1. Privacy Notices – Overview Information Expand About Us Adoption UK is a registered charitable company (Charity number 1160647; Company number 09454981) referred to variously throughout our Privacy Notices as ‘Adoption UK’, ‘<Service Name>’, Us’ and ‘We’. For the purposes of the data processing described in this statement, Adoption UK act as the Data Controller unless otherwise stated. Throughout our Privacy Notices, where we refer to ‘you’, if you engage with us on behalf of your family, we are referring to both you and your family. Our Commitment If you and/or your family use an Adoption UK service, you can be assured that we are committed to making sure that any information we hold about you will be collected, stored and used in accordance with The Data Protection Act 2018 and General Data Protection Regulation 2016/679 (GDPR). This means that we adhere to the data protection principles of only holding information about you that is relevant to our work with you, that we make sure the information that we hold is accurate, up to date, secure, and only kept for as long as we need it. Should you have any questions relating to this notice or our processing of personal data, please email our Data Protection Officer at [email protected] or contact us at Adoption UK, Bloxham Mill, Barford Road, Bloxham, Banbury, OX15 4FF.
2. Services Privacy Notice Expand This Privacy Notice is for users of all Adoption UK services. This includes but is not limited to Psychology and Therapy Hub (PATH) services, Peer to Peer, Membership, Scotland FASD Service, Kinship Care Advisory Service Scotland and general community support services. There is a separate notice for: Fundraising, Public Affairs and Marketing Training and Consultancy Privacy NoticeEmployee, Volunteer and Contractor Privacy Notice Where we collect personal information from: We may collect information about you at a number of stages in your use of our service. Referral You may be referred to our service by a social worker or other support organisation that is providing services to you. Where they refer to us, they will usually ask for your consent to do so. As part of the referral, they may share with us your contact information and the reason for their referral. If you choose not to participate the referral information will be removed, otherwise it will be added to the information we collect about you as part of providing the service to you. Registration When you register with an Adoption UK service, we may record the basic information we need in order to be able to provide the service and/or contact you. This will include your name, where you live, information about why you are using an Adoption UK service and the work that we are doing with you. Data collected from you will be retained while you use our service and may be held for a number of years after you cease using the service for purposes of compliance with Adoption Support Regulations. During your Engagement with us Throughout your engagement with us, our service team will record information about the service provided to you, including case reporting, plans and reviews. We collect this information so that we can keep in touch with you during the course of the work we are doing with you, to work out how best we can help you, to record the work that we have done and to assess how that work has gone. This will help us to fully understand your needs, recommend actions and improve the services that we deliver to you. Data collected during service delivery will be maintained in your case file for a number of years after you cease using the service for compliance purposes. When you contact our helplines If you contact one of our helplines, the helpline team will collect information about your enquiry and the details of your call. If necessary and with your consent, they may then refer you to another service team to resolve your request. Calls will also be recorded for training and compliance purposes or to improve our services. If you make a complaint If you make a complaint about the services you have received or one of our service team, the details of the complaint will be recorded and processed to investigate and resolve the issue. Information will only be provided to members of the team with a need to know. What personal information do we record? The type of information (including personal information) that we collect and use and what we do with it will depend upon your relationship with us.We collect only the personal data that we require to provide you with services, fulfil contracts or keep in touch. The data we collect enables us to deliver services that are that are most appropriate to your needs. Should you choose not to divulge this information to us, it may affect our ability to provide the service to you. The data that we need to collect will vary, but may include: Your name Your contact details, including email, telephone number and postal address Your date of birth The details of your family Reason for Referral Photographs (Of group sessions and events) Healthcare Information Names of your child(ren)’s school and teacher(s) Employment information, Occupation Social Care History Ethnicity information Disability information Your religion Sexual Orientation Details needed to improve your experience such as dietary requirements or accessibility needs Special Categories of Data Due to the nature of the services we provide, some of the data we collect is sensitive.Information relating to Health, Ethnicity, Religion and Sexual Orientation are considered to be Special Categories of Data and we are required to take extra care when handling this information. We may need to process this data under the following conditions: With your explicit consent. Where it is necessary in substantial public interest in: Preventing and detecting unlawful acts. Ensuring equality of opportunity and treatment Provision of confidential counselling or support services Safeguarding of children and individuals at risk. Safeguarding of economic wellbeing of at-risk individuals Children and Young Person’s information Adoption UK is committed to protecting the privacy of the children and young people you provide us with information about, whether this be through our website or at fundraising events. Adoption UK requires the consent of a parent or guardian before anyone under 16 years of age participates in an event organised by us. Children aged under 13 must obtain the consent of a parent or guardian before providing any personal information. Who Will Have Access to Information About you? Your information will only be accessed by people who need to do so as part of their role. This could include: Staff working at the service that you use. Staff supporting the delivery of our services. Adoption UK senior managers (If there is a need to do so). Staff working for our partner organisations where we operate the service as part of a partnership. Our commissioners, on whose behalf we may be running the service you use. In some circumstances commissioners may be allowed to check files to make sure that we are providing you with the service that we should be. Regulators (such as OFSTED or Care Inspectorate Wales), who may review our work in order to ensure that we are doing a good job and keeping clear and accurate records. Staff working at partner organisations carrying out surveys or market research on behalf of Adoption UK We will always respect your privacy, and will seek your permission before sharing your record with any other services (other than those referenced above) that you are working with. In the following limited circumstances, we may also be obliged to share your information: If we believe you or somebody else could be at risk if we do not do so. If we are legally obliged to share your information, such as in response to a court order. How Do We Use Your Information? Adoption UK will only use your information in a fair and transparent manner and where we have a legal basis for doing so. To Keep in ContactIn order to provide the services that you have registered for, we will need to communicate with you to arrange meetings and visits and discuss aspects