Privacy policy
Privacy policy
1. About us
The Association of Christians in Counselling and Linked Professions (ACC) is a company limited by guarantee registered in England (company number 2791541) and a charity registered with the Charity Commission for England and Wales (register number 1018559) and the Office of the Scottish Charity Register (register number SCO39810).
ACC is committed to protecting and respecting your privacy. The confidentiality of your personal information is of paramount concern to ACC. To this end ACC complies with the General Data Protection Regulations/Data Protection Act 2018 in the collection, processing, holding and transmitting of your personal information. For example, ACC has in place in respect of its website technical and organisational measures against accidental or unlawful destruction; or accidental loss, alteration, unauthorised disclosure or access; and adequate security programmes and procedures to ensure unauthorised persons are denied access to any personal information on the website.
This policy sets out the basis on which any personal data that we collect from you, or that you or others provide to us, including when using this website (www.acc-uk.org), will be processed. By using the ACC website and/or services, you consent to the collection, processing, holding and transmitting of your personal information for the purposes set out below.
ACC is the data controller in respect of your personal data. This means that we are responsible for deciding how we hold and use personal data about you.
2. What information we collect and how we’ll use it
We collect personal data so that we can operate effectively and provide you with the best possible service. The information we collect depends on the context of your interactions with us and with our website. It also depends on the choices you make, for example the functions you use and your privacy settings. You may choose not to provide certain information but if you do, and that information is necessary to provide a particular feature, then you may not be able to use that feature. We will only use your personal data where we have a valid lawful basis to do so.
The lawful bases for processing are set out in Article 6 of the UK GDPR. At least one of these must apply whenever personal data is processed:
(a) Consent: the individual has given clear consent for you to process their personal data for a specific purpose.
(b) Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract.
(c) Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations).
(d) Vital interests: the processing is necessary to protect someone’s life.
(e) Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.
(f) Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.)
The information below summarises what information we collect about you, explains how we intend to use it and what our legal basis is for using it. The information that we hold and process about you will depend upon whether you are:
- “Visitor” to our website.
- “Enquirer” through contact via e-mail or telephone.
- “Purchaser” of services and products.
- “Individual Member” – the data held will depend upon the membership category.
- “Designated Contact for Affiliate Members”
- “Members Referee” – some membership categories are required to provide a supervisor and Christian sponsor.
- “Complainant” – an individual who has raised a concern or complaint about a member.
- “Complaint Witness”
- “Members of Other Bodies in Receipt of Sanctions from a Complaint Hearing”
- “Service Providers”
- “Marketing Contacts”
a). Visitor
What information will we collect about you?
- Device and usage data including IP addresses and device identifiers,
- Device event information including crash logs, hardware settings, browser type and browser language,
- Information derived from cookies and similar technologies.
How will we collect information about you?
Automatically collected and stored in our server logs when you interact with our website, using Google analytics.
Why are we processing information about you?
To improve the user experience of our website, including to offer you tailored content, and to protect the security of our website.
To analyse the traffic to our website
What is our legal basis for processing information about you?
As applicable, your consent and/or to pursue our legitimate business interests as, in particular to understand how our website is used, to improve the user experience of our website, and to maintain the security of our website.
b). Enquirer
What information will we collect about you?
Name, contact details, areas of enquiry.
How will we collect information about you?
Provided by you.
Why are we processing information about you?
Your consent and/or in order to offer you services that may be of interest to you.
c). Purchaser
What information will we collect about you?
Name, contact details, payment details. Dependant on the purchase or service requested, it also may include dietary requirements, disability (for reasonable adjustment purposes) and emergency contact information.
How will we collect information about you?
Provided by you/allocated by us.
Why are we processing information about you?
To provide the product/service and to keep accounting records in-line with HMRC requirements.
What is our legal basis for processing information about you?
By consent and/or to pursue our legitimate interests, in providing services, products and information.
d). Individual members
What information will we collect about you?
Name, contact details, date of birth, demographic information, professional qualifications and accreditations, areas of practice, therapies offered, membership number, church membership, information provided as part of the joining, registration, accreditation and practice review processes and for the “Find A Counsellor” facility, information gathered as part of a complaint process and payment details.
Which of the details listed above are collected will depend upon the membership category that an individual does/has been a member of i.e. Registered Member, Student Member, Pastoral Care Member, etc.
How will we collect information about you?
Provided by you, allocated by us or provided by a third party as part of a joining, registration, accreditation, practice review or complaint process.
We may additionally receive or verify information by contacting relevant third parties i.e. supervisor, training provider, church leader, etc.
Why are we processing information about you?
