Use of your Personal Information by STEPPING STONES (Privacy notice)

Updated May 2018


Stepping Stones Data Protection Officer is Catriona Finlayson (Operations Manager). She can be contacted via email ( or in writing at Stepping Stones, St Faiths Centre, Red Post Hill, SE24 9JQ


The contents of the privacy notice are as follows:

1.Purpose of processing and lawful basis for processing

2.Categories of personal data being collected


4.Data subjects’ rights

5.Security and Data Storage

6.Right to withdraw consent or not provide data


1.Purpose of processing and lawful basis for processing

All data processed by Stepping Stones will be for two purposes. The first and primary purpose is to undertake our work with service users, as part of the services Stepping Stones delivers. The second purpose is to monitor our work so that we might evaluate it for the purpose of service planning or for our funders, and to request further funding.

The lawful basis for processing a majority of data that we collect will be ‘consent’ or ‘legitimate interest’ (in order for us to deliver our charitable mission and objectives).

2.Categories of personal data being collected

Stepping Stones may collect the following personal data:


  • Name
  • Age
  • Address
  • Your contact details (including phone number and email address)
  • Name and contact details of carer, care provider or support worker
  • National Insurance number and proof of address
  • Details about your health and learning disability

Sensitive personal data:

We do not normally collect or store sensitive personal data service users. However, there are some situations where this will occur (for example – to meet monitoring requirements for specific funders). When we do so, we will be very clear as to why we are collecting such information, and we will only do so with your specific consent and permission.

If you are a volunteer or staff member then we will collect extra information about you, for example:

  • references
  • criminal records checks
  • details of emergency contacts


3.Retention period

Your data will be retained as long as you attend classes at Stepping Stones.

You may request that your data is amended, erased, or access to your data restricted. Please see section 4 for further information.


4.Data subjects’ rights

As a ‘data subject’ (i.e. a person about whom Stepping Stones holds data), you have a number of rights:

1.You have a right to freely access this privacy statement at any time

2.You may complain to the Information Commissioner’s Office about how Stepping Stones handles your data.

3.You may request to see any, or all, of the data that Stepping Stones holds about you.

4.You may request to have the data we hold on you amended.

5.You may request to have any, or all, of your data erased from Stepping Stones’ data systems.

6.You may request to restrict Stepping Stones’ use of your data.

If you require further information regarding these rights, please speak to the Information Commissioner’s Office by calling 0303 123 1113 or visiting


5.Security and data storage

Stepping Stones will undertake appropriate technical and organisational measures to process personal data securely.

Any personal data will be:

  • Kept in securely, if in physical copy;
  • Protected by the use of passwords and IT safety systems, if kept on a computer;
  • Destroyed in an appropriate manner, if it is no longer needed and;
  • Stored in as few places a possible (staff and volunteers are discouraged from establishing unnecessary new data sets)


6.Right to withdraw consent or not provide data

If you have given Stepping Stones consent to use your data, you may withdraw that consent at any time. Please speak to a member of staff at Stepping Stones to understand what withdrawal of consent may mean for you as, while we will not discriminate against a service user for withdrawing consent, there may be some circumstances in which it is impossible for us to work with you without it.