Privacy Notice

About this notice 

Road to Change CIC is committed to protecting your privacy and handling your personal information with care, respect and transparency.  We recognise that trust is especially important where people have experienced road traffic bereavement or serious injury.

​

This Privacy Notice explains how we collect, use, store and share personal information, and outlines your rights under data protection law.  It applies to personal information we receive through our website, referral forms, email, telephone, social media, events, or any other means.

​

Road to Change CIC complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

​

What is Road to Change?

Road to Change CIC is a Community Interest Company registered in England and Wales.  We collect, use and are responsible for personal information about you.  When we do this, we are the ‘controller’ of this information for the purposes of the UK GDPR.

​

We are registered with the Information Commissioner’s Office (ICO) - ICO registration number: ZC100122.

 

How can I contact Road to Change?

If you have any questions about this Privacy Notice or how we handle your personal information, you can contact us as below:

​

• Email: support@roadtochange.co.uk

• Address: Road to Change CIC, Granville House, 2 Tettenhall Road, Wolverhampton, WV1 4SB

​

What information do we collect?

We may collect and process the following categories of personal information:

 

• Personal identifiers and contact details (such as name, email address, telephone number and postal address)

• Details of the collision through which you were bereaved or seriously injured, including relevant justice outcomes

• Emergency contact details​

• Records of your engagement with our services, activities and events​

• Records of donations made to Road to Change (we do not store card or payment details)

• Volunteer information, including bank details where expenses are reimbursed

​

We do not routinely collect special category data.  Where this is required (for example information relating to health, ethnicity, religion or gender), we will explain why it is needed and will only record it with your explicit consent.  

​

We do carry out DBS checks on our directors and volunteers and have a policy specific to this.

​

How do we collect information?

We collect personal information:

• Directly from you (for example via forms, emails, phone calls or event registrations)

• Indirectly from professionals acting on your behalf (such as police officers, counsellors or healthcare professionals), where they have obtained your consent

• Through your interactions with our website, social media or surveys

​

Why do we need this information?

We use personal information to:

• Provide appropriate support, peer connection, justice guidance or remembrance activities

• Communicate with you about our services, events or updates where you have consented

• Assess what support you may need while reducing the need for you to repeat traumatic information

• Safeguard your wellbeing and safety during activities or events

• Meet legal, regulatory and safeguarding obligations

​

What are our lawful bases for processing information?

 

Under the UK GDPR, we rely on the following lawful bases when processing personal information:

• Consent

• Legitimate interests (to deliver our charitable and support services)

• Public task (where applicable)

• Vital interests (where processing is necessary to protect life or safety)

​

For special category personal data, we rely on explicit consent, vital interests, or our status as a not-for-profit organisation with appropriate safeguards in place.

​

You may withdraw your consent at any time by contacting us.

​

Will we share information?

We do not sell personal information.  We may share information:

• With your consent

• In anonymised form with funders or partners for reporting and service planning

• Without consent where required to safeguard individuals, protect life, prevent crime, or comply with legal or regulatory obligations

 

International Data Transfers

We do not routinely transfer personal information outside the United Kingdom.  Where any of our third party systems involve international data processing, appropriate safeguards are in place to ensure data protection standards equivalent to UK GDPR are maintained.

 

How do we store information?

 

We store personal information securely using a combination of organisational and technical measures.

​

We use Donorfy, a CRM system designed for charities and not for profit organisations, to manage records. Access to systems is role based, restricted and password protected.  Only authorised directors and approved volunteers can access information relevant to their role.

​

Information on Donorfy’s security and data protection can be accessed at the below links:

 

• https://donorfy.com/security

• https://donorfy.com/data-protection

​

How long do we store this information?

We keep personal information for as long as you engage with Road to Change.  Where engagement ends, records are normally retained for two years before being securely deleted or anonymised, unless a longer retention period is required by law.

​

Cookies and website data

Our website does not currently use any cookies or analytical tools.  This privacy policy will be updated as our website develops.

 

What data protection rights do I have?

You have rights under the UK GDPR, including the right to:

• Access your personal information

• Request correction of inaccurate or incomplete data

• Request erasure in certain circumstances

• Restrict or object to processing

• Request data portability

• Withdraw consent at any time

​

We do not carry out automated decision making that produces legal or similarly significant effects.

​

What will Road to Change do in the event of a data breach?

If a data breach occurs which is likely to result in a risk to your rights or freedoms, we will notify the ICO and affected individuals without undue delay and record any remedial action taken.

​

How do I make a complaint?

If you have concerns about how we have used your personal information, you can contact us using the details above.  You also have the right to complain to the Information Commissioner’s Office:

• https://ico.org.uk/make-a-complaint/data-protection-complaints/

​

Changes to this notice

 

This Privacy Notice is reviewed regularly and may be updated from time to time.  Where significant changes are made, the updated version will be published and, where appropriate, communicated to individuals.

​

Alternative Formats

If you would like this Privacy Notice in an alternative format, or need support to understand it, please contact us using the details above.

​

This privacy notice does not provide exhaustive details of all aspects of our collection and use of personal information.  Please do not hesitate to contact us should you have any questions.