Introduction

This privacy policy explains how British Association for Supported Employment, also known as BASE, and Inclusive Trading CIC where applicable, collects, uses, stores and shares personal information.

In this policy, “we”, “us” and “our” refers to British Association for Supported Employment and, where relevant, Inclusive Trading CIC. “You” means people who visit our website, contact us, become members, book events or training, use our services, apply for opportunities, make purchases, submit forms, or otherwise interact with us.

This policy applies to our website at https://www.base-uk.org/ and to any other website, platform, form, booking system or service that links to this policy.

If you do not agree with this policy, please do not use our website or services. If you have any questions about this policy or how we use personal information, please contact us using the details in the “Contact us” section below.

1. Who we are

British Association for Supported Employment is a national body that promotes, protects and strengthens the Supported Employment model. We work with members, employers, commissioners, policymakers, partners and the wider public to support better employment outcomes for disabled, neurodivergent and disadvantaged people.

For data protection purposes, we are normally the controller of the personal information we collect. This means we decide why and how personal information is used.

Email: admin@base-uk.org

2. Information we collect

Information you provide to us

We collect personal information that you choose to provide when you use our website, register for an account, become a member, make a booking, complete a form, make a payment, attend an event, contact us, subscribe to updates, take part in surveys, apply for opportunities, or otherwise interact with us.

The personal information we collect may include:

• Your name
• Your email address
• Your phone number
• Your postal address
• Your organisation name
• Your job title or role
• Your username and account details
• Your password or authentication details
• Your communication preferences
• Your membership details
• Your event, training or booking details
• Your billing address
• Your purchase order number, where supplied
• Information needed to respond to enquiries or provide support
• Information included in forms, applications, surveys, feedback or testimonials

Information collected automatically

When you visit or use our website, we may automatically collect technical and usage information. This may include:

• Your IP address
• Your browser type and version
• Your device type
• Your operating system
• Your language preferences
• Referring URLs
• Pages viewed
• Dates and times of visits
• Website actions, searches and interactions
• Error logs, diagnostic information and performance data
• Approximate location based on device or IP address

This information helps us keep our website secure, understand how it is used, improve performance, diagnose technical issues and improve our services.

3. How we use your information

We may use your personal information to:

• Create, manage and maintain user accounts
• Provide membership services
• Deliver events, training, conferences, awards and related services
• Process bookings, orders, payments, refunds and invoices
• Respond to enquiries and provide support
• Send administrative information, service updates and policy updates
• Manage customer, member and stakeholder relationships
• Request feedback and understand satisfaction with our services
• Publish testimonials, case studies or feedback where appropriate permissions are in place
• Send marketing and promotional communications where permitted
• Personalise or improve website content and user experience
• Analyse website usage and service performance
• Protect our website, systems and services from fraud, abuse and security threats
• Meet legal, accounting, tax, audit and regulatory obligations
• Exercise, establish or defend legal rights

4. Our lawful bases for using your information

We only use personal information when we have a valid lawful basis under data protection law. Depending on the activity, we may rely on one or more of the following lawful bases:

Where we rely on legitimate interests, we only do so where we believe our interests are not overridden by your rights, freedoms and interests.

5. Special category information

Some types of personal information are treated as more sensitive under data protection law. This is known as special category data.

We may process special category information where necessary and lawful, including where you choose to provide it to us. This may include information about:

• Disability
• Health or accessibility needs
• Neurodivergence
• Dietary requirements that may reveal health or religious information
• Racial or ethnic origin
• Sexual orientation, where voluntarily provided
• Other equality, diversity or inclusion information that you choose to share

We may use this information to provide reasonable adjustments, accessibility support, inclusive services, equality monitoring, event support, training support, membership services, or other services connected with our work.

We will only process special category information where we have both a lawful basis under Article 6 of the UK GDPR and a separate condition under Article 9 of the UK GDPR. Depending on the context, this may include explicit consent, substantial public interest, employment and social protection purposes, or other conditions permitted by law.

6. Cookies and similar technologies

We use cookies and similar technologies, such as pixels, tags and analytics tools, to help our website work properly, understand how people use it, improve services, and support marketing or measurement where permitted.

Some cookies are necessary for the website to function. Other cookies, such as analytics or marketing cookies, are only used where required permissions are in place.

For more information, please read our Cookie Policy: https://www.base-uk.org/website-cookie-policy

7. Payments and billing

If you make a payment or booking through our services, we may collect information needed to process that transaction. This may include billing details, order details, organisation details, invoice details and purchase order information.

Payment card information is processed by our payment providers. We do not store full payment card details on our own systems unless expressly stated at the point of collection.

Our payment and billing providers may include:

• Stripe: https://stripe.com/gb/privacy
• Paysafe: https://www.paysafe.com/en/privacy-policy/

8. Who we share information with

We do not sell your personal information. We may share personal information where necessary with trusted organisations that help us run our services, meet legal obligations, or deliver services you have requested.

