PURPOSE

Cocaine Anonymous Online GB Area (CAOGB) is committed to protecting the privacy, confidentiality and personal data of members, visitors, volunteers, and trusted servants who participate in our online meetings, services, and activities. This policy applies the obligations brought about by the following legislation

• UK General Data Protection Regulation (UK GDPR)
• Data Protection Act 2018
• Data Use and Access Act 2025
• Applicable international privacy laws where users access services outside the UK.

This policy explains how personal information is collected, used, stored and protected in accordance with applicable data protection laws and CA’s Traditions, particularly the principle of personal anonymity.

SCOPE

This policy applies to:

• Online meetings and events hosted by CAOGB
• Websites, social media accounts, and online services operated by CAOGB
• Mailing lists, contact forms, and service communications
• Volunteers and trusted servants handling member information
• Any digital or administrative systems used by CAOGB

CAOGB provides online recovery support services, meetings, and resources for individuals seeking recovery from cocaine and other drug addictions.

Data Controller

Cocaine Anonymous Online GB Area (CAOGB) is the Data Controller of all personal data it may process.

Contact Email for any queries: trustees@caonline.org

GUIDING PRINCIPLES

CAOGB handles personal data according to the following principles:

• Personal anonymity is respected at all times.
• Only necessary information is collected.
• Personal information is not sold or shared for commercial purposes.
• Data is protected against unauthorized access or misuse.
• Members may participate anonymously whenever possible.

CAOGB has an obligation to observe the seven UK GDPR Principles article 5 (1a-f,2) when processing personal data. These include:

1. Processing should be clear and transparent. This is achieved by explaining to individuals how we will process their personal data and why. Privacy notices are provided at the earliest opportunity.
2. Personal data is processed for explicit purposes. We may only gather personal data where a clear purpose has been identified. Those purposes are clearly documented in this policy.
3. The processing of personal data is strictly limited to those purposes. This means for example, data gathered for a specific purpose, may not be processed for another incompatible purpose.
4. Personal data processed must be accurate and where necessary inaccuracies must be rectified without undue delay.
5. Personal data must not be retained for any longer than is necessary. We therefore observe all statutory retention periods such as those included in employment law. We also retain personal data for specific periods based on our business or insurance requirements.
6. We have appropriate technical and organisational security measures in place to protect personal data. This includes data protection awareness training for our staff and volunteers.
7. We are accountable for our processing activities. We maintain records, undertake risk assessments and ensure our team is aware of their responsibilities.

THE LAWFUL BASIS FOR PROCESSING PERSONAL DATA

a. There are six lawful bases for processing personal data. We may use the following conditions under certain circumstances:

Consent. Where it is appropriate to do so, we may ask an individual to consent for us to process their personal data. Where this is the case, we must ensure that the individual is informed as to what they are consenting too. They must have a choice as to whether to consent to such a purpose and they must be able to withdraw their consent at any time.

b. Processing is necessary due to a contractual obligation. This will apply only where there is a financial consideration between the parties such as employment. It does not apply to volunteers or clients who do not pay for our services.

c. A legal obligation to process personal data. This applies where another law obligates us to process personal data.

d. Processing is necessary due to a public task or interest. This is unlikely to be a condition we may rely upon but is central to our processing activities where a safeguarding issue has been identified. Where this is the case, we also rely upon the Appropriate Policy Document.

e. Processing personal data in our Legitimate Interest. Where a purpose is lawful and where no other condition may be applied, we may process personal data in our Legitimate Interest. We may undertake a Legitimate Interest Assessment (LIA) to ensure this condition is appropriate to use. This condition is also used in conjunction with the condition in section (d) of this policy and where the provisions of the Data Protection Act 2018 Schedule 1 are applied.

SAFEGUARDING

1. Our duty to safeguard our clients’ best interests is a cornerstone of our work. Where a concern is identified we must ensure appropriate action is taken. In such circumstances we will not use the Consent of the individual as the lawful basis as this may prejudice the outcome. Instead we rely upon Legitimate Interest (see section e) in conjunction with Public Interest, (see section d) and the Data Protection Act 2018 Schedule 1, Part 2, paragraph 18, ‘safeguarding of children and of individuals at risk’
2. This process enables the lawful processing of sensitive personal data without the consent of the individual. We rely upon the Appropriate Policy Document for this activity.