of your requirements and to invite you to participate in surveys or market research relevant to Adoption UK services or campaigns. This communication may be via Mail, Email, Telephone or SMS. Legal Basis: Performance of Contract To send you newsletters and information you have requested. Where we provide an information service, we will send you the requested information. To tell you about events and other services that may be of interest to you -Adoption UK provide a range of support and advice services throughout the UK. If we feel that you may be interested in services for which you are not currently registered, we would like to send you this information. Legal basis: Legitimate Interests If we do so by email, we will ask for your consent. Legal Basis: Consent To provide the services you have agreed to. We will process your personal information in order to provide the services for which you have registered, this may include; providing support, information, social care or specific therapies. We will use the information to work out how best we can help you, to provide the best possible service to you, and to record the work that we have done and to assess how that work has gone. Legal Basis: Public Task / Legal Obligation / Legitimate Interests / Performance of Contract To refer you for services provided by other service providers. If, in the course of our work together, we think that there may be other services that would be of benefit to you we may suggest a referral to those service providers. We will discuss this with you and seek your consent before sharing your information with anyone else. Legal Basis: Consent To publicise the work that we do. Adoption UK would like to make people aware of the work that we do in the community, this enables us to provide services to more people. We may use anonymised case studies to tell people about our work. Legal Basis: Legitimate Interests To provide anonymous reports to our funders and commissioners. Many of our services are funded by other organisations, such as the local authority, government departments, the NHS or other charities. We may use anonymised data and statistics to report to them on the performance of our services. Sharing Data with Third-Parties We will never share your information with a third party who intends to use it for their own marketing purposes and there are very limited instances where we will share your personal data with a third party. These could include: If a third party provides a service to us, such as running an event on our behalf, undertaking surveys or market research on our behalf or providing an element of a contract for us, such as email distribution or postal mail distribution . For the administration of events. For example, an event venue may require the provision of the names of attendees in advance, for security purposes. Where there is a legal or regulatory requirement to disclose your personal information such as from HMRC or the courts, we have a genuine and real concern regarding a person’s well-being, or where disclosure is necessary for taxation and criminal investigation purposes. In order to prevent fraud and crime, we may perform due diligence checks to ensure we are not being abused, such as by fraudsters or criminals posing as genuine donors for example money laundering proceeds of crime and tax avoidance. We do these checks to help protect Adoption UK from abuse. Where does Adoption UK store your personal information? Wherever possible, we ensure that your personal data is kept in the UK. We minimise use of servers outside of the EEA and in some limited instances if we need to transfer your personal information to a third party for processing in countries that aren’t listed as ‘adequate’ by the European Commission we’ll only do so where we have appropriate contracts or other appropriate safeguards in place. By communicating electronically with us, you acknowledge and agree that your data may be processed in this way. How long will Adoption UK retain your personal information? We will only keep information about you for the length of time it is necessary to do so in order to engage with you in the way that you have requested and in accordance with our data protection legal requirements, our regulatory requirements as a registered adoption support agency, and tax and accounting rules. When your personal data is no longer needed, we will ensure that it is disposed of in a secure manner. If you would like us to delete any information we hold about you, please contact us using the details in the “Contact us” section and note the ‘Your Rights’ section below. Your Rights You have the following rights with respect to the data that we hold about you. Right to Access You have qualified rights to see the information we hold about you. If you would like to see the information that Adoption UK holds about you, please email The Data Protection Officer at [email protected] or write to us at the below address. We will then be able to arrange either for you to either look through your file with a member of staff, or for you to be sent a copy of the information. Can you see all of the information Adoption UK holds about you? In some circumstances, we may not be able to share the entire contents of your file with you. This could be if, for example, a doctor, has written to us in confidence. We would not be able to share such information with you unless the person who provided us with the information agreed to do so. We also may not be able to share information with you if we believe that it could seriously harm you to see it. In order to protect the privacy of others, we may not be able to share information about other people that appears in your file. Right to Rectification If the information we hold about you is incorrect or you would like Adoption UK to delete the information held about you. We would like to ensure that all the information we hold is accurate and up to date. If you believe that the information we hold about you is incorrect please first speak to a member of the service team who support you, they may be able to correct any inaccurate data. To make a formal request to correct or make any changes to the information, or for us to delete the information we hold about you, please email the Data Protection Officer at [email protected] or write to us at the below address. Each request will be dealt with on a case by case basis. Once you finished using an Adoption UK service Once you’ve finished using an Adoption UK service, your file will be closed. We will then archive your file and keep it in accordance with our data retention policy and legal and compliance requirements. We will not keep your file for longer than it is needed or required by law. Once your file is no longer required, it will be securely disposed of. You can request access to the file at any point prior to its destruction. In some circumstances, where Adoption UK are providing a service on behalf of another organisation, control over the retention and destruction of those fills will fall to that organisation and be dependent upon their own policies and procedures. If you are concerned about what is in your file or how it is stored If you are unhappy with any aspect of how your file is held, who sees it, or the contents of it, please contact the Data Protection Officer at [email protected] or follow the Adoption UK Complaints Procedure. For further information about our Complaints Procedure, which is published on the Adoption UK website, or speak to the manager of the service you have been using. You can also complain to the Information Commissioner at: Information Commissioner, Wycliffe House, Water Lane, Wilmslow, SK9 5AF, or on 01625 545 745. Contact with Corporate Subscribers under PECR ‘Corporate Subscribers’ are people who Adoption UK might contact in a professional context, using their work contact details, including phone, email and post. These contact details may be obtained from public domain sources (company websites etc.), from our own business records or from other companies and business contacts. Adoption UK may contact Corporate Subscribers under the legal basis