Section One: Information for service users

Who we are

Victim Support is an independent charity supporting people affected by crime in England and Wales. We provide individual, independent, emotional, and practical help, to enable people to cope and recover from the effects of crime. Our victims’ services are free and available to everyone, whether the crime has been reported, and regardless of when it happened.

In some areas Victim Support may provide services to people that commit crime. These services have the aim of reducing reoffending and helping offenders to be aware of or to understand how their crimes have affected their victims and others.

The contact details for Victim Support in relation to processing of personal information and for any questions regarding this privacy notice are:

Victim Support
Building 3
Eastern Business Park
Wern Fawr Lane
Old St. Mellons
Cardiff
CF3 5EA

Victim Support’s Data Protection Officer can be contacted at dpo@victimsupport.org.uk

What information we collect

• Personal data: Name, contact details, date of birth, address, physical characteristics
• Special category data: Racial/ethnic origin, health, religious beliefs, sexual orientation
• Criminal offence data: Convictions or offences, processed with extra safeguards
• Case notes and support details: Most of our services require that we process adequate personal information in order that we can legally, safely and fully provide the service(s) you need. Unfortunately, without an adequate level of information we may not be able to provide you with a particular service or may need to withdraw that service.

Where we process special category data, we do so under the substantial public interest conditions in Schedule 1 of the Data Protection Act 2018, including safeguarding individuals, providing support services, or preventing and detecting unlawful acts.

How we collect your data

• Directly from you
• From agencies like the police or partner organisations

Why we use your data

• To provide support and services
• To campaign for change, conduct research and fundraise
• To manage your relationship with us

Lawful bases for processing

• Public task: Delivering services with a basis in law

Most Victim Support services process your personal information in the performance of a public task with a basis in law e.g. the Domestic Violence, Crime and Victims Act 2004 and the provisions of the Victims’ Code of Practice. This means we do not require your consent to process your personal data, but you do have the right to object to the processing.

Victim Support processes necessary personal information about offenders/alleged perpetrators in relation to the provision of services to victims and witnesses of crime. This information is processed only in relation to the statutory support required to be provided to victims in law.

Some services provided by Victim Support do not fall within our statutory public task. Where this is the case, we rely on the lawful basis of legitimate interests to provide support or on consent where explicitly required.

• Consent: Where you have given explicit permission

A small number of Victim Support services process your data on the legal basis of consent, the individual service will inform you of this. Where we process your personal data on the legal basis of consent you have a right to withdraw your consent.

• Legitimate Interests: Where we have determined that the processing of personal data is necessary and does not override the rights and freedoms of individuals.

The Witness Service processes personal data on the legal basis of legitimate interests, where the service is not delivered as part of the statutory victim and witness support framework. This includes supporting witnesses whose involvement does not fall within our public task obligations.

We have carried out a Legitimate Interests Assessment (LIA) to ensure that this processing is necessary, proportionate, and does not override your rights and freedoms. You have the right to object to the processing of your personal data at any time.

More information is available in the Witness Service Privacy Notice [PDF].

• Recognised legitimate interests (DUAA 2025): Specific processing activities may be carried out under the DUAA 2025 where they fall within the Act’s recognised legitimate interests categories. When we rely on these provisions, we will identify them and explain why they apply.

• Legal obligation, contract, vital interests: For specific processing activities as required by law or to protect individuals.

Sharing your data

• With your consent, to other agencies for your support

This will usually be to ensure you receive the wider services you require to meet your needs. We will tell you who those agencies are and how they can support you before making a referral. Victim Support undertakes reasonable due diligence checks on organisations/services we may directly refer you to, however, as these organisations are not a part of Victim Support, we cannot guarantee the level or quality of service you may receive. When we provide signposting information to you i.e., we do not make a direct referral but provide you with information sources that may be useful to you, we do not endorse the services and the use of the information is at your own discretion.

• Without consent, if required by law or to protect someone’s safety

• With joint controllers (we’ll tell you who they are)

In some areas of England and Wales, Victim Support delivers services as part of a commissioned group of service providers. This type of service delivery model often means one organisation receives all referrals for all victims into one central database and processes that data solely for the purpose of making an onward referral to the part of the group that can best meet your needs. Where this happens Victim Support and the other organisations that form the group are normally joint controllers of your data and/or the onward referral is made on the legal basis of public task. Victim Support does not require your consent to make these onward referrals.

International transfers

• All VS systems are located in the UK. Some third-party platforms may process data outside the UK/EEA. Where this occurs, Victim Support ensures that appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions, to protect your personal information.

How long we keep your data

• If you accept support: 6 years
• If you decline: up to 12 months
• Children and young people’s data will be retained until their 25^th birthday to ensure they can access that data in adulthood
• See our Retention Policy for more details

Your rights

You have the following rights under data protection legislation:

• The right to be informed

You have the right to be informed of how your personal information will be used, for how long it will be kept, how you can opt out of further processing, and the right to lodge a complaint with a supervisory authority.

• The right of access

You have the right to ask Victim Support to provide you with any personal information we hold about you this is known as a Subject Access Request.

Victim Support reserve the right to charge a reasonable fee for, or refuse to respond to, any request it deems manifestly unfounded or excessive.

Where it is not possible to comply with the request without disclosing information that identifies another individual we do not have to comply with the request.

• The right to rectification

You have the right to request that Victim Support corrects any personal information the charity holds on you if it is factually inaccurate or incomplete.

• The right of erasure

You have the right to request deletion or removal of your personal information in specific circumstances. This right does not apply when personal data is processed on the legal basis of public task.

• The right to restrict processing

You have the right to request Victim Support suppresses processing of your personal information.

• The right to object

You have the right to object to Victim Support processing your information in certain circumstances.

• The right to withdraw consent where your personal information is being processed based on that consent.
• The right to lodge a complaint with the ICO

The Information Commissioner’s Office can be contacted at:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
https://ico.org.uk/for-the-public/

• Exemptions to data subject rights

There are certain circumstances where data protection legislation (such as the UK GDPR and Data Protection Act 2018) allows organisations to withhold or limit the information provided to individuals, or to refuse requests to exercise specific rights. These exemptions may apply, for example, where disclosure would adversely affect the rights and freedoms of others (such as when processing the data of alleged perpetrators or offenders to ensure the safe support of victims), compromise ongoing investigations, breach legal privilege, or conflict with statutory obligations. Where an exemption applies, we will explain the reason for our decision and provide information about your right to challenge it or seek advice from the Information Commissioner’s Office.

Some Victim Support services process personal information on behalf of another organisation. This means we are not the controller of your personal information. We will let you know when this is the case and support you to exercise your rights from the controller.

How to Exercise Your Rights

Contact your local team or email: dpo@victimsupport.org.uk

If you are a child or young person, your rights in data protection legislation are the same as adults if we can establish you are competent or mature enough to understand those rights. Please see our CYP Privacy Notice [PDF]

Complaints

• Use our online Complaints Form
• Contact our DPO: dpo@victimsupport.org.uk
• Contact the ICO: https://ico.org.uk/for-the-public/

Automated Decisions

We do not make automated decisions about you. Automated decision-making means decisions made solely by automated means without human involvement.

Accessibility

This notice is available in alternative formats on request.