At KIDS, we take your privacy seriously and treat all the personal data you give us with great care.

Our Family Support Online Privacy Policy mirrors our organisational Policy and explains how we collect, store and use the personal data you give to us. We’ll keep this page updated so that you can be confident when sharing your data with us that it will only be used in accordance with this policy. If you have any questions concerning your personal data and how we look after it or you would like to update how you would prefer to hear from us then please email enquiries@kids.org.uk. This Privacy Policy applies to the www.familysupport.kids.org.uk website.

By giving us your personal information, you agree to the use of it as set out in this policy.

Who is the controller of your data?

KIDS is the controller of your personal data. If you have any questions about this privacy policy, please contact us here.

When and where do we collect your personal information?

We collect personal information about you when you access information about our services, purchase our services, ask about our activities, request information about a role with us, make a donation to us, register for an event, engage with our social media channels, order products and services, subscribe to receive our monthly e-newsletter, sign-up for project updates, provide feedback or otherwise give us personal information.

What personal data do we process?

We process personal data about you that you give to us when you make a donation, book services from our site, such as your name, addresses, email address, telephone number and payment card details. When you visit our website we also automatically receive your IP address which is a unique identifier for your computer or other device you are using to access our site

If you use your credit or debit card to pay for our services or to donate to us, we will ensure that this is done securely and in accordance with the Payment Card Industry Data Security Standard. You can find our more information about PCI DSS here https://www.pcisecuritystandards.org/security_standards/index.php.

We do not store your credit or debit card details at all, following the completion of your transaction. All card details and validation codes are securely destroyed once the payment or donation has been processed. Only staff authorised and trained to process payments will be able to see your card details.

We take your privacy seriously and treat all the personal data you give us with great care. We will not sell or swap your details with any other organisation, ever, and will keep your details private and secure. This Privacy Policy explains how we collect, store and use the personal data you give to us. We will inform you of any update to our Privacy Policy that will affect you.

Visitors to our website

When someone visits www.familysupport.kids.org.uk we collect standard internet log information and details of visitor behaviour patterns in order to provide the best experience we can for users and keep the site up to date and relevant. We will not associate any data gathered from this site with any personal data from any source.

Device information

We collect information from or about the computers, phones, or other devices where you access our websites. We may associate the information we collect from your different devices, which helps us provide a consistent user experience.

Why do we collect data?

Personal data collected and processed by us may be used for the following key purposes:

• to provide you with the services, support, products or information you have requested
• to process any payments or donations we may receive from you
• for administrative purposes (we may need to contact you about a donation you made or an event you have expressed interest in)
• administration/payment of our grants;
• responding to requests for support;
• to analyse and improve the services we offer
• communication about our membership, fundraising and other activities that we think may be of interest to you, including training events; and
• distribution of our e-newsletter
• for internal record keeping, such as the management of feedback or complaints
• where we are required or authorised by law

Personal data provided to us will be used for the purposes outlined at the time of collection or registration in accordance with the preferences you express.

We process your data for fundraising and marketing purposes to ensure that we are contacting you with the most appropriate communication, which is relevant and timely and will ultimately provide you with an improved experience. In doing so, we may use profiling techniques using publicly available data or information that you have already provided to us. This helps us to make appropriate requests to donors who may have the means and the desire to give more.  Importantly, it enables us to raise more funds in a cost-effective way.

You can opt out of your data being used in this way at any time by:

• contacting us via telephone on 0207 359 3635
• send us an email with your details
• write to us at: KIDS, 249 Birmingham Road, Wylde Green, Sutton Coldfield, West Midlands, B72 1EA

We follow an opt in approach for email communications and we use legitimate interest as the basis for some post and phone communications.

Social media advertising

We may occasionally share your name and email address with Meta so they can match it with any existing profiles. This allows us to show our content in your newsfeed, or in the feeds of people who share your interests. We also use this data to exclude specific supporters from Meta ads; for example, if you are already running a marathon for us, we don’t want to invite you to register again.

The Meta pixel is installed on our website, and data will only be sent to Meta via the pixel once a user has consented to cookies.

As a charity we aim to use cost-effective ways of finding those who are interested in our services or in supporting our cause. This means we can run efficient campaigns and raise funds which enable us to offer our services to as many people as possible.

Our Meta Business Manager is set up securely and monitored regularly to ensure we know and understand what data is being passed to Meta.