of Legitimate Interests and as permitted under the PECR (2003) legislation. We may contact corporate subscribers by email or telephone provided that the subscriber has not previously opted out and is not registered with the Telephone Preference Service (TPS) or its corporate equivalent (CTPS). Direct Mail is not covered by PECR. We may contact subscribers by mail if they have not previously opted out of receiving such communications. You have a right to object to the processing of your data for direct marketing. We will provide opt-out notices on our communications to you, or you can advise our team at [email protected] Adoption UK understands that PECR (2003) legislation will be replaced by the EU e-Privacy Regulation (ePR) in due course and reserves the right to review this privacy notice accordingly. Changes to this policy Adoption UK reserves the right to make changes to our privacy policy from time to time. Where we do so, we will publish the new policy on our website www.adoptionuk.org and where appropriate notify you by email. Contact Details If you would like to speak to someone at Adoption UK about how you collect, use and store my personal data; or if you have any questions, comments, requests or suggestions, please contact our Data Protection Officer at [email protected], by post at Adoption UK, Bloxham Mill, Barford Road, Bloxham, Banbury, OX15 4FF or on 01295752240. If you would like to change your contact preferences, please get in touch with us at:[email protected] or telephone our helpline on 0300 666 0006.
3. Training and Consultancy Privacy Notice Expand This Privacy Notice is for users of all Adoption UK Training and Consultancy. There is a separate notice for our Adoption Support Services; Fundraising, Public Affairs and marketing; and for those who work for us: Services Privacy NoticeFundraising, Public Affairs and MarketingEmployee, Volunteer and Contractor Privacy Notice Where we collect personal information from: Most of the information we hold and process will have been provided by you. When you provide your personal information directly to us. If you sign up to one of our training events, request some information, purchase a product, or communicate directly with our teams for another reason, whether online, on paper, in person, or over the phone, you will be sharing your personal information with us. When you provide your personal information through a third-party organisationFor example, when we are commissioned to deliver training and your name and details are sent as part of an attendance list. Publicly available personal information - if your contact details are recorded online in a public website. What personal information do we record? The type of information (including personal information) that we collect and use and what we do with it will depend upon your relationship with us.We collect only the personal data that we require to provide you with services, fulfil contracts or keep in touch. The data we collect enables us to deliver services that are that are most appropriate to your needs. Should you choose not to divulge this information to us, it may affect our ability to provide the service to you. The data that we need to collect will vary, but for training and consultancy services this may include: Your name Your contact details, including email, telephone number and postal address Your date of birth The details of your family Photographs (Of group sessions and events) Ethnicity information Disability information Your religion Sexual Orientation Details needed to improve your experience such as dietary requirements or accessibility needs. Where we provide you with other types of service in addition to training or consultancy, we are likely to collect additional data about you and your family. Special Categories of Data Due to the nature of the services we provide, some of the data we collect is sensitive.Information relating to Health, Ethnicity, Religion and Sexual Orientation are considered to be Special Categories of Data and we are required to take extra care when handling this information. We may need to process this data under the following conditions: With your explicit consent. Where it is necessary in substantial public interest in: Preventing and detecting unlawful acts. Ensuring equality of opportunity and treatment Provision of confidential counselling or support services Safeguarding of children and individuals at risk. Safeguarding of economic wellbeing of at-risk individuals Children and Young Person’s information Adoption UK is committed to protecting the privacy of the children and young people you provide us with information about, whether this be through our website or at fundraising events. Adoption UK requires the consent of a parent or guardian before anyone under 16 years of age participates in an event organised by us. Children aged under 13 must obtain the consent of a parent or guardian before providing any personal information Who Will Have Access to Information About you? Your information will only be accessed by people who need to do so as part of their role. This could include: Staff working at the service that you use. Staff supporting the delivery of our services. Adoption UK senior managers (If there is a need to do so). Staff working for our partner organisations where we operate the service as part of a partnership. Our commissioners, on whose behalf we may be running the service you use. In some circumstances commissioners may be allowed to check files to make sure that we are providing you with the service that we should be. Regulators (such as OFSTED or Care Inspectorate Wales), who may review our work in order to ensure that we are doing a good job and keeping clear and accurate records. We will always respect your privacy, and will seek your permission before sharing your record with any other services that you are working with. In the following limited circumstances, we may also be obliged to share your information: If we believe you or somebody else could be at risk if we do not do so. If we are legally obliged to share your information, such as in response to a court order. The ways Adoption UK uses your information Adoption UK will only use your information in a fair and transparent manner and where we have a legal basis for doing so. With your ConsentWhere you have consented for us to do so, we will use your data to: Send you information about Adoption UK and our services that we think may be of interest to you. This may be by mail, email, telephone or SMS, but we will offer you the chance to opt in or out of receiving these messages. Direct marketing (if you requested to be added to a list). Sending you relevant information e.g. about legislative changes, research etc. Preparing conference packs. Arrange Training, workshop and conferences. Prepare attendance certificates and analyse Contractual obligation In order to perform our obligations in a contract that we hold with you, we may use and process your personal data where it is necessary for the performance of a contract or agreement that we have with you (For example where you have signed up for a workshop or training course) to enable us to: Run our training, workshops and conferences. Process payments. Provide you with the services, products or information you asked for (including consultancy work). Keep a record of your relationship with us. Make sure we know how you prefer to be contacted. Legitimate interests For our own legitimate interests or those of our clients and customers in: Operating our business efficiently. Marketing our services to potential customers. Ensuring the safety and security of our staff and customers. Informing our commissioners about the performance of our services. In pursuit of these interests, we may: Ask you to give feedback on your use of our services. Provide information about similar products and services that may be of interest. Provide summarized information about our services to the organization that commissioned us. To keep you informed about courses, workshops and conferences that are relevant to you. Recruit staff, associate trainers and volunteers. When Legally