Special category information

When we use health, disability, SEND or other special category information, we also identify an additional legal condition. Depending on the circumstances, this may include explicit consent, protecting vital interests, safeguarding or another substantial-public-interest condition, or the establishment, exercise or defence of legal claims. We will not rely on consent where it would not be freely given or where another legal condition is more appropriate.

Our legitimate interests include operating and improving a safe and effective community-interest service, communicating with families and professional partners, protecting our participants, animals, staff and property, maintaining appropriate records and defending legal rights. We balance these interests against the rights and expectations of the people concerned.

​

6. Children and young people

We provide services to children and young people and therefore take particular care with their information. Information may be provided by, and communications may be conducted through, a parent, carer, guardian, school or referring professional. We explain information to the child or young person in an age-appropriate way where reasonably possible and take account of their views and developing capacity.

Parental or carer permission does not remove the child or young person's own data-protection rights. Where consent is the basis for processing, we consider who is able to provide valid consent in the circumstances.

​

7. If you do not provide information

Some information is needed to assess suitability, keep participants safe, administer bookings or meet legal and insurance obligations. If required information is not provided, we may be unable to offer or continue a service. Optional information, including promotional photography consent, is not a condition of receiving our core services.

​

8. Sharing information

We do not sell personal information. We disclose it only where this is necessary, proportionate and lawful. Recipients may include:

• parents, carers, guardians and emergency contacts, where appropriate;

• schools, local authorities, grant-making bodies, funders, commissioners, healthcare or support professionals and referring organisations involved in the participant's support or the funding, monitoring or evaluation of our work;

• safeguarding partners, emergency services, regulators, courts or other public authorities where required or permitted by law;

• our insurers, professional advisers, accountants and legal advisers;

• carefully selected providers of website hosting, booking systems, communications, email, cloud storage, document management, design, social media, IT support and payment processing; and

• contractors or authorised personnel who need the information to perform their duties and are subject to confidentiality and data-protection requirements.

We may share information without consent where this is required or permitted for safeguarding, emergency response, prevention or detection of crime, regulatory compliance, legal proceedings or another lawful purpose. Where consent is appropriate, we will seek it before sharing. For grant and impact reporting, we use anonymous statistics and anonymised case studies wherever reasonably possible and share identifiable participant information only where necessary and lawful.

Our principal technology and service providers may include Wix (website, forms and bookings), Google (email, Drive, Forms and Calendar), GoCardless (payment processing), Calendly while it remains in use, Meta services including Facebook, Instagram and Messenger, WhatsApp, and Canva where it is used to prepare identifiable content. These organisations may act as our processors or as independent controllers for particular activities. Their own privacy information may also apply.

​

9. International transfers

Some technology providers may store or process information outside the United Kingdom. Where this happens, we require an appropriate legal safeguard, such as UK adequacy regulations, the UK International Data Transfer Agreement or UK Addendum to approved standard contractual clauses, together with any additional measures required. Further information about relevant safeguards is available on request.

​

10. Keeping information secure

We use proportionate organisational and technical measures designed to protect personal information against accidental loss, unauthorised access, alteration or disclosure. These include:

• locked storage for paper records;

• password-protected devices and accounts, with additional authentication where available;

• access restricted to people who need the information for their role;

• secure disposal and deletion processes;

• confidentiality, safeguarding and data-protection procedures; and

• assessment and management of suspected personal-data breaches.

No method of transmission or storage is completely secure. If a breach is likely to create a risk to people's rights and freedoms, we will take appropriate action and notify the Information Commissioner's Office and affected individuals where the law requires.

​

11. How long we keep information

We keep information only for as long as reasonably necessary for the purpose for which it was collected, including safeguarding, insurance, tax, accounting and legal requirements. We consider the nature and sensitivity of the information, the risks of retaining it, applicable limitation periods and any instructions from relevant insurers or authorities.

