Community workshop – The Owl’s Nest

Privacy for pathways and support

In pathways and support we process more data than in a single workshop or a one-off question. That is mainly because of coordination: we work with goals, appointments, follow-up and (where appropriate) contact with a referrer. At the same time we keep it practical: we do not collect information “just because we can”, but because it is needed to make the pathway workable and safe.

Key principle: you stay in control. We agree in advance whether there is coordination with a referrer, what we share back, and how you can review what is recorded about you. For privacy questions or GDPR requests, email privacy@the-owls-nest.nl.

Scope: what we do and do not do

The Owl’s Nest is a community workshop. We provide practical support and structure in a workshop setting. We are not a healthcare provider and we do not keep medical or psychological files. If there is crisis, instability or acute care needs, the lead clinician or lead support worker remains responsible.

What data we process in a pathway

A pathway typically results in a file (“relationship file”) with information needed for planning, execution, safety and accountability. This may include:

• Basic details: your name and contact details (phone and/or email), and where needed address details.
• Referral and context: who referred you (contact person/organisation), the purpose of the referral, and practical conditions.
• Appointments and planning: appointment moments, attendance, working agreements and concrete next steps.
• Workshop observations: practical, observable items such as capacity within activities, work pace, keeping appointments, cooperation and response to change or stress.
• Files and materials: photos/videos of a problem or files for printing/cutting, only if needed for the pathway or if you ask us to keep them.
• Communication: relevant coordination with you and (if agreed) with the referrer.
• Incidents: if an accident or safety issue occurs (see “Incidents and safety”).

Sensitive information and special categories of data

We try not to collect sensitive information (such as medical details) via email or forms. If certain information is needed to work safely or to make reasonable adjustments, we record it as minimally as possible and restrict access to the core team.

Control, review and sharing with a referrer

In a pathway, coordination with a referrer can be useful. Our fixed way of working is: you stay in control, and we do this transparently and with your agreement.

• Review before sending: if we prepare an interim update or a final report, you are always involved in drafting it. You always get to review the text before we send anything.
• Coordination in your presence: coordination with a referrer only takes place with your agreement, and in your presence – unless you explicitly choose otherwise (for example because you prefer written feedback, or because you do not want to attend the conversation).
• Consent for data exchange: for exchanging data with a referrer we use a consent statement that you sign. This consent can always be withdrawn. Withdrawal means that from that moment onward we do not do any new data exchange. Withdrawal does not automatically end the pathway; we then look together at what is still feasible and appropriate.
• Chain requests: if a chain request comes in (a request within the chain of organisations involved around your pathway), we cooperate within the limits of what is necessary. We inform you that a chain request has been received and what it is about.
• Your requests and the chain route: you have the right to request access to or a copy of your data yourself. If you submit a request to us, we ask whether you want us to raise it as a chain request on your behalf. If (part of) our chain request is refused, we tell you, so that – if you wish – you can also submit a direct request yourself.

We keep feedback limited to practical, workshop-based information. We do not provide medical or psychological reports.

Interim updates and final report

If the pathway calls for it, we can provide interim feedback and conclude with a short final report. We always do this according to the agreements above: transparently, with your agreement, and with review before sending.

Our feedback covers practical, verifiable information from the workshop context, for example:

• attendance and keeping agreements,
• building routine and capacity within activities,
• what helps (conditions, stimulus load, support),
• feasible next steps.

We agree in advance whether reporting happens, when, and to whom. We correct factual inaccuracies. If you disagree with an observation or conclusion, we can include your response as an addendum.

Business: invoices and quotations

Only when an invoice or a quotation is needed, we process additional business details:

• Company name and address (for invoicing).
• Chamber of Commerce number is optional.
• We process a VAT number where required, for example for an overseas client or supplier.

Who can access this data?

• Core team: access to file information needed for execution, follow-up, safety, chain coordination and accountability.
• Workshop tutors/mentors/volunteers: only what is needed for the specific appointment (e.g. name, when, what for, and where necessary relevant files or photos).

Retention, files and backups

Pathway information is recorded in a named relationship file. We review these files periodically (once every 5 years) and archive them where needed for continuity, accountability, or the ability to reconstruct agreements. For temporary matters that do not lead to an ongoing contact we may use an anonymous folder (“miscellaneous”) with a retention period of up to 1 year.

Sometimes we place files or images temporarily on our NAS to complete a step. After completion we remove them from the temporary storage. If they are needed again later, the core team will retrieve them via the relationship file or via “miscellaneous”.

Our systems are also backed up for disaster recovery: recovery after loss, failure, error or incident. These backups are not a working archive and are not searched for day-to-day handling. They are full system backups (operating system, settings and data), not selective backups of individual database items, emails or files.

Backups are stored on our own equipment (no cloud) and are only accessible to the designated backup operator within the core team. The retention schedule is: daily 21 days, weekly 20 weeks, monthly 12 months and yearly 10 years.

Please note: invoices and receipts are part of our administration and are retained in line with the applicable retention requirements.

Incidents and safety

In case of an accident, conflict or safety issue, we may record an incident for follow-up, insurance and compliance. This may include what happened, when, and contact details to handle things properly. Where needed, we record additional details relevant to safety (for example involved materials or substances). Only the core team has access.

When do we share data with third parties?

• Referrer: only if agreed (see “Control, review and sharing”), and limited to practical workshop-based information.
• Insurer: only in case of a claim, and only the data needed to handle the claim.
• Authorities: if an authority requests data, we assess the request carefully and do not disclose more than necessary. When we are legally required to provide data, we comply with that obligation.

Your rights and contact

You can always ask what data we have recorded about you and request access. You can have factual data corrected and you can ask us to delete data if it is no longer needed. You can also object to certain processing. For privacy questions or GDPR requests, email privacy@the-owls-nest.nl.

Foundation, central privacy and canary statement

The Owl’s Nest is a project of the foundation behind ASK-Solutions. On this website we explain what happens here in terms of privacy, but the general foundation-wide basis and arrangements are centralised on the main site in the central privacy statement.

The main site also hosts our warrant canary statement. For questions or GDPR requests about The Owl’s Nest you can always email privacy@the-owls-nest.nl.