Obliged to Do SoUnder certain, limited conditions we may be obliged by law to disclose data to the relevant authorities for example: Keeping financial records. Public interest concerns about a vulnerable child or vulnerable adult. Sharing Data with Third-Parties We will never share your information with a third party who intends to use it for their own marketing purposes and there are very limited instances where we will share your personal data with a third party. These could include: If a third party provides a service to us, such as running an event on our behalf or providing an element of a contract for us, such as email distribution or postal mail distribution. For the administration of events. For example, an event venue may require the provision of the names of attendees in advance, for security purposes. Where there is a legal or regulatory requirement to disclose your personal information such as from HMRC or the courts, we have a genuine and real concern regarding a person’s well-being, or where disclosure is necessary for taxation and criminal investigation purposes. In order to prevent fraud and crime, we may perform due diligence checks to ensure we are not being abused, such as by fraudsters or criminals posing as genuine donors for example money laundering proceeds of crime and tax avoidance. We do these checks to help protect Adoption UK from abuse. Data Security Adoption UK has a number of steps in place to keep your personal information as safe as possible. We train all of our staff in data protection and data security to increase awareness of its importance. We keep our data protection and data security policies and practices under regular review and review the personal data that we hold, where we hold it and what we do with it. Adoption UK requires the third parties it works with to comply with data protection laws and puts controls in place to ensure that your information is handled safely and appropriately. Where does Adoption UK store your personal information? Wherever possible, we ensure that your personal data is kept in the UK. We minimise use of servers outside of the EEA and in some limited instances if we need to transfer your personal information to a third party for processing in countries that aren’t listed as ‘adequate’ by the European Commission we’ll only do so where we have appropriate contracts or other appropriate safeguards in place. By communicating electronically with us, you acknowledge and agree that your data may be processed in this way. How long will Adoption UK retain your personal information? We will only keep information about you for the length of time it is necessary to do so in order to engage with you in the way that you have requested and in accordance with our data protection legal requirements, our regulatory requirements as a registered adoption support agency, and tax and accounting rules. When your personal data is no longer needed, we will ensure that it is disposed of in a secure manner. If you would like us to delete any information we hold about you, please contact us using the details in the “Contact us” section and note the ‘Your Rights’ section below. Your rights The GDPR legislation provides you with a number of rights in relation to your personal data; in some cases these are qualified rights, in particular where we have legal and regulatory requirements to retain certain records. Right to Withdraw Consent Where you have consented to our processing of your data, you have the right to withdraw that consent at any time. To do so, please contact our Data Protection Officer by email at [email protected] or write to us using the details below. Right to Access You have a right to obtain copies of the information that we hold about you.To request access to any data, please email our Data Protection Officer at [email protected] or write to us at the address below explaining which data you require. In the interest of security, you will need to prove your identity before any information can be shared with you. Under certain circumstances we may not be able to disclose all of the information you request, for example if it contains information about other people or there are legal reasons for us to withhold the data. Right to Rectification We would like to ensure that the data we hold about you is accurate and up-to-date. If you believe the data we hold is inaccurate, please tell us in the first instance. However, you may also ask us formally to correct your data by emailing our Data Protection Officer at [email protected] or writing to us at the below. Right to Erasure or the Restriction of ProcessingIn certain circumstances you can ask us to remove your data from our systems by emailing our Data Protection Officer at [email protected] or writing to us at the below address. If there is a legal reason for us to continue holding the data we will let you know, otherwise we will make efforts to comply with your request. You may ask us to restrict our processing of your data if: We are using the data for marketing You believe that our processing of the data is unlawful You object to us using your data (pending investigation) In these circumstances, we may continue to store your information, but will otherwise only process it with your consent or where we have a legal reason to do so. Right to Complain If you are concerned about the way we have processed your personal information, you have the right to complain to the Information Commissioners Officer (ICO). To do so please refer to the ICO website. Contact with Corporate Subscribers under PECR ‘Corporate Subscribers’ are people who Adoption UK might contact in a professional context, using their work contact details, including phone, email and post. These contact details may be obtained from public domain sources (company websites etc.), from our own business records or from other companies and business contacts. Adoption UK may contact Corporate Subscribers under the legal basis of Legitimate Interests and as permitted under the PECR (2003) legislation. We may contact corporate subscribers by email or telephone provided that the subscriber has not previously opted out and is not registered with the Telephone Preference Service (TPS) or its corporate equivalent (CTPS). Direct Mail is not covered by PECR. We may contact subscribers by mail if they have not previously opted out of receiving such communications. You have a right to object to the processing of your data for direct marketing. We will provide opt-out notices on our communications to you, or you can advise us at [email protected]. Adoption UK understands that PECR (2003) legislation will be replaced by the EU e-Privacy Regulation (ePR) in due course and reserves the right to review this privacy notice accordingly. Links Adoption UK does not have any control over how any third-party websites handle and use your data. Therefore, if you follow any links to third party sites from Adoption UK websites, you must check the Privacy Policy for that organisation in order to understand how your data could be used. This policy does not cover third party websites. Changes to this policy To make sure that this policy and our practices stay legally compliant and up-to-date, we may make changes from time to time. If we make any substantial changes, we will make this clear on our website, or by contacting you directly, if appropriate Contact Details If you would like to speak to someone at Adoption UK about how you collect, use and store my personal data; or if you have any questions, comments, requests or suggestions, please contact our Data Protection Officer at [email protected], by post at Adoption UK, Bloxham Mill, Barford Road, Bloxham, Banbury, OX15 4FF or on 01295752240. If you would like to change your contact preferences, please get in touch with us at:[email protected] or telephone our helpline on 0300 666 0006.