Our usual retention approach is:

General enquiries that do not lead to a service: Normally up to 12 months after the last meaningful contact

Contracts, invoices and core financial records: Normally 7 years after the end of the relevant financial year or contractual relationship

Adult participant, assessment, attendance, progress, consent and incident records: Normally 7 years after the final service, unless a longer safeguarding, insurance or legal period applies

Ordinary child participant, assessment, attendance, progress and consent records: Normally 7 years after the final service or until the participant reaches age 21, whichever is later, unless a longer safeguarding, insurance, contractual or legal period applies

Child safeguarding and child-protection records: Normally retained until the child or young person reaches age 25, and longer where legal proceedings, a statutory inquiry, professional guidance or insurer requirements make this necessary

Concerns or allegations relating to workers or volunteers: Normally retained until the person reaches normal retirement age or for 10 years from the allegation, whichever is longer, subject to safeguarding, legal and insurer requirements

Complaints, claims, incidents and circumstances that may give rise to a claim: Normally 6 years after closure, but relevant documentation is retained for as long as proceedings or insurer requirements continue and is not destroyed while a claim or circumstance remains live

Photography, case-study and media permissions: For the period of permitted use, with a limited record of the permission and any withdrawal retained as necessary to demonstrate compliance

Website analytics and cookies: For the period stated in our Cookie Notice and the settings of the relevant service

These periods may be shortened or extended where justified. Information that is no longer required is securely deleted, anonymised or destroyed.

​

12. Photographs, video, testimonials and publicity

We separate participation in our services from permission for promotional photography, video, testimonials, case studies or publicity. Refusing promotional permission will not affect access to our core services or funding decisions. Permission choices may distinguish between internal use, grant applications, printed material, our website and named social-media channels. For children and young people, we seek permission from the appropriate parent or carer and, where appropriate, involve the child or young person and respect their wishes.

Where consent is used, it may be withdrawn at any time for future use by contacting us. We will stop new use and remove material under our control where reasonably possible. Withdrawal cannot always reverse publication already completed, remove printed materials already distributed, or control copies independently shared by other people or platforms. We avoid pairing a child's full name, precise location, support needs or other unnecessary identifying details with public images or stories. We may retain a limited record of the consent and its withdrawal to demonstrate compliance.

13. Website, cookies and analytics

Our website may use essential cookies or similar technologies needed for security and basic operation. Non-essential analytics, embedded-media, advertising or similar technologies will be used only where the required consent has been obtained. You should be able to accept or reject non-essential cookies and change your choices later through the website's cookie controls.

Our separate Cookie Notice explains the technologies used, their purposes, providers and retention periods. Information entered into website forms is used for the purpose stated on the form and handled in accordance with this notice.

​

14. Your data-protection rights

Depending on the circumstances and the lawful basis being used, you may have the right to:

• be informed about how your personal information is used;

• request access to your personal information and receive a copy;

• ask us to correct inaccurate or incomplete information;

• ask us to erase information where there is no lawful reason to keep it;

• ask us to restrict how information is used;

• object to processing based on legitimate interests and object at any time to direct marketing;

• receive certain information in a portable format or ask for it to be transferred;

• withdraw consent at any time where processing is based on consent, without affecting earlier lawful processing; and

• complain to the Information Commissioner's Office.

These rights are not absolute and exemptions may apply. We may need to verify identity and clarify a request. We normally respond within one month, although the law permits an extension for complex or numerous requests. We do not normally charge a fee.

To exercise a right, contact us using the details in section 1. If a request concerns a child or another person, we may need to consider authority, capacity and the best interests and rights of the person concerned.

​

15. Automated decision-making

We do not use personal information to make decisions based solely on automated processing that produce legal or similarly significant effects. Suitability, support and safeguarding decisions involve human judgement.

​

16. Marketing communications

Where required, we send electronic marketing only with consent. Every marketing communication will provide a way to unsubscribe, and you may withdraw consent at any time. We may retain a minimal suppression record so that we can respect an opt-out.

​

17. Complaints

Please contact us first if you have a concern so that we have an opportunity to resolve it. You are not required to contact us before complaining to the Information Commissioner's Office (ICO).

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Website: https://www.ico.org.uk

18. Changes to this notice

We may update this notice when our services, systems, providers or legal obligations change. The current version will be published on our website. Where a change materially affects how we use existing personal information, we will take reasonable steps to bring it to the attention of affected people.

​

Last updated: 25 August 2026

Next scheduled review: August 2027, or sooner if required

​

​