We may share information with:

• Website hosting and technical support providers
• IT, security and maintenance providers
• Payment processors and billing providers
• Event, booking, ticketing and training platforms
• Email, newsletter and communication providers
• Customer relationship management and database providers
• Analytics providers, including Google Analytics where used
• Professional advisers, including accountants, auditors, insurers and legal advisers
• Regulators, public authorities, courts or law enforcement where required by law
• Partners, funders or delivery organisations where this is necessary and lawful

We may also allow users to connect with third-party accounts or services, such as Facebook or LinkedIn, where this functionality is available and chosen by the user.

We may use Google Analytics to help us understand how our website is used. You can learn more about Google’s privacy practices at: https://policies.google.com/privacy

You can opt out of Google Analytics across websites by visiting: https://tools.google.com/dlpage/gaoptout

Where third-party service providers process personal information on our behalf, we require them to protect it and only use it in line with our instructions.

We may also share or transfer personal information in connection with a merger, restructuring, transfer of services, sale of assets, acquisition, or similar organisational change.

9. International transfers

Some of the organisations we use may process personal information outside the United Kingdom. Where this happens, we take steps to ensure that appropriate safeguards are in place, such as adequacy regulations, international data transfer agreements, standard contractual clauses, or other safeguards permitted by law.

10. How long we keep your information

We keep personal information only for as long as necessary for the purposes set out in this policy, unless a longer period is required or permitted by law.

Retention periods depend on the type of information and the reason we collected it. In general:

• Account information is kept while your account is active and for a reasonable period afterwards.
• Membership information is kept while you are a member and for a reasonable period afterwards.
• Event, training and booking information is kept for administration, reporting and legal purposes.
• Financial and transaction records are kept for tax, accounting and audit purposes.
• Marketing preferences are kept until you unsubscribe or ask us to stop contacting you.
• Website analytics information is kept for a limited period according to our analytics settings.
• Enquiry and support records are kept for as long as needed to respond and manage follow-up.

Where we no longer need personal information, we will delete it, anonymise it, or securely archive it until deletion is possible.

11. How we keep your information safe

We use appropriate technical and organisational measures to protect personal information. These may include access controls, secure systems, staff procedures, supplier checks, encryption where appropriate, backups, monitoring and security measures designed to protect our website and services.

No system, website, email service or internet transmission can be guaranteed to be completely secure. You should only send personal information to us using secure methods and should take care when sharing information online.

12. Children and young people

Our services are not generally directed at children under 18. We do not knowingly collect personal information from children under 18 without appropriate consent or another lawful basis.

If you believe that we have collected personal information from a child without appropriate permission, please contact us and we will take reasonable steps to delete or manage the information lawfully.

13. Your privacy rights

Depending on the circumstances, you may have the following rights under data protection law:

• The right to be informed about how your information is used
• The right to access your personal information
• The right to correct inaccurate or incomplete information
• The right to request deletion of your information
• The right to restrict how your information is used
• The right to object to certain uses of your information
• The right to data portability
• The right to withdraw consent where we rely on consent
• The right to complain to the Information Commissioner’s Office

These rights do not always apply in every situation. We may need to keep certain information where we have a legal obligation, contractual requirement, legitimate reason, or lawful basis to do so.

You can exercise your rights by contacting us using the details in the “Contact us” section below.

You can also complain to the Information Commissioner’s Office, the UK data protection regulator: https://ico.org.uk/make-a-complaint/

14. Marketing communications

We may send you marketing communications where you have agreed to receive them or where we are otherwise permitted to do so by law.

You can unsubscribe from marketing emails at any time by using the unsubscribe link in our emails or by contacting us.

If you opt out of marketing, we may still send you important service messages, booking information, membership information, account notices, legal notices or other non-marketing communications.

15. Do Not Track signals

Some browsers and mobile devices include a Do Not Track setting. At present, there is no universally accepted standard for recognising or responding to Do Not Track signals. We do not currently respond to Do Not Track browser signals.

If a recognised standard is introduced that we are required to follow, we will update this policy.

16. Changes to this policy

We may update this privacy policy from time to time. When we do, we will update the “Last updated” date at the top of this page.

If we make significant changes, we may provide a more prominent notice on our website or contact you directly where appropriate.

We encourage you to review this policy regularly so you understand how we use and protect personal information.

17. Contact us

If you have questions about this policy or how we use your personal information, please contact us:

Email: admin@base-uk.org

You may also contact: gillian.parker@base-uk.org

18. Reviewing, updating or deleting your information

You may ask us to review, update, correct or delete personal information we hold about you, subject to any legal or operational reasons we may need to retain it.

To make a request, please contact us using the details above. We may need to ask for information to confirm your identity before responding to your request.