GDPR and Privacy Policy

Derbyshire LERO Development Project - a project delivered by Recovery Connections customer privacy notice

This privacy notice tells you what to expect us to do with your personal information and how we handle, store, use and protect your data.

Contact details
Email: info@recoveryconnections.org.uk

What information we collect, use, and why

We collect or use the following information to provide and improve products and services for clients:

Names and contact details

Gender

Pronoun preferences

Date of birth

Third party information (such as family members or other relevant parties)

Usage data (including information about how you interact with and use our website, products and services)

Information relating to compliments or complaints

Video recordings

Audio recordings (eg calls)

Records of meetings and decisions

Website user information

We also collect or use the following information to provide and improve products and services for clients:

Racial or ethnic origin

Religious or philosophical beliefs

Sexual orientation information

We collect or use the following personal information for information updates or marketing purposes:

Names and contact details

Marketing preferences

Website and app user journey information

We collect or use the following personal information for research or archiving purposes:

Names and contact details

Website and app user journey information

We also may collect or use the following information for research or archiving purposes:

Racial or ethnic origin

Religious or philosophical beliefs

Sexual orientation information

We collect or use the following personal information to comply with legal requirements:

Name

Contact information

Any other personal information required to comply with legal obligations

We collect or use the following personal information for recruitment purposes:

Contact details (eg name, address, telephone number or personal email address)

Date of birth

We collect or use the following personal information for dealing with queries, complaints or claims:

Names and contact details

Correspondence

Lawful bases and data protection rights

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.

Which lawful basis we rely on may affect your data protection rights which are in brief set out below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:

Your right of access - You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for. You can read more about this right here.
Your right to rectification - You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete. You can read more about this right here.
Your right to erasure - You have the right to ask us to delete your personal information. You can read more about this right here.
Your right to restriction of processing - You have the right to ask us to limit how we can use your personal information. You can read more about this right here.
Your right to object to processing - You have the right to object to the processing of your personal data. You can read more about this right here.
Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you. You can read more about this right here.
Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent at any time. You can read more about this right here.

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.

Our lawful bases for the collection and use of your data

Our lawful bases for collecting or using personal information to provide and improve products and services for clients are:

Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:

We collect and use limited personal information as part of our work delivering the Derbyshire Lived Experience Recovery Organisation (LERO) Development Project. Our legitimate interest is to engage with people who have lived and living experience of substance use and recovery, in order to better understand their views, encourage involvement, and co-produce plans that improve services and support in Derbyshire. This helps ensure that future services reflect real needs, reduce stigma, and promote recovery within local communities. We believe this use of personal information provides significant benefit to individuals and communities, and that it does not override people’s privacy rights or cause harm. All personal data is used proportionately, stored securely, and not kept longer than necessary.

Promoting inclusivity and equity to ensure diverse voices (e.g. from different localities, cultures, backgrounds, and identities) are represented and reflected in the development of recovery initiatives.
To ensure accessibility and identify and address barriers to participation (e.g. access needs, cultural considerations, transport issues) that may affect engagement in events or services
Raising awareness and reducing stigma, collecting feedback, stories, and experiences that can be used (with consent) to challenge stigma and promote recovery positively in communities and local systems.
Supporting ongoing engagement, by collecting contact details (with consent) from people who wish to stay involved in the development of LEROs or other recovery-focused initiatives.
To use insights and data to identify local needs, risks, and strengths that will help build sustainable, community-led support systems and inform commissioners.
Conducting responsible evaluation and monitoring by collecting anonymised feedback and demographic data (e.g. age group, borough) to evaluate the reach, quality, and impact of engagement events and activities.
Building community and peer network by supporting connections between individuals in recovery or with shared experience, helping people access mutual support and recovery capital.
To collect contact details (with consent) from people who wish to stay involved in the development of LEROs or other recovery-focused initiatives.
Conducting responsible evaluation and monitoring.
To collect anonymised feedback and demographic data (e.g. age group, borough) to evaluate the reach, quality, and impact of engagement events and activities.

Vital interests – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. This includes an urgent need for life sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability.

