from UQ Web Design
  • Achieve360 Ltd understand that children of all ages should be given the opportunity to understand how Achieve360 records and stores information about them

Age appropriate leaflets are available to inform children/young people from 4 years to 18yrs; they are distributed with the original Referral Request Form.

Children & GDPR: Processing a child’s personal data

Achieve360 Ltd Guidelines and Procedures

A child is anyone under the age of 18yrs (UN Convention on Rights of a child)

  • It is advised that only children aged 13yrs and over can give their own consent. Children under this age need consent from whoever holds parental responsibility for the child. Achieve360 try and ensure a child understands what/why they are giving their consent and that we do not exploit any imbalance in power in the relationship between us. If an older child is not deemed competent to consent to processing or cannot exercise their own data protection rights, then an adult with parental responsibility may consent on their behalf
  • If an ‘online service was to be streamed directly to a child’ and the service used ‘consent’ as the law basis under GDPR - only children 13yrs or over can give their own consent. Under this age, unless the service is an online preventative or counselling service, consent needs to be provided by the holder of parental responsibility for the child. NB: (Achieve360 Ltd do not offer online services to children & young people)
  • Any child/young person/parent/guardian/carer/consultant/worker who wishes to read the information Achieve360 Ltd holds on their file about them, should contact Nicki Livesey MD on Mob: 07760220306. Arrangements can also be made for individual records/personal information held by Achieve360 Ltd to be erased at any time
  • Achieve360 Ltd design and produce Privacy Notices specifically for children, so they are be able to see what happens to their personal data and what rights they have. They are clearly written in plain, age appropriate language using diagrams and cartoons, symbols and colour. The risks regarding the processing of personal information and how we safeguard against them are explained in a child friendly way, to ensure that parents and children understand the implications of sharing data

If we are relying on Parental Consent, we offer two versions of the Privacy Notice:

1 for Parental Responsibility (Referral Form) and 1 for the child (Taken from the ICO.org.uk ‘Guide to GDPR2018’ - ‘Children & GDPR’)

Multi-Agency Working with Achieve360 Ltd

Aligned to the GDPR Policy, the Achieve360 Ltd Confidentiality Policy, ensures that where a client’s personal information is stored, it is kept confidential and a high standard of handling personal information is upheld. The Confidentiality Policy outlines where information including personal data from case work might be shared with others.

Requests for information from Third Parties

Achieve 360 Ltd will not disclose any information to third parties without the agreement of the person involved or unless it comes within the exempted terms of the Achieve 360 Ltd Confidentiality Policy (Safeguarding Vulnerable Adults and Children).

Clients need to be confident that information will not be passed inappropriately by one agency to another. The only exceptions to this are outlined as follows:

‘Although there is not a legal duty to do so, Achieve360 consultant/workers are advised only to speak to a third party where a person or third-party are thought to be at risk and in immediate danger. If a consultant/worker feels that action needs to be taken, they should discuss this first with Nicki Livesey, MD, Achieve 360 Ltd.

If the MD cannot be contacted they should contact a Headteacher/Children’s Services Social Worker/Police Officer and explain the circumstances.’

The situations when action may be required are:

  1. Where the person/young person/child is clearly not in control of his or her own safety i.e. involved in an accident, suffering from a drug overdose
  2. Where the emotional or mental state of the person/young person/child concerned is such that it puts their own, or a third parties lives or safety at risk
  3. Where a third party is at risk of danger or abuse e.g. where a sibling is left with the family and being abused and/or where the work falls within the Achieve360 Ltd Child Safeguarding and Vulnerable Adult Protection Policy & Procedures

Nicki Livesey MD
Achieve360 Ltd
December 2018

Appendix 1

Achieve360 Ltd Social Media Policy & Procedures (for safer online practice)

While everyone is welcome to engage in social media, only a designated online/Social Media spokesman may speak on behalf of Achieve 360 Ltd. This decision should be taken with the knowledge of the Managing Director, Nicki Livesey, or a member of Senior Management.

All social media activities can help the reputation of Achieve 360 Ltd.

If you do choose to engage in social media… Q. Who may engage on Achieve 360’s behalf?

Achieve 360 Ltd - Social Media Guidelines

These guidelines cover all current social media platforms - web and digital technologies that enable social interaction - and include but are not limited to:

  • Blogs (including corporate and personal blogs);
  • Social networking sites (e.g. Facebook, MySpace, Google+, Bebo, Friendster, LinkedIn, Orkut, etc.);
  • Micro-blogging sites (e.g. Twitter);
  • Video and photo sharing websites (e.g. Flickr, YouTube, Vimeo);
  • Forums, networks and discussion boards (e.g. Google and Yahoo! groups);
  • Online encyclopaedias (e.g. Wikipedia);
  • Comment fields in online publications of newspapers;
  • Product Rating and Review Sites (e.g. Amazon, Yelp)

Tips when using Social Media

  • Always correct your mistakes; acknowledge errors and inaccurate information, and, if necessary, apologise
  • If you post something in error, don’t delete it - simply post an update with the correct information
  • Be mindful that your posts should not be false or misleading in any way
  • Be aware that involvement in social media means you are always "online." You must assume that your social media activity is visible to all your personal and professional networks. Social media is a powerful and everlasting tool. Once something is posted, it will linger online forever. Be thoughtful about what you communicate and how you go about doing so, taking into consideration your tone and the words you use. Be aware your comments remain for a while
  • Be Alert. You may come across comments about Achieve 360 Ltd or its services. If you discover a questionable comment about the company and/or its practices, contact the MD or a Senior Manager to determine if a response is needed and who should respond. Be especially careful not to comment on things that are not in your area of expertise. Be mindful not to give an opinion about a topic or issue you are unsure of: it is always best to refer the issue to the MD or a Senior Manager
  • Avoid any conduct that could endanger or put Achieve 360 Ltd. reputation at risk
  • Act legally and honestly
  • Be transparent and be yourself. Never pretend to be who you are not
  • Use your true name
  • Be sure to state that the opinions you are sharing are your own and that they do not represent the views of Achieve 360 Ltd
  • Respect intellectual property - all copyright, trademark and other laws that apply offline apply online as well. Do not infringe upon the intellectual property rights of anyone when using social media. Obtain approval before reproducing any materials (including trademarks) and referencing services
  • Be sure to credit your sources when posting a link or information gathered from another source. In general, it is better to link to other materials than to post a copy. For example: "I work with Achieve 360 Ltd and have just read a great article on ‘The learning mentor’ in the Times - post link to article)
  • Intellectual property also relates to Achieve 360’s rights to own its official corporate and brand pages on social networking sites
  • Do not open accounts under the Achieve 360 Ltd brand name. If there is a site that you suspect is an unofficial page, please inform the MD or a Senior Manager and provide either a link to the site or a screen grab of the internet page

Using Social media responsibly

  • Be civil and respectful: practice civility when engaging in social media and treat others with the same respect as you would expect from them. Personal attacks, "fights," and defamatory remarks are considered poor form in any communication. Be mindful of how questionable commentary might reflect on your reputation - personally and professionally
  • Do not disclose Confidential information re Achieve360 Ltd. Blogs, posts, and tweets should not disclose or reveal any non-public or confidential information about the organisation, its business, or its people and services. This includes professional networking sites such as LinkedIn, where even if you belong to a private group, information may still be available to the public and people outside of Achieve 360 Ltd

Nicki Livesey MD
Achieve 360 Ltd
August 2018