4. Fundraising, Public Affairs and Marketing Privacy Notice Expand This Privacy Notice is for individuals communicating with us or supporting us in relation to our Fundraising, Public Affairs and Marketing activities. There is a separate notice for our Adoption Support Services; Training and Consultancy; and for those who work for us: Services Privacy NoticeTraining and Consultancy Privacy NoticeEmployee, Volunteer and Contractor Privacy Notice Where we collect personal information from: When you provide your personal information directly to us. If you sign up to one of our events, make a donation, purchase a product, complete a survey or communicate directly with our teams for another reason, whether online, on paper, in person, or over the phone, you will be sharing your personal information with us. When you provide your personal information through a third-party organisation Adoption UK works with other organisations such as JustGiving, London Marathon, Fundraising Event Partners and Corporate Partners and organisations who have us as their Charity of the Year. We work with these organisations to make sure that we can provide the best services and opportunities to those we work with, our supporters, staff and volunteers. If you provide your personal information to these third parties and indicate that you wish to support Adoption UK or wish to hear from us such as by supporting an event, signing up to hear from us, or making a donation, the organisation you have contacted may share your details with us (including personal information). For information about the type of information receive through these third parties, see the section below “What type of information do you collect”. To learn how these organisations use your personal information, please read their Privacy Policy. Publicly available personal information In some circumstances, we may combine information you provide us with personal information available from external sources such as on your employer’s website, in newspaper and magazine articles in the press, or in public records such as Companies House. This might be in order to provide you with a better experience at Adoption UK events or to ensure that we are contacting you with information that we feel is relevant to you, or in order that we can provide you with a better and more personal experience in your interactions with Adoption UK. It also enables us to gain a better understanding of our supporters to improve our fundraising products and services. If you leave us a legacy and information is required for administration purposes in relation to that legacy, we may refer to publicly available sources in order to obtain the information required for these purposes. Occasionally we obtain publicly available information such as contact information or we research information to help us perform due diligence checks to ensure we are not being abused by fraudsters or criminals posing as genuine donors or to ensure that there are no conflicts of interest from potential supporters or organisations prior to our engagement. This might be if, for example, we noticed unusual donation activity. We do these checks to help protect Adoption UK from abuse. For further information around this please see the marketing section below. Social media We may refer to personal information available on and through your LinkedIn, Twitter and Facebook profile in order to provide you with a better and more personal interaction with Adoption UK. Your personal settings within LinkedIn and the privacy policies of its website and messaging services will determine what information you have given us, and others, permission to access. Please check your settings and the privacy policies of those sites if you’re not sure what permissions you’ve given. When you use our website or apps So that we can make our website as good as possible, and provide the best possible experience for those who use it, we collect cookies when you use our website. This can include the pages you visit and areas that are of most interest. Cookies can also be used to make using the website faster, such as by automatically filling your name and address. Further information about cookies is set out below and in our cookies policy. In addition, the type of device you’re using to access our website or apps and the settings on that device may provide us with information about your device, including the type of device it is, what specific device you have, what operating system you’re using, or why a ‘crash’ has happened. Your device manufacturer or operating system provider will have more details about what information your device makes available to us. What personal information do we record? The type information (including personal information) that we collect and use and what we do with it will depend upon your relationship with us. If you are kind enough to support us, such as by making a donation, registering to hold an event, do some fundraising, signing up for an event or participate in campaigning with us the data that we need to collect will vary, but may include: Your name Your contact details, including email, telephone number and postal address Your date of birth Your personal story or information about your family and experiences of adoption Your image and/or recordings of your voice and/or that of members of your family (with consent) Your bank or credit/debit card details and (only if we need it, such as if you are taking part in a sporting event), health information. Why you’ve decided to campaign, support us or make a donation Details needed for us to provide you materials such as t-shirt size The name and address of your employer, particularly if we are running an event in conjunction with your employer, or your employer is a Corporate Partner of Adoption UK If an event is being provided by a third party, the name and contact details of that third party supplier Details needed to improve your event experience such as dietary requirements or accessibility needs Invoicing information A declaration from you to enable us to re-claim Gift Aid on your donations Special Categories of Data We will rarely collect information classified as “special categories of personal data” or “sensitive personal data”, such as information about your race, religious beliefs, political opinions and health information. We will only do so if there is a clear reason for doing so, such as if you are attending an event and we need your health information to ensure your safety, or to enable you to participate in an event. If you choose to share your personal experiences of adoption or kinship care and in doing so share information about your family. If you provide us with your bank or credit card details to process a payment over the telephone or via a postal mailing, we will always ensure that your information is handled securely. We do not store your credit or debit card details at all following the completion of your transaction. All card details are securely destroyed once the payment or donation has been processed. Only staff authorised and trained to process payments will able to see your card details. If you make a payment through our website, the payment will be processed through a secure third party such as Stripe or GoCardless and we will not have access to any of your card details. Your card will be processed in accordance with the policies of the processor providing that service that you will be notified of at the time of making payment and we would refer you to their terms and conditions for further information. How we use the personal data we collect Adoption UK uses your personal data in different ways, depending on the nature of our relationship with you. If you make a donation, complete an online survey, register to hold an event, sign up for an event or do some fundraising or support us with our public affairs and campaigning work we need to collect this data for numerous reasons, in order to: provide you with the services, products or information you asked for. administer your donation or support your fundraising. process gift aid. keep a record of your relationship with us. Share your comments and/or story. Make sure we know how you prefer to be contacted. Understand how we can improve our services, products or information. In sharing your story, your image or voice recording, we reserve the right publish the content in any appropriate manner, including