In order for you to become and remain a member of ACC, for maintenance of our public register and to enable ACC to perform functions that members have agreed to as part of membership joining and renewal and the Terms and Conditions of Membership and the requirements of the Professional Standards Authority.
What is our legal basis for processing information about you?
By consent and/or to pursue our legitimate interests as the operator of a public register and membership body.
e). Designated contact for organisational members
What information will we collect about you?
If you are the designated contact of the Affiliate Member, then we will hold name and contact details.
How will we collect information about you?
Provided by you/allocated by us.
Why are we processing information about you?
In order for the organisation to become and remain an affiliated member of ACC and to enable ACC to perform functions that members have agreed to as part of membership renewal and the Terms and Conditions of Membership.
What is our legal basis for processing information about you?
To pursue our legitimate interests as the operator of a public register and membership body.
f). Members’ referees
Some membership categories are required to provide supervisor and Christian sponsor information; these are referred in this document as “members’ referees”.
What information will we collect about you?
Name, and contact details.
How will we collect information about you?
Provided by the member for whom you are a “referee”.
Why are we processing information about you?
In order to meet the requirements for ACC membership and to be able to verify details provided by the member if needed.
What is our legal basis for processing information about you?
To pursue our legitimate interests as the operator of a public register and membership body.
g). Complainant
A person that raises a concern or complaint about an ACC member (individual or organisation) or ACC itself will be referred to in this document as a “complainant”.
What information will we collect about you?
Name, and contact details and all information that you have provided as part of the complaint process.
How will we collect information about you?
Provided by you, your representative or others who have been asked to provide information as part of the complaint process i.e. witnesses.
Why are we processing information about you?
To enable ACC to carry out the complaint process as part of our legitimate interests as the operator of a public register and membership body.
h). Complaint witness
As part of ACC’s complaint process ACC or those acting on behalf of ACC in this process may need to contact and hold data for individuals acting as witnesses or providing information relating to the complaint.
What information will we collect about you?
Name, and contact details and all information that you have provided as part of the complaint process.
How will we collect information about you?
Provided by you, the complainant or the member subject to a complaint.
Why are we processing information about you?
To enable ACC to carry out the complaint process as part of our legitimate interests as the operator of a public register and membership body.
i). Members of other bodies in receipt of sanctions from a complaint hearing
A protocol agreed by holders of PSA Accredited Registers means that certain sanctions imposed and removal the Register following a complaint process will be shared with all other PSA Accredited Register holders.
What information will we collect about you?
Name, and the information provided by the PSA Register holder relating to complaint sanctions.
How will we collect information about you?
Provided by the relevant PSA Register holder.
What is gathered from an ACC complaints process and an outcome.
Why are we processing information about you?
To pursue our legitimate interests as the operator of a public register and membership body in accordance with PSA requirements.
j). Service providers
ACC will engage the services of individuals to fulfil roles within the work of ACC, for example trainers, Assessors, Complaint Panel members and investigators, etc. and will be referred to in this document as “Service Providers”.
What information will we collect about you?
Name, and contact details, bank details, qualifications, CV.
How will we collect information about you?
Provided by you.
Why are we processing information about you?
In order to ensure that service providers are qualified and suitably experienced for the role and to make payments for services.
What is our legal basis for processing information about you?
To satisfy the requirements of contracting individuals to perform roles within the scope of ACC’s work.
k). Marketing contacts
What information will we collect about you?
Name, contact details.
How will we collect information about you?
Provided by you.
Why are we processing information about you?
To keep you informed of future events and products and information about ACC (if permission to retain the details has been provided by you).
What is our legal basis for processing information about you?
To pursue our legitimate interests, in providing services, products and information.
3. Change of purpose
We may only use your personal data for the purposes for which we collected it, or for another reason that is compatible with the original purpose. Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
4. Automated decision-making
Automated decision-making takes place when an electronic system uses personal data to make a decision without human intervention. Some of the functions on our website – e.g. the function that allows an Enquirer to search our register of counsellors and process personal data in an automated manner.
You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making, unless we have a lawful basis for doing so and we have notified you.
5. Sharing of information
5.1 We may share your personal data with your consent or as necessary with selected third party service providers that support us in the performance of the activities set out in the table above.
5.2 We may also share your personal data with other third parties, for example in the context of the possible restructuring of our activities or the transfer of some of our responsibilities to another organisation. We may also need to share your personal data with a regulator or otherwise to comply pursue a complaint process or to comply with the law.
5.3 We require all our third party service providers and all other companies within our group to take appropriate security measures to protect your personal data in line with our policies. We do not allow our third party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes in accordance with our instructions.
