Privacy notice for children and young people
Who we are
We are Winston’s Wish, a charity providing support to bereaved children and young people. We’ve been doing this since 1992.
We do other things too, like training for teachers, writing and publishing books and talking about what it is like for children when a parent or brother or sister dies so that more people out there can help.
Get in touch
If you want to know more about the personal information we have of yours, or if you want to raise a question with us then do drop us a line. If you are under 13 your parent or carer would need to do this. If you are over 13 then you can write to our data protection officer, Laura. She’s contactable at lthreadingham@winstonswish.org.
We think it would be best if you discussed this with your parent or carer first, and that you copied them into any emails you send.
Personal data – what’s that?
What we mean is any information that could be used to identify you. At its simplest this could be just your name and address; or, it could include a telephone number, email address, a picture or recording of you. As we might be supporting you, there are things our practitioners would need to know to help them do that. This could be quite sensitive and personal information about what has happened and how you are doing.
Where we get your personal data from and what we do with it?
Basically, we get it from you! If you are under 13 then your parent or carer has to give it to us on your behalf. We don’t buy lists of names. If you are being supported by us then we might take information from, for example, your school which would help us to help you as best we can. We’d only take this if we had your (or your parent/carer’s) permission to do that.
So:
You might get in touch with us to help raise money for us to deliver our services.
You might need a little bit of help yourself and maybe someone has contacted us for you.
When you are in touch with us we will sometimes ask you for personal information. Personal information means things like your name, your age, where you live and how we can contact you.
But that’s only if you are over 13. The first thing we would want to know, and check, is how old you are.
If you are under 13 then we have to ask a parent or carer, or another adult who looks after you to give us that information for you. We tell them how we keep that information safe in our other ‘Privacy Notice’ – it is a bit longer than this one! They can ask to see any of that information, any time.
If you are 13-18 then you can give us permission (or, ‘consent’) to record some data about you depending on what we are doing and hold on to it for as long as we need to.
So, if you are raising money then you might want to get emails from us about fundraising events, or you might want to do something to raise money. We’d need to keep in touch with you about that.
If you are getting support then your practitioner will sit down with you and explain all of this and check that you agree, that you know what your rights are, and that you understand what we do with your personal information – it is yours after all!
It is really important to know that we are really careful with this information.
Everyone here is trained in safeguarding which means that we know how to keep you safe and that includes how we keep your information safe. We don’t share it unless you tell us we can (unless we are really worried about you), and we store it safely.
How long we keep your data for
We have thought a lot about how long we should hold on to personal data. We believe it is only as long as you would consider reasonable, or where we have to because of the law. We have a list of how long we keep all information and what we do with it (delete or archive) when its time is up! We keep it very safe on our systems, just like you would expect us too.
Your rights
You have all the same ‘rights’ with regard to your personal information as adults do – this is a very good thing. There are 12 rights and you can see them here: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/
If you want to know more, have a look at our general Privacy Notice.
This privacy notice was last updated by adults in September 2021 in line with the compliance deadline for GDPR. It will be reviewed by children and young people regularly.
Children and families
You might be receiving a service from us in which case we would collect your data as part of receiving that service. This might include quite sensitive information relating to the support we are providing to you. If you are under 13 we will need to get consent from the relevant adults to hold your personal information.
Sometimes another agency (like a school, GP or local authority) might have information that they want to pass onto us but we would only take that data with your consent.
In any case, before you started receiving support from us we would have explained all of this to you and asked you to give us your specific permission (your ‘consent’) to gather, hold and process this information for a defined period of time.
Sometimes we are approached by the media who want to speak to families who have experienced a bereavement. We never pass on any information about families to the media unless the family have given us specific consent to do so.
When you call our helpline, we collect some basic information about you and your situation to allow us to provide the support offered to you, with your consent. We follow the nationally recognised Helplines Standard and are a member of the Helplines Partnership.
If you asked to be referred on for further support, or if you requested a free resource to be sent to you at the end of a call or a series of calls then we would let you know at that point that we would need to gather some additional personal information from you with your consent.
We would only hold that data either for the purposes of providing you with an ongoing service, or to get a publication to you. Either way, this information is kept safe and deleted after an appropriate period of time, in line with our data retention policy. If you want to know how long that is then please ask us.
When you contact us through the ASK e-mail service, you are providing some personal information such as an e-mail address or names. We retain this information securely for as long as necessary in order that we can respond to your request appropriately.
Our online chat service is anonymous, but in receiving notifications using an email address or SMS you are providing some personal information. We retain this information securely for a short period before they are deleted.