but not limited to the following: Digital communications. Publications on websites, digital screens, and other online platforms (including social media platforms Facebook, Twitter, and Instagram; iTunes U, YouTube). These generally include photographs, edited articles, interview transcripts, podcasts, webinars, videos, film and broadcast media. Print publications. Publications such as magazines, reports, postcards, envelopes, leaflets, prospectuses, and outdoor promotional material (including lamp-post banners and posters). These generally include photographs and edited articles, and promotion of digital materials. Other types of communication. Publications on news platforms, such as newspapers, magazines, television and radio shows, and/or any other media or distribution channel now known or to be invented. we may wish to do this in the following ways: We may also use your data for the following: Direct Marketing We will use the details you provide to us to communicate with you about the work we are doing with children and families across the UK, how your support is helping and other ways you can help in the future, such as through volunteering, events or fundraising. We may also send you appeals asking for a donation to support our work. We will never send you electronic marketing communications, such as fundraising emails, or contact you by telephone unless we have your express consent that you wish to hear from us in this way. If you do subscribe to Adoption UK emails or our e-newsletters, we will understand that you are granting us the right to use that email address for email marketing. If you don’t currently hear from us by email or receive our e-newsletter and would like to do so, or if you would like to update your preferences, please contact us using the details in the “Contact us” section below. You can also unsubscribe from Adoption UK emails by clicking the ‘unsubscribe’ link at the bottom of any of our emails. We may contact you by post if we believe we have a legitimate interest in doing so and that contacting you in this way will not have unduly adverse consequences for you. This might be if, for example, you have a history of making donations and have not indicated that you no longer wish to receive these appeals by post. If you hear from us via the post and no longer wish to do so, please contact us using the details in the Contact us section below. We are committed to communicating with you in the way you wish us to and we will always respect your privacy. You can change your mind at any time and it is quick and easy to let us know that you no longer want to hear from us by using the contact details in the Contact us section below or by posting us an updated consent form that you may receive in the post. You can be assured that our staff will deal with any request quickly, sensitively, courteously and professionally. Personalisation and Profiling To help us to make sure you’re happy to hear from us and happy with what we send you, we may use the personal information that we have gathered in the course of our relationship to tailor our future communications. This includes helping us to understand the likelihood of you responding to a campaign communication, research communication or fundraising communication from us, potentially donating and in some instances donating or supporting us at a higher level. The greater understanding of you we can obtain from this information, the more personalised and relevant we aim for our communications to be. We also carry out targeted communication and marketing activity to ensure that we are contacting you with the most appropriate communication, which is relevant and timely and will ultimately provide an improved experience for you. For example, by providing timely news about our work, letting you know the different ways you can get involved or support us and how you can help raise funds. You can opt out of your personal data being used for profiling. However, this may mean that you stop receiving marketing communications from us or they become more generic and less relevant to you as they are no longer based on your interests in our cause. If you do wish to opt-out please contact us using the details in the “Contact us” section below. Sharing your Story To show our funders, partners and supporters the great work that Adoption UK does, we may share anonymised information about the ways in which a successful fundraiser has been able to help Adoption UK support young people and their families and the work we have been doing; or anonymised information about ways in which a family has been supported by Adoption UK. In some cases, with consent, we would like to use images and sound recordings (including photographs and videos) to accompany a during fundraising, campaigning or marketing. We will not share any information which makes you identifiable unless you have given us express consent to do so, or, if someone is under 18, without the consent of their parent or guardian. When does Adoption UK share your personal information with another party? We will never share your information with a third party who intends to use it for their own marketing purposes and there are very limited instances where we will share your personal data with a third party. This could include: If a third party provides a service to us, such as running an event on our behalf, conducting surveys or market research on behalf of Adoption UK or providing an element of a contract for us, such as email distribution, or fulfilling a Christmas card order. This would include our trusted partners that work with us in connection with our charitable purposes, entities that act as fundraisers for Adoption UK, sell Adoption UK’s products or provide Adoption UK information and marketing for us. To assist with the administration of fundraising. For example, if you have indicated that your employer may be willing to match fund any donations you make to Adoption UK, we may need to contact your employer. For the administration of events. For example, an event venue may require the provision of the names of attendees in advance, for security purposes. Where there is a legal or regulatory requirement to disclose your personal information such as from HMRC or the courts, we have a genuine and real concern regarding a person’s well-being, or where disclosure is necessary for taxation and criminal investigation purposes. additional third parties operating on matters unrelated to Adoption UK, but only where we have your written consent. In order to prevent fraud and crime, we may perform due diligence checks to ensure we are not being abused, such as by fraudsters or criminals posing as genuine donors for example money laundering proceeds of crime and tax avoidance. We do these checks to help protect Adoption UK from abuse. How do we keep your personal information safe? Adoption UK has a number of steps in place to keep your personal information as safe as possible. We train all of our staff in data protection and data security to increase awareness of its importance. We keep our data protection and data security policies and practices under constant review and review the personal data that we hold, where we hold it and what we do with it. Adoption UK requires the third parties it works with to comply with data protection laws and puts controls in place to ensure that your information is handled safely and appropriately. Wherever possible, we ensure that your personal data is kept in the UK. We minimise use of servers outside of the EEA and in some limited instances if we need to transfer your personal information to a third party for processing in countries that aren’t listed as ‘adequate’ by the European Commission we’ll only do so where we have appropriate contracts or other appropriate safeguards in place. By communicating electronically with us you acknowledge and agree that your data may be processed in this way. How long does Adoption UK keep personal information? We will only keep information about you for the length of time it is necessary to do so to engage with you in the way that you have requested and in accordance