Protecting you and the information we collect and store about you
We understand that sharing personal information requires trust. That’s why we work hard to keep information secure, use it fairly, and be transparent about how it is handled. This notice explains what information we collect and how we use it.
We process personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 .
UK GDPR principle (Article 5(1)(a) — lawfulness, fairness and transparency): “Personal data shall be processed lawfully, fairly and in a transparent manner.”
This means we will always explain what information we collect and how we use it.
UK GDPR principle (Article 5(1)(f) — security): “Personal data shall be processed in a manner that ensures appropriate security of the personal data.”
This means we take appropriate measures to protect personal information from loss, misuse, unauthorised access or disclosure.
Our clients (service users)
- Name and contact details
- Date of birth
- Ethnicity
- Emergency contacts
- Support and care requirements
- Health and eye condition information
- Other disabilities where apropriate
- Dietary information
- Meeting notes and support records
- Safeguarding information
Donors and Supporters
- Name and contact details
- Donation history
- Payment information
Employees and Volunteers
- Contact details
- Employment history
- Qualifications
- Right to work information
- DBS and safeguarding information
- Health information where required
Visitors
- Name
- Organisation
- Vehicle registration
- Purpose of visit
- Visiting person(s)
- Arrival and departure times
We use personal information to:
- Provide services and support
- Safeguard children and vulnerable people
- Manage donations and fundraising
- Recruit and manage employees and volunteers
- Meet legal and regulatory obligations
- Investigate complaints and concerns
- Maintain security of our building
- Improve our services and website
Under Article 6 UK GDPR, organisations must have a lawful basis for processing personal information. This means we cannot collect or use your personal data unless we have a valid reason to do so. For example, we may need your information to provide a service to you, to meet a legal requirement, because you have given us permission, or because it is in our legitimate interests to run and improve our services.
These reasons are known as lawful bases under UK GDPR. They are the legal grounds that allow us to use personal information, and we only rely on one where it is appropriate for the specific purpose. In practice, this might mean using your information because it is needed to deliver a service, because we are required to comply with the law, because you have agreed to it, or because it is necessary for us to run and improve our services in a fair and balanced way.
Where necessary, we may share information with trusted third parties who support our work or where we are legally required or permitted to do so. This includes:
- Local authorities
- Educational organisations
- Healthcare professionals
- Safeguarding organisations
- Professional advisers
- Regulators
- Approved service providers
We only share information where there is a lawful basis to do so under UK GDPR. This may include legal requirements, safeguarding duties, or where it is necessary to deliver our services or operate effectively. We do not rely on consent as the sole basis for sharing information where we are required or permitted to share it by law.
CCTV operates at our premises to help keep people safe, protect property and prevent or detect crime.
Clear CCTV signage is displayed around the building to make people aware that recording is in operation. We recognise that some individuals may not be able to see signage easily, including people with visual impairments, and we therefore ensure that this information is also available through other accessible means where appropriate.
Access to CCTV recordings is strictly limited to authorised personnel who require it for legitimate purposes such as security, safeguarding, or incident investigation.
CCTV systems may be maintained or supported by approved contractors. Any third parties involved in maintenance are required to comply with UK data protection legislation and only access footage where necessary to perform their duties.
When you visit our website we may collect technical information, including your IP address, browser type, operating system, pages visited and how long you spend on each page. We use cookies, which are small text files stored on your device, to help us understand how people use our website and to improve its performance and usability. More detailed information about the cookies we use, including how you can manage or disable them, is available in our Cookies Policy.
"Personal data shall be kept no longer than is necessary."
Article 5(1)(e) UK GDPR
We only retain personal information for as long as is necessary to fulfil the purpose for which it was collected, and to meet any legal, regulatory, or safeguarding requirements.
In some cases, we may retain information beyond our standard retention periods (up to the age of 30) where it is necessary to continue providing specialist services, or where there is a clear legal or operational need to do so.
You also have rights in relation to your personal information, including the right to request that we delete or amend the data we hold about you. This is known as the “right to be forgotten” (right to erasure) and the right to rectification. Where these rights apply, we will take steps to update or securely remove your information as appropriate, unless we are required or permitted to keep it for legal, regulatory, or safeguarding reasons.
You have the right to:
- Access your information
- Correct inaccurate information
- Request deletion in certain circumstances
- Restrict processing
- Object to processing
- Receive a copy of information you have provided
- Withdraw consent where consent is relied upon
"The controller shall provide information without undue delay and in any event within one month."
Article 12(3) UK GDPR
If you have concerns about how we use your information, please contact us first.
You also have the right to complain to the Information Commissioner's Office (ICO).
Telephone: 0303 123 1113
Website: https://ico.org.uk
We may update this Data Protection Notice from time to time to reflect changes in legislation, guidance or our services.
The latest version will always be available on our website.
Last reviewed: June 2026