When we upload your data to Meta, it gets hashed into a randomised code which become unidentifiable at an individual level. Meta is under contract with us and will not use your information for any other purposes. For more details on how Meta processes personal data, please visit their privacy policy.

If you have any queries or complaints, please contact our Data Protection Officer at DPO@kids.org.uk. 

Where does your personal data come from?

Most of the data we process about you comes from you, for example, information you provide to us online. Some information comes from third parties such as our partners who recommend applicants to funders or share the details of applications.

Other information is gathered during your use of our website (e.g. IP addresses or information obtained via cookies).

Do you have to provide your personal data?

In most cases, providing your personal data to us is optional, however, in some circumstances if you do not provide it, we will probably not be able to fulfil your expectation or deliver all or deliver all of the services you might require, keep you up to date with news or events, subscription materials or e-newsletters, or our website may not work properly for you. For example:

• if you make a payment on our website, we need details such as your name and address and payment card details to be able to take your payment. If you do not provide your data we will not be able to process your payment;
• you can turn off cookies on your browser and we will not place any cookies on your device or computer. However, this is likely to mean that you may not be able to use all parts of our website.

What are the legal grounds for processing your personal data?

Data protection laws require us to tell you what legal basis we use for processing your personal data. These bases are set out in the applicable data protection law.  We generally use the following:

• the processing is necessary to perform a contract with you (i.e. the contract for the delivery of the service you have purchased), or to take steps requested by you before entering into this contract;
• the processing is in KIDS or someone else’s legitimate interests, and these interests are not overridden by your interests or rights in the protection of your personal data;
• the processing is necessary to meet a legal obligation which applies to KIDS;
• you have consented to our processing of your personal data. If you have consented, you can withdraw your consent at any time by contacting us here.

Who do we share your personal data with?

Personal data collected and processed by us may be shared in the following situations:

• with KIDS employees and volunteers;
• with contractors, agents and other third parties who provide services to us.

We use a number of suppliers to process website donations, manage direct debit payments and send our written appeals and e-newsletters. We carefully select our suppliers and ensure that theses suppliers abide by our data processing agreements.

Our data processors

• We use Office 365, provided by Microsoft to provide our email system and some document storage services.
• We use Amazon Web Services (AWS) to host our website. If you contact us via our website the information you supply via the forms on our website will be stored by AWS.
• We use Calendly to provide call scheduling services. If you choose to book a call with us using our callback service your details will be processed by Calendly.  
• We use Google Analytics to help us understand how people are using our website and how they find it. We use this information to help us make the website better. If you choose to accept Google’s cookies then some data about the pages you view on our website will be shared anonymously with Google.
• We use Facebook and other services from Meta like Instagram to help us advertise our Family Support Online service. If you choose to accept Facebook’s cookies then data about your use of our website will be shared with Facebook. Depending on your existing relationship with Facebook the data shared with Facebook may identify you.  For more information please see the section on Social Media Advertising above.
• We use Mailchimp to manage our email mailing list. If you choose to sign up to our newsletter or choose to accept communications from us then we will pass your email address and name to Mailchimp.
• TinCup Social are our marketing partner. If you choose to accept our use Facebook cookies then some of your information will be shared with them so they can help us to market the Family Support service.  

Data retention

We will hold your personal information on our systems for as long as is necessary for the relevant activity for which your data was originally obtained. For example we will keep a record of donations for at least seven years.

If you request that we stop sending you marketing materials we will keep a record of your contact details and appropriate information to enable us to comply with your request not to be contacted by us.

The nature of our work is such that we may have lifelong relationships with donors, beneficiaries and supporters. Legacy income is vital to the running of the charity. We may keep data you provide to us for a specified length of time, to carry out legacy administration and communicate effectively with the families of people leaving us legacies. This also enables us to identify and analyse the sources of legacy income we receive.

What are your rights?

You have several rights in relation to your personal data. These include accessing your data, correcting any mistakes, having your data erased, restricting the processing of your data, objecting to the processing of your data, data portability, and rights relating to automated decision making and profiling.  In most cases there are conditions attached to these rights.  Please see below for further information on each of these.