Public task – we have to collect or use your information to carry out a task laid down in law, which the law intends to be performed by an organisation such as ours. All of your data protection rights may apply, except the right to erasure and the right to portability.

Our lawful bases for collecting or using personal information for information updates or marketing purposes are:

Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:

We collect personal information, such as names and email addresses, to build a contact list of people who wish to receive updates about our work. This includes invitations to events, research surveys, blog content, and opportunities to get involved in the development of lived experience recovery initiatives in Derbyshire. Our legitimate interest is to keep people informed and involved in a project that is shaped by the voices of those with lived and living experience of substance use and recovery. Sharing information in this way helps build community, increase participation, reduce stigma, and improve recovery outcomes locally. We only collect information from people who have actively expressed interest in staying in touch, and we always provide the option to unsubscribe or withdraw consent at any time. We believe the benefit of building this mailing list outweighs any minimal risks, especially as we handle all personal data with care, transparency, and security.

Vital interests – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. This includes an urgent need for life sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability.

Our lawful bases for collecting or using personal information for research or archiving purposes:

Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:

We collect and use personal information for research and evaluation purposes to understand the needs, experiences, and views of people with lived and living experience of substance use and recovery. This helps us to co-produce meaningful services, inform local planning, and improve recovery support across Derbyshire. The information we collect is used to identify common themes and trends. Where possible, data is anonymised or pseudonymised.

Our lawful bases for collecting or using personal information to comply with legal requirements:

Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

Vital interests – collecting or using the information is needed when someone’s physical or mental health or well-being is at urgent or serious risk. This includes an urgent need for life-sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability.

Our lawful bases for collecting or using personal information for recruitment purposes are:

Consent - we have permission from you after we give you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

Our lawful bases for collecting or using personal information for dealing with queries, complaints or claims are:

Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

Where we get personal information from

Directly from you

Publicly available sources

How long we keep information

We only keep your personal information for as long as it is needed for the purpose it was collected. Once it is no longer required, it will be securely deleted or anonymised.

For this project:

Mailing list and contact information will be retained until March 2026 (six months after the project ends) or until you ask us to remove it.
Non-anonymised survey responses will be retained for no more than three months, then fully anonymised.
Anonymised survey data may be retained for up to two years to support learning, reporting, or future development work.
Event registration data will be kept for up to three months after each event, to support event delivery and evaluation.
Qualitative quotes used in reports will be anonymised by role or region (not name) and held securely until final reporting is complete.
Contact details shared with Derbyshire County Council (with your consent) will be passed securely and removed from our records after transfer.

Who we share information with

Data processors

Recovery Connections

This data processor does the following activities for us: Cloud-based data collection and storage platforms (e.g. Google Workspace, Google Forms) - Google LLC Techology, United States (data stored within the EEA\/UK where possible; subject to appropriate safeguards under UK GDPR) on secure drives. Event management and registration platforms (e.g. Eventbrite) Eventbrite, Inc Industry: Events and ticketing, Sector\/Sub-sector: Event registration and management services, Location: United States (with data processed in accordance with UK GDPR safeguards).

We have a joint controller relationship with Recovery Connections. We process your personal information with that joint controller for the following reason: Recovery Connections is Provider with appropriate experience of Lived Experience Recovery Organisations (LEROs) to engage with Derbyshire residents with lived and living experience of substance use to raise awareness of LEROs and support them to build their own organisation or organisations. Recovery Connections as the provider are funded to deliver this project.

We also have a joint controller relationship with Derbyshire County Council. We process your personal information with that joint controller for the following reason: Derbyshire County Council are the funders of this project, and recipients of the project final aims and outcomes.

Others we share personal information with

Emergency services in the case of injury or illness where indicated and appropriate.

Organisations were legally obliged to share personal information with

How to complain

If you have any concerns about our use of your personal data, you can make a complaint to us using the contact details at the top of this privacy notice.

If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.

The ICO’s address:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113

Website: https://www.ico.org.uk/make-a-complaint

Last Updated: 1st April 2025

Page updated

Report abuse