INFORMATION RIGHTS

a. There are eight information rights that may be upheld. They include:

b. The right to be informed. This is achieved by ensuring privacy information is available via our website or anywhere else we may gather personal data. It may also be provided verbally.

c. The right to access personal data. We provide access to personal data where a Data Subject makes a request. This is normally completed within one month. It should be noted that the requester does not have an absolute right to access their personal data. Reason for not allowing access include but may not be limited to, where the data identifies another person, where it is deemed to be confidential, where it may lead to harm to the individual, where it is legally privileged, or where it relates to management decision making.

d. Right to rectify inaccuracies. In accurate information should be corrected within a reasonable time frame.

e. Right to be forgotten. Under some circumstances we may delete records pertaining to an individual when requested to do so. However, if there is a contractual or legal obligation this will not be possible until the statutory data retention period has been met. Other reasons to not uphold this right include safeguarding.

f. Right to restrict processing activities. This may be upheld where there is a concern about the validity of the activity concerned. Processing may resume once the concerns have been addressed.

g. Right to portability may apply if a client wishes for their personal data and records to be sent to another provider.

h. When we make automated decisions about an individual, for example using Artificial Intelligence, we must provide human oversight and be able to explain how such a decision was made. An individual may question such decisions and have them reviewed.

i. An individual has the right to object to our processing activities. Our normal complaints procedure should suffice but we are obliged to inform the individual that they can complain to the regulator.

RISK ASSESSMENTS

1. We may assess the risk of certain processing activities. The UK GDPR requires a Data Protection Impact Assessment to be completed where there is a new way of processing activity or where special category data is being processed. Our policy framework includes a template for such assessments.
2. Assessments should be periodically reviewed

DATA BREACHES AND INFRINGEMENTS OF UK LAW

We are obligated to report such circumstances to the Information Commissioner’s Office (ICO). This should be completed within 72 hours of discovery of such events.

INFORMATION WE MAY COLLECT

Depending on participation, CAOGB may collect:

Basic contact information

• First name or pseudonym
• Email address
• Service contact details
• Matters concerning a safeguarding concern

Meeting participation information

• Online meeting usernames or display names
• Service roles or commitments

Technical information

• Website usage data (non-identifying analytics)
• IP addresses collected automatically by online platforms

CAOGB encourages members to use first names or pseudonyms rather than full legal names.

HOW INFORMATION IS USED

Information may be used to:

• Provide meeting access and fellowship services
• Send service or event communications
• Support trusted servant coordination
• Maintain website and meeting security
• Respond to inquiries or support requests

Information is not used for marketing or commercial activity.

ANONYMITY IN MEETINGS

Members are reminded:

• Participation in meetings is voluntary.
• Cameras and microphones are optional unless required for service roles.
• Recording meetings without permission is prohibited.
• Screenshots or sharing participant information outside meetings is prohibited

Meeting chairs may remind participants of anonymity principles.

DATA STORAGE AND SECURITY

CAOGB takes reasonable steps to protect information:

• Access limited to trusted servants with service needs.
• Password-protected systems where applicable.
• Use of secure service platforms where possible.
• Regular review of stored information.

However, complete security of online communication cannot be guaranteed.

DATA SHARING

CAOGB does not sell or rent personal information.

Information may be shared only when:

• Required for service functions within CA
• Required by law
• Necessary to protect safety or prevent harm

Only minimum necessary information is shared.

DATA RETENTION

Personal information is kept only as long as necessary for service purposes. Contact lists and service information are periodically reviewed and outdated information removed.

MEMBERS RESPONSIBILITIES

Members are encouraged to:

• Protect their own anonymity online
• Avoid sharing personal information of others.
• Use discretion when posting or communicating online.
• Respect confidentiality within meetings.

CHILDREN AND YOUNG PEOPLE

CA is intended for individuals seeking recovery from addiction. CAOGB does not knowingly collect information from minors. Local laws regarding participation by minors should be observed.

EXTERNAL PLATFORMS

Meetings and services may use third-party platforms (e.g., video conferencing, email providers). These services have their own privacy policies, and participants are encouraged to review them.

REVIEW AND AMENDMENTS

This policy may be updated periodically to reflect changes in services or legal requirements. Updates will be communicated through CAOGB service channels.

CONTACT INFORMATION

Questions or concerns regarding privacy or data protection may be directed to:

Cocaine Anonymous Online GB Area
Service Email: trustees@caonline.org
Website: caonline.org

APPROVAL RECORD

This policy was approved by: Trustees (On behalf of the C.A. Online GB Area)

• Approval Date: 17th August 2026
• Date of next Review: 1st September 2027

This document supports clarity, unity, and effective service within the Cocaine Anonymous Online GB Area.