with our legal requirements, the requirements of adoption support regulations and tax and accounting rules. Where the information we hold about you includes images or recordings of your voice we will contact you every five years to reconfirm your consent for us to use these. In some instances even if we cease using your personal information (processing) for the purposes you agreed, we are required to retain the information in archive for legal or regulatory purposes. When your personal data is no longer needed, we will ensure that it is disposed of in a secure manner. If you would like us to delete any information we hold about you, please contact us using the details in the “Contact us” section below. How do we protect vulnerable supporters? Adoption UK takes into account the needs of any potential donor who may be in a vulnerable circumstance or require extra care and support to make an informed decision. If in any doubt, if any member of Adoption UK staff knows or has reasonable grounds for believing that an individual lacks capacity to make a decision to donate, a donation will not be taken. Children and Young Person’s information Adoption UK is committed to protecting the privacy of the children and young people you provide us with information about, whether this be through our website or at fundraising events. Adoption UK requires the consent of a parent or guardian before anyone under 16 years of age participates in an event organised by us. Children aged under 13 must obtain the consent of a parent or guardian before providing any personal information. Other websites linked from Adoption UK website Adoption UK does not have any control over how any third-party websites handle and use your data. Therefore, if you follow any links to third party sites from Adoption UK websites, you must check the Privacy Policy for that organisation in order to understand how your data could be used. This policy does not cover third party websites. Use of Cookies Cookies are small text files which are used by websites to learn about your visit to the site and in some cases to tailor your experience on the website. We use cookies to improve your experience of using the Adoption UK website. Find out more about cookies on www.allaboutcookies.org. You can turn cookies off on your computer – please check your computer settings for further information. Turning cookies off could restrict your use of our website. Some of these cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. The data collected is not shared with any 3rd party. The information we get through the use of these cookies is anonymous and we make no attempt to identify you or influence your experience of the site while you are visiting it. If you do not allow these cookies we will not be able to include your anonymous visit in our statistics. We use cookies on our site that provide functionality, improve performance, help with behavioural advertising and embedded content. We will use a cookie that stores your font size preferences, which allows us to make the size standard throughout the site and we will use a cookie to remember you acceptance of the cookie banner statement. Contact with Corporate Subscribers under PECR ‘Corporate Subscribers’ are people who Adoption UK might contact in a professional context, using their work contact details, including phone, email and post. These contact details may be obtained from public domain sources (company websites etc.), from our own business records or from other companies and business contacts. Adoption UK may contact Corporate Subscribers under the legal basis of Legitimate Interests and as permitted under the PECR (2003) legislation. We may contact corporate subscribers by email or telephone provided that the subscriber has not previously opted out and is not registered with the Telephone Preference Service (TPS) or its corporate equivalent (CTPS). Direct Mail is not covered by PECR. We may contact subscribers by mail if they have not previously opted out of receiving such communications. You have a right to object to the processing of your data for direct marketing.We will provide opt-out notices on our communications to you, or you can advise our team at [email protected]. Adoption UK understands that PECR (2003) legislation will be replaced by the EU e-Privacy Regulation (ePR) in due course and reserves the right to review this privacy notice accordingly. Your rights in relation to the personal information we hold about you The right to see what personal information we hold about you. If you would like to know if we are processing any of your personal information or to see the personal information that we hold about you, you can make a request by sending a description of the personal information you wish to see to our Data Protection Officer at [email protected] or by writing to the Data Protection Officer at Adoption UK, Vantage Business Park, Bloxham Road, Banbury, Oxfordshire, OX16 9UX. It will normally take us one month to get back to you but could take longer (a further two months) if it’s a complex request or we get a lot of requests at once. In order to confirm identity, we before sharing information we may ask to see two forms of identification, including photographic ID. And to make sure that we only send information to the right person, we may not be able to provide this information via email. The right to amend, delete, limit and object You may have the right to request any of the following in relation to the personal information we hold: To request that we amend personal information that we hold incorrectly. deletion of the personal information we hold. We will consider any request on a case by case basis. for restrictions to be imposed upon how we process your personal information. You may also have the right to object to the way in which we process your personal information. If you wish to exercise any of these rights or have any questions in relation to any of the above, please contact us using the details in the “Contact us” section below. Please note that it may take 28 days for your request to be implemented from the date of the request. Further information in relation to how you can access and change the information any organisation holds about you, see guidance provided by the Information Commissioner here If you would like to complain to Adoption UK about our handling of your personal data, please contact please contact our Data Protection Officer at [email protected] or by post at Adoption UK, Bloxham Mill, Barford Road, Bloxham, Banbury, OX15 4FF. If you wish to lodge a complaint or seek advice from a supervisory authority please contact: The Office of the Information CommissionerWycliffe HouseWater LaneWilmslowCheshire SK9 5AF Tel: +44 (0) 01625 545 745 Website: www.ico.org.uk Changes to this policy To make sure that this policy and our practices stay legally compliant and up-to-date, we may make changes from time to time. If we make any substantial changes, we will make this clear on our website, or by contacting you directly, if appropriate. To be sure that you don’t miss anything, please check back to this page from time to time. Contact Us I would like to speak to someone at Adoption UK about how you collect, use and store my personal data. If you have any questions, comments, requests or suggestions, please contact our Data Protection Officer at [email protected] by post at: Adoption UKBloxham MillBarford RoadBloxhamBanburyOX15 4FF If you would like to change your contact preferences, please get in touch with us at [email protected] or call our helpline on 0300 666 0006.