Accessing your data

You can ask us to:

• confirm whether we are processing your personal data;
• give you a copy of that data;
• provide you with other information about your personal data such as what data we have, what we use it for, who we disclose it to, whether we transfer it abroad and how we protect it, how long we keep it for, what rights you have, how you can make a complaint, where we got your data from and whether we carry out any automated decision making or profiling.  We aim to give you all this information in this privacy policy, although if anything is unclear, please contact us.

You do not have to pay a fee for a copy of your information unless your request is unfounded, respective or excessive, in which case we will charge a reasonable amount in the circumstances. We will let you know of any charges before completing your request.

We aim to respond to you within 1 month of receiving your request unless it is particularly complicated or you have made several requests, in which case we aim to respond within 3 months.  We will let you know if we are going to take longer than 1 month in dealing with your request.  If we have a lot of information about you we might ask you if you can tell us what exactly you want to receive.  This will help us action your request more quickly.

Correcting your data

You can ask us to correct any data which is inaccurate or incomplete. This is free of charge.

If we have shared the data with anyone else, we will tell them about the correction wherever possible.  We aim to deal with requests for correction within 1 month, although it might take us up to 3 months if your request is particularly complicated.

If we can’t action a request to correct your data, we will let you know and explain why this is.

Erasing your data

This right is sometimes referred to as “the right to be forgotten”. This is not an absolute right but you have the right to have your data erased, free of charge, in certain circumstances.

You can ask for your data to be erased where:

• it is no longer necessary for the purpose for which it was originally collected or processed;
• we are processing your data based on your consent, and you withdraw that consent;
• you object to the processing and we do not have an overriding legitimate interest for continuing;
• your data has been unlawfully processed;
• your data must be erased to comply with a legal obligation;

There are some exceptions to this right. If one of these applies, we do not have to delete the data.

If we have shared your data with third parties, we will tell them about the erasure of your data unless this is impossible or would involve disproportionate effort.

Restricting the processing of your data

You can ask us to restrict the processing of your personal data in some circumstances, free of charge. This is not an absolute right. If processing is restricted we can store the data and retain enough information to make sure the restriction is respected, but we cannot further process your data.

You can restrict the processing of your personal data in the following cases:

• if you contest the accuracy of your data, we will restrict processing until we have made sure the data is accurate;
• if you object to our processing and we are considering this objection;
• if the processing is unlawful but you do not want us to erase your data;
• if we no longer need the personal data but you require the data to establish, exercise or defend a legal claim.

If we have disclosed the data to a third party, we will inform them about the restriction unless it is impossible or would require a disproportionate effort.  We will tell you if we decide to lift a restriction on processing your data.

Objecting to the processing of your data

Objecting to the processing of your data is free of charge. It is not an absolute right but you can object to our processing of your data where it is:

• based on the legitimate interests ground; or
• for the purposes of scientific/historical research and statistics.

We will stop processing your personal data unless we have compelling legitimate grounds for the processing which override your interests and rights, or unless we are processing the data for the establishment, exercise or defence of legal claims.

You can require us to stop using your data for direct marketing purposes. We will stop as soon as we receive your request.  There are no exemptions or reasons for us to refuse.

Data Portability

This allows you to obtain and reuse your personal data for your own purposes across different services. It applies where the following conditions are met:

• you provided the personal data to us yourself;
• we are processing the data either based on your consent or because it is necessary for the performance of a contract; and
• the processing is carried out by automated means

We will provide your data free of charge in a structured, commonly used and machine readable form.  We aim to provide your data within 1 month of receiving your request unless it is particularly complicated or you have made several requests, in which case we aim to respond within 3 months. If we are going to take longer than 1 month we will let you know and explain why we need more time. If we consider that we cannot provide you with your data, we will contact you and explain why this is.

Automated decision making and profiling

You have the right not to be subject to a decision which is based on automated processing and which produces a legal (or similarly significant) effect on you.

We will tell you about any automated decision making that affects you. You have the right to:

• request human intervention;
• express your point of view;
• ask for the decision to be explained; and
• challenge the decision

These rights are not absolute. They do not apply if the decision is:

• necessary for us to enter into or perform a contract with you;
• authorised by law (e.g. for fraud prevention); or
• based on your explicit consent

If your personal details change, please help us to keep your information up to date by notifying us. You can also request access to any information we hold about you at any time by:

• emailing enquiries@kids.org.uk; or
• writing to the Fundraising Administrator, KIDS, 249 Birmingham Road, Wylde Green, Sutton Coldfield, West Midlands, B72 1EA