Who are Norfolk and Waveney Mind?
Norfolk and Waveney Mind (“N&WM”, “we”, “us”) is a mental health charity. We are the data controller for the personal information we collect when providing support.
Got a question? How to get in contact with us
If you need any information about how we process information or to invoke any of your information rights, please contact our Data Protection Officer (DPO): [email protected], Norfolk and Waveney Mind, 50 Sale Road, Norwich NR7 9TP.
I want to request information about myself or someone else
To make a request for information, please email [email protected]
Please note that where a request is made for personal data, we will always conduct identification checks and, where a third party is requesting information, proof of consent to share data. So please include this in the first instance to ensure that we can complete your request without delays.
What are my rights?
Under data protection law, you have various rights when it comes to your data, which may include the right to:
- Access your information
- Ask us to correct it
- Ask us to delete it (in certain circumstances)
- Restrict or object to some uses
- Withdraw consent where consent is used
I want to make a complaint
If you are unhappy with how we use your data, please contact our DPO in the first instance. If you would like to take this further, you can also make a complaint to the Information Commissioner’s Office (ICO): https://ico.org.uk and find us on their register using their search tool: https://ico.org.uk/ESDWebPages/search/
How long do you keep my data?
Your information is kept only as long as necessary and in line with our Data Retention Policy. You can request a copy of this using the contact details in the contact us section above.
Will you share my data for marketing purposes?
We never sell your information or share it for marketing.
We collect data for the following:
I am a service user
This statement details how we use your information if you access any of our services:
What information we collect
Depending on the support you receive, we may collect:
- Your name, contact details, and pronouns
- Information about your mental and physical health
- NHS number and other identifiers
- Protected characteristics (e.g., ethnicity, gender identity) – only with your consent
- Contact details for your next of kin or referrer
Why we use your information
We use your information to:
- Provide you with mental health support and communicate with you
- Make referrals to other services when needed
- Keep you safe (including safeguarding activities)
- Report anonymised service data to commissioners like the NHS
- Improve our services
Our lawful bases
We process your information because:
- It is in our mutual Legitimate Interest to provide support safely and effectively
- We have your Explicit Consent for protected characteristics
- It is needed under Substantial Public Interest (Safeguarding) and we need to act to keep someone safe
- For Health & Social Care purposes, where qualified professionals deliver your support.
Who we share your information with
We may share information with:
- Other health, care, or support organisations involved in your care
- Partner organisations that refer you to us or receive referrals from us
- NHS Digital (for required national reporting for NHS‑funded services)
- Emergency services, where necessary for safeguarding or serious risk
- Approved third‑party system providers who host our databases (under strict contracts)
I am a member of staff, volunteer, or trustee
This statement details how we use your information if you work for us in any capacity:
What information we collect
We may collect:
- Name, contact details, pronouns
- Recruitment information
- Right to work documents, DBS results
- Employment/volunteering records
- Payroll and pension details (staff only)
- Emergency contact information
- Health data where required for employment law or occupational health
- Protected characteristics information (only with your explicit consent)
Why we use your information
We use your information to:
- Recruit, manage and support you
- Meet our employment, safeguarding and legal obligations
- Provide payroll, pensions and benefits (staff)
- Ensure a safe working environment
- Provide training and supervision
- Monitor equality and improve our practices
Our lawful bases
We process your information because:
- It is necessary for your Contract (e.g., payroll, management)
- We have a Legal Obligation to (e.g., right‑to‑work checks, HMRC, employment law)
- We have a Legitimate Interest in managing our workforce
- We have your Explicit Consent for protected characteristics
- Employment Law allows us to process relevant health data (Art 9(2)(b))
Who we share your information with
We may share information with:
- Payroll and pension providers
- Training and accreditation bodies
- IT service providers (e.g., HR system providers)
- External auditors, insurers or regulators
- DBS service providers
- Emergency services where required for safety
I am a supporter or event attendee
This statement details how we use your information if you support us in any way, including but not limited to making donations, registering to our mailing list, or attending any of our corporate or community events:
What information we collect
We may collect:
- Name, contact details and pronouns
- Ticket registration details
- Donation amounts and Gift Aid declarations
- Payment information (processed securely by trusted third parties – we do not store card details)
- Photographs or video footage at events. Where possible we will ask for your consent for this, e.g., for close up photos or photos that identify you. Sometimes at big public events this may not be possible.
- Communication preferences
Why we use your information
We use your information to:
- Process your donation or Gift Aid
- Register you for an event and communicate with you
- Thank you and keep you updated
- Keep our events and activities safe and well‑managed
- Improve our fundraising and engagement
Our lawful bases
We use your information because:
- We have a Legitimate Interest in running events, processing non‑Gift‑Aid donations, keeping accurate supporter records
- We have a Legal Obligation to process Gift Aid and financial information
- We have your Explicit Consent to send you marketing communications and use photos/videos
Who we share your information with
We may share information with:
- Payment processors
- HMRC for Gift Aid claims