5. Employee, Volunteer and Contractor Privacy Notice Expand This privacy notice covers the use of your personal data if you are an employee, volunteer or contractor (where, as a contractor, you are fulfilling roles similar to those conducted by employees) of Adoption UK and our related services. As an employer, Adoption UK needs to process information about its employees and volunteers for normal employment purposes such as management and administration.We take the privacy and security of your information extremely seriously and will only use it in a lawful, fair and transparent manner in order to manage our relationship with you and to ensure the effective running of the organisation. Information may be collected and used at many stages of your employment with Adoption UK: During the recruitment and selection process. To carry out pre-employment checks. When you join Adoption UK. During your working life at Adoption UK. At the time when your employment ends. After you have left Adoption UK’s employment. We use personal information: In order to fullfil our obligations to you under your contract of employment. To comply with legal requirements, such as the health and safety at work legislation. In order to pursue our legitimate business interests. To perform our rights and obligations in connection with your employment. To contact your emergency contact, where necessary and appropriate. If information is not provided by you we may, in some cases, not be able to comply with our obligations. In such circumstances, we will advise you of the implications of your decision. Adoption UK may wish to publish information about you for other purposes, such as during fundraising, marketing or public affairs activity; in these cases where this is not already covered within your obligations under your contract of employment, we will only do so with your consent. What information does Adoption UK process? As employees, volunteers or contractors working with Adoption UK the personal information we gather, hold and process about you will include but is not limited to: Name Address Personal Email address Personal telephone number Date of Birth National Insurance Number Identification document copies Bank or Building Society Details Next of Kin name and contact details Qualifications Medical history and sickness absence history Employment history and details of previous employers Personal and professional references Performance and disciplinary records Criminal records history Race, religion, gender and sexual identity Data Security Adoption UK takes appropriate precautions to protect the security and integrity of the personal data we hold. Technical and organisational measures have been put in place to protect the information systems on which your data is stored and we require our suppliers and service providers to protect your personal information by contractual means Sharing information with third parties We will only disclose information about you to third parties if: We are legally obliged to do so. For example, tax information may be transferred to HMRC, or where there is a court order requiring us to share the information. We need to do so in order to fulfil our contractual obligations to you.For example we may disclose your information to a payroll company in order to process your salary and other benefits. We may transfer data about you to other companies for purposes connected with your employment or the management of Adoption UK’s business. If you are seconded to an external organisation for any period of time, Adoption UK will share data with the host employer as necessary in order to administer and manage the secondment. The information Adoption UK may share may include your contact details and emergency contact details, details regarding your contract of employment and job description and annual leave records for the relevant period of time. Adoption UK may also be required to share any health and or other special category data needed to address and manage any grievance or performance matters with the host in connection with our duties and obligations as your employer. The host will provide you with a copy of their privacy notice explaining how your data may be used by them. When Adoption UK is involved in a merger or a contract or service are transferred to or out of Adoption UK, it may be necessary to transfer personal data relating to employees involved under TUPE regulations. If in future we intend to process your personal data for a purpose other than that which it was collected, we will provide you with information on that purpose and any other relevant information. Transfer of Data to other countries In limited and necessary circumstances, your personal information may be transferred outside of the European Economic Area (EEA). Where such transfers occur, we will assure that adequate protection exists either through appropriate contractual arrangements or as required by law. How long do we keep your data? Your personal information will be kept on file only for as long as it is required, or we are obliged to retain the information by law. In most circumstances, employee data will be retained for six years after your contract with Adoption UK has ended, but this may be longer if required under the terms of regulations relating to our regulated activities as an adoption support agency. In the case of tax data we are required to retain this information for seven years from the end of the tax year in which you were last paid. Your rights If you have provided consent for the process of your data you have the right (in certain circumstances) to withdraw that consent at any time. To do so, you should contact your line manager in the first instance or the Data Protection Officer whose details are recorded below. Withdrawing consent will not affect the lawfulness of the processing before your consent was withdrawn. Under the General Data Protection Regulation (GDPR) you have a number of rights with relation to your personal data. Access You have the right to request access to the personal information held about you.To request access, you should send a Subject Access Request (stating what information you would like access to) in writing to the Data Protection Officer whose details are below. Rectification It is important that the information we hold about you is accurate and up to date.If you believe that your information is inaccurate you should notify your line manager in the first instance. Erasure In certain circumstances, you have the right to request that we erase information about you from our files and systems. This will only be possible if there is no other legal basis under which we are obliged to keep the information. Restrict Processing You may have the right to request that Adoption UK restrict the processing of your data if you believe the data to be inaccurate, no longer required or processed unlawfully. Complaints You have the right to complain to the data protection authorities if you believe that your data is being processed improperly or illegally. Contact with Corporate Subscribers under PECR ‘Corporate Subscribers’ are people who Adoption UK might contact in a professional context, using their work contact details, including phone, email and post. These contact details may be obtained from public domain sources (company websites etc.), from our own business records or from other companies and business contacts. Adoption UK may contact Corporate Subscribers under the legal basis of Legitimate Interests and as permitted under the PECR (2003) legislation. We may contact corporate subscribers by email or telephone provided that the subscriber has not previously opted out and is not registered with the Telephone Preference Service (TPS) or its corporate equivalent (CTPS). Direct Mail is not covered by PECR. We may contact subscribers by mail if they have not previously opted out of receiving such communications. You have a right to object to the processing of your data for direct marketing.We will provide opt-out notices on our communications to you, or you can advise our team at [email protected]. Adoption UK understands that PECR (2003) legislation will be replaced by the EU e-Privacy Regulation (ePR) in due course and reserves the right to review this privacy notice accordingly. Changes to this policy Adoption UK reserves the right to make changes to this policy from time to time.Where changes are made, the details will be posted on the Adoption UK HR system within the documents section and the Adoption UK website. If you have any questions in relation to any of the above, please contact our Data Protection Officer by email at i[email protected] or contact your manager.