APPENDICES

Further information on matters covered by this policy can be found in the relevant documents, guidelines and procedures, which provide practical guidance on the application of this policy.

APPENDIX 1: ONLINE ANONYMITY STATEMENT EXAMPLE

Cocaine Anonymous Online GB Area – Online Meeting Anonymity Statement

In keeping with the Traditions of Cocaine Anonymous, we remind all participants that anonymity is the spiritual foundation of all our Traditions.

Who you see here, what you hear here, and whom you meet here, let it stay here.

Please respect the privacy and anonymity of all participants by:

• Using only your first name or a nickname if you prefer.
• Not recording this meeting in any way.
• Not taking screenshots or sharing participant information.
• Not repeating personal stories or identifying details outside the meeting.
• Ensuring your own surroundings protect your anonymity as needed.
• Participation by camera or microphone is voluntary unless required for a service role.

Our common welfare depends upon trust and confidentiality so that everyone feels safe to share openly.

Thank you for helping us maintain a safe and anonymous recovery environment.

APPENDIX 2: SAFEGUARDING ANNOUNCEMENT FOR MEETING CHAIRS

Short Safeguarding Announcement for Chairs

Before we begin, a brief safeguarding reminder:

Please help keep this meeting safe and respectful for everyone. Harassment, bullying, or inappropriate behavior is not acceptable. Please respect personal boundaries and anonymity, and do not pressure anyone to share contact details or personal information.

If any participant feels uncomfortable or unsafe, please contact the meeting host or a trusted servant.

Thank you for helping maintain a safe recovery space for all.

APPENDIX 3: RECOMMENDED ZOOM MEETING SETTINGS AND SAFETY CHECKLISTS FOR HOSTS

Zoom Host Safety Settings Guide For Online Recovery Meetings

This guide helps meeting hosts create a safer and more respectful online meeting environment.

General Host Best Practices

• Open the meeting early to test settings.
• Assign a co-host or co-chair when possible.
• Monitor participants and chat during the meeting.
• Remind participants of anonymity and meeting conduct.

Zoom Recommended Settings

Before the Meeting

Enable:

• Waiting Room – allows hosts to admit participants individually
• Meeting Passcode – prevents unwanted access.
• Only authenticated users if appropriate.
• Disable participant screen sharing by default.
• Disable automatic recording.
• Mute participants upon entry.

Optional depending on meeting style:

• Allow participants to rename themselves.
• Allow camera optional for anonymity.

During the Meeting

Hosts or co-hosts should:

• Admit participants from the waiting room carefully.
• Mute disruptive participants if needed.
• Stop participant screen sharing if misused.
• Disable chat temporarily if chat becomes disruptive.
• Remove disruptive attendees if necessary.
• Lock meeting after start time if appropriate.

Zoom Chat, Messaging, Anonymity and Data Protection

Recommended options:

• Limit chat to the host or to everyone publicly, depending on the meeting format.
• Disable private participant-to-participant chat where appropriate.
• Remind participants not to pressure others for contact details or other personal information.
• Participants should be reminded that anything shared in the Zoom chat may contain personal or identifying information and should therefore be treated with the same respect for anonymity as information shared verbally during the meeting.
• In keeping with Cocaine Anonymous Tradition 12, Zoom chat should not be retained unnecessarily after the meeting. At the conclusion of each meeting, the host or another responsible trusted servant should ensure that the Zoom chat is deleted where the platform permits.
• This should form part of the end-of-meeting procedure so that subsequent users of the device, Zoom account or meeting cannot access previous meeting conversations, participant names, contact details or other potentially identifying information.
• Deleting the chat also supports good data protection practice by ensuring that personal information is not retained for longer than necessary, in accordance with the CAOGB Privacy and Data Protection Policy.

These measures help protect the anonymity and confidentiality of members while also reducing the risk of personal information being inadvertently accessed or retained.

Removing Disruptive Participants

If someone behaves inappropriately:

• Issue a reminder of meeting guidelines.
• Mute or stop video if needed.
• Remove participants if behavior continues.
• Enable “Prevent removed participants from rejoining.”

Suggested Host Checklist

Before meeting:

• Waiting room/lobby enabled
• Screen share restricted
• Co-host assigned
• Recording disabled

During meeting:

• Monitor chat
• Watch participant behavior
• Address disruptions calmly

After meeting:

• Remove remaining participants if needed
• Review any incidents with service committee
• Delete chat