5.4 The following third-party service providers process personal data about you for the following purposes:
Okapi Technology Ltd: processes this data to manage the installation and configuration (systems, software, networks, internet, and more); to provide IT support and solutions; and preventive maintenance. Data processed by Okapi Technology Ltd on behalf of ACC should only ever be used for ACC’s purposes as specified and authorised by ACC.
Image+ Limited: processes this data to manage the installation and configuration (systems, software, networks, internet, and more); to provide IT support and solutions; and preventive maintenance. Data processed by Image+ on behalf of ACC should only ever be used for ACC’s purposes as specified and authorised by ACC.
Opayo and Sum up: processes this data to manage payments made to ACC for services and products. Data processed by Opayo/Sum up on behalf of ACC should only ever be used for ACC’s purposes as specified and authorised by ACC.
Sage Accounting: processes this data to manage ACC accounting records.
HMRC: processes this data to enable the claiming of Gift Aid in accordance with HMRC requirements. Data processed by HMRC on behalf of ACC should only ever be used for ACC’s purposes and HMRC purposes in accordance with tax legislation.
Other: From time-to-time ACC may hold events at third party venues. ACC may be required to provide data to enable registration/bookings at these venues and to meet their health and safety requirements. Data processed by such organisations on behalf of ACC should only ever be used for the specified purpose.
6. Storing your information
6.1 The personal data that we hold about you will only be processed and stored within the United Kingdom.
6.2 We will only retain your personal data for as long as is necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting obligations. For example, we may need to retain some of your personal data for 6 years after you have made a purchase from us for legal reasons.
6.3 We have a separate retention policy; please see the full policy here.
7. Keeping your information secure
7.1 All information that you provide to us is stored on secure servers. We have put in place appropriate measures to protect the security of your information.
7.2 The transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of the information transmitted to our site and you acknowledge that any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access or inadvertent disclosure.
7.3 You are responsible for keeping confidential any passwords that you have to access our services, including and used to log-in to our website. Please do not share your password(s) with anyone else. If you lose control of your password, you may lose control over your personal data. If your password has been compromised for any reason, please let us know by contacting us at: office@acc-uk.org or 024 76449694.
8. Your rights
8.1 You have the right under data protection laws to:
(a) request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it. This right is subject to a number of exemptions which allow information to be withheld in certain circumstances. For example, subject access rights are excluded where compliance would involve disclosing information relating: to another individual; data which consists of information which is subject to legal professional privilege; negotiations or confidential references;
(b) request correction or erasure of your personal data (unless we have the legal right to retain it, please see our Retention Policy. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing (see below).
(c) object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on these grounds. You also have the right to object where we are processing your personal data for direct marketing purposes.
(d) request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of personal data about you, for example if you want us to establish its accuracy or the reason for processing it.
(e) request (in limited circumstances) the transfer of your personal data to another data controller.
(f) change your data processing preferences at any time.
If you wish to exercise any of the above rights, then you may do so by contacting us at: office@acc-uk.org or 024 76449694.
8.2 If you have a user/member account with us, you can update your account settings by signing-in to your account on the website.
8.3. you should be aware that if you ask us to stop processing your personal data in a certain way or erase your personal data, and this type of processing or data is needed to facilitate your use of the website you may not be able to use the website as you did before. Similarly, if you decline to provide personal data which is necessary in order for us to provide services to you, then we will be unable to provide those services. This does not include your right to object to direct marketing, or your right to withdraw consent for any data processing which is based solely upon your consent. These rights may be exercised at any time without restriction.
9. Marketing and information providing
9.1 We would like to send you information by email about products and services which may be of interest to you.
- This will be performed automatically for all current members, as it is seen as a membership benefit and providing information that may affect your professional practice and membership.
- For non- members, this will only be performed with your consent. You have the right at any time to stop us from contacting you for marketing purposes. If you no longer wish to be contacted for marketing purposes, you can unsubscribe by using the “unsubscribe” link at the bottom of our marketing messages or contacting us at: office@acc-uk.org or 024 76449694.
10. Other websites
Our website may contain links to other websites. This privacy policy only applies to this website so when you link to other websites you should read their own privacy policies.
11. Changes to this privacy policy
We keep our privacy policy under regular review and will post any updates on this webpage. This privacy policy was last updated in March 2023.
12. How to contact us and complaints
12.1 ACC is the data controller in respect of your personal data.
12.2 If for any reason you are not happy with the way that we have handled your personal data, please contact us at office@acc-uk.org or 024 76449694. If you are still not happy, you have the right to make a complaint to the Information Commissioner’s Office here.
Reviewed and updated March 2023