However, if you asked to be referred on for a face-to-face service, or if you requested a free resource to be sent to you whilst using our online chat service then we would let you know at that point that we would need to gather some personal information from you with your consent.
We would only hold that data either for the purposes of providing you with an ongoing service, or to get a publication to you. Either way, this information is kept safe and deleted after a defined period of time. If you want to know how long that is then please ask us.
Supporters, donors, staff and volunteers
As a supporter or donor, you might give us personal information if you take part in a fundraising event, buy a book or a memory box, register for an activity, or donate an amount to us to support our work. This might include your name and address and bank details, for example.
You might want to work for us, or already be employed here in which case we would hold personal information that you had given us for the purposes of your employment which might include your employment history and bank details.
If you are successful and you come and work for us then we use the performance of a contract as the lawful basis for processing your personal data.
You might also have volunteered with us, and so we would hold some personal information that you had given to us for the purposes of making that happen. Again, this might include information you had given to us with your consent relating to your interests, experience and contact information.
What we do with your personal data
We use the data we gather from children, young people and families we are supporting for the sole purpose of providing the best care and support that we can to them. This might also include being able to evaluate the quality of support we have given and audit our practices. Where we believe sharing the information we have been given with other agencies is in the best interests of supporting the child or young person then we would do that with consent.
We have produced a separate privacy notice for children and young people.
We take our responsibility to safeguard the welfare of children, young people and vulnerable adults very seriously. We are legally obliged to pass on personal information to the relevant authority if we thought a child, young person or vulnerable adult was at risk. When you begin to receive a service this will all be covered in the process of giving your consent for us to hold and process your personal information.
We take protecting your personal information seriously. We will never sell or swap your details with another organisation. We use the information supporters and donors have given to us to process any donations or to keep in touch about our work. This includes newsletters, fundraising updates and opportunities to attend or take part in events. We aim to provide our supporters with a great experience and to communicate with every support in the best way.
At Winston’s Wish, our work is only made possible thanks to the generosity of our supporters – so it is important that our fundraising efforts are as effective as they can be. By developing a better understanding of our supporters’ interests, preferences and level of potential donations through researching them on publicly available sources we can tailor our fundraising communications to those most likely to be interested in them. We use websites such as corporate websites, public social media accounts, the Electoral Register and Companies House to get a fuller understanding of someone’s interests and capacity to support the charity.
We use the information that staff provide us to ensure that we can meet our legal obligations as an employer and for administrative purposes. For volunteers, we use personal data for administrative purposes. In both cases, we also use personal data to ensure we comply with safeguarding legislation and our obligations there. This includes ensuring our vetting and barring checks are done in accordance with DBS legislation and best practice.
In some instance,s we need to record personal data to meet our legal obligations (for example we need to record financial transactions to comply with UK tax laws).
How long we keep your data for
We would never seek to keep your data for longer than you would think reasonable. In our GDPR and Data Protection Policy we set out a retention schedule that indicates how long we hold personal information and when it is deleted or archived.
If you would like to know how long we keep data for then please do contact us using the contact information at the top of this privacy notice.
We are registered with the Fundraising Regulator, and we follow the Fundraising Regulator’s Code of Practice – https://www.fundraisingregulator.org.uk/code-of-fundraising-practice/code-of-fundraising-practice/
If you are receiving communications from us then we will periodically ask you if you would still like to receive information from us and you are welcome to opt out at any time in line with best practice in fundraising.
Who can see your information
We take data security very seriously. Our internal systems are robust and we have invested in ensuring our data systems meet industry standards. Access to information we hold internally is restricted according to the type of data we hold and where we hold it. All personal data is processed by staff in the UK and data we hold securely on third party servers is hosted and maintained within the European Union.
For the purposes of storing or processing some of the data you provide, or providing our services to you we might pass some of your personal information to service providers e.g. Cloud-based data storage providers; HMRC or external agencies (e.g. schools, local children’s services).
We may also share your data with law enforcement agencies or statutory agencies if required.
A word about ‘Cookies’
When anyone visits our website, their IP address, browser and version, operating system and the site they came from are stored in a log file. This information is only used for statistical purposes to help improve this site. Log files do not contain any personal information. We do not use cookies for collecting personal information and we will not collect any information about you except that required for administration of the web server.
GDPR – A Summary of Your Rights
The Information Commissioner’s Office (ICO) has produced a summary of your rights in relation to data protection and the General Data Protection Regulation (GDPR)
If you have a concern about how we have handled or processed your data, or are unsatisfied with our response to a complaint you have raised with us then please contact the ICO – https://ico.org.uk/concerns
This privacy notice was last updated in September 2021. It is reviewed regularly.