Privacy policy

Introduction

This Privacy Notice is for children benefiting from our services, past and present, their families, carers and friends, education and healthcare professionals, fundraisers, donors, supporters, customers, website visitors and any others* whose personal data is processed by The Elizabeth Foundation.

Personal data relates to a living person who can be identified directly or indirectly from the data, which can include electronic and paper records, and data in the form of photographs, video clips, sound recordings and CCTV footage. For the purposes of this notice, data processing includes the collection, recording, storage, alteration, retrieval, use, sharing or destruction of personal data.

The Elizabeth Foundation is committed to processing any information you provide using this website or through any other interaction with us in accordance with the Data Protection Act 2018 and UK GDPR.

*NB We have a separate privacy notice for staff, volunteers and job applicants.

Your rights

Under UK GDPR individuals have the following rights:

• of access (to see what is being held about them)
• to rectify (to be able to correct any incorrect information)
• of erasure (to have their details removed)
• to restrict processing (but not delete) i.e. individuals may choose what and how they would like information
• of portability (to have their data transferred to another organisation if they wish)
• to object to their data being held, and
• the right not to be profiled for wealth screening or any other enhancement of data already held

Why we process data

The Elizabeth Foundation only processes personal data where there is one or more appropriate legal basis for doing so. There are six legal bases for processing personal data:

• Legitimate interest: an example of this could be to keep interested parties informed of our activities or to let them know about opportunities to support us. When we collect data using the “soft opt-in” allowed by the Data (Use and Access) Act 2025 we will always offer the opportunity to opt out at the point of collection and we will never send data where you have not explicitly opted in or been given the opportunity to opt out.
• Consent: in the nursery and other areas of our activity we obtain the explicit consent of parents and others, as appropriate, before processing personal data, and consent may be withdrawn at any time.
• Legal requirement: for example, to comply with obligations to HMRC.
• Performance of a contract: for example, if you order an item from our website we collect and process your personal data so that we can send the item to the correct address.
• Vital interest: this could happen in the unlikely event we need to disclose personal data to facilitate emergency medical care.
• Public Task: where we work to help the NHS deliver their services we operate under Public Task.

What data we keep, why, and for how long

Children and families using our services

• Data collected: name, address, telephone, email, medical data, dietary requirements and allergies, emergency contacts, photo/video/audio.
• Collected from: enrolment forms, one-to-one support and counselling, teaching, meetings and assessments, surveys and sign-up forms.
• Why collected: to enable our education team to provide the best possible, most appropriate teaching and support; to manage health risks while in our care; to work constructively with other professionals supporting the child.
• Lawful basis: consent.
• How long: until the child reaches 25 years of age, in line with NHS Records Management Code of Practice.

Engagement and fundraising

• Data collected: name, address, email, telephone, family details, past gifts, donations and purchases, events attended.
• Collected from: on and offline donation and order forms, letters, emails, telephone calls.
• Why collected: to build and maintain relationships with individuals, increasing engagement and loyalty, helping to promote giving to support the charity’s operations. Also to answer questions, provide information, understand trends and address any complaints.
• Lawful basis: consent, legitimate interest
• How long: six years from last engagement, donation or purchase.

Donations or payments received and payments made

• Data collected: name, address, email, telephone, financial information (including bank or card details).
• Collected from: forms, contracts, invoices, telephone, email, post
• Why collected: to pay suppliers, process donations and receipts from ticket sales etc
• Lawful basis: consent, legal requirement, performance of a contract
• How long: six years (except card details which are not retained)

How we keep your data secure

• We employ a mix of traditional physical security measures and technical controls such as user access restrictions, passwords, anti-virus software and multi factor authentication to protect your personal details.
• We ensure our staff receive appropriate training
• We use the NHS Data Security and Protection Toolkit to check we are following good practice.
• We ensure that we are compliant with the Payment Card Industry Data Security Standard (PCI DSS) and our compliance partner performs penetration tests on our network.
• Where personal data is no longer required (either because deletion has been requested or the retention period has expired) we ensure that it is disposed of securely.

Sharing data with third parties

• To enable continuity of care for families we gain consent from parents/carers to share information with other professionals who make up part of the family’s support network.
• We often undertake activities that might involve video or photography, including The Elizabeth Foundation website, social media sites, promotional material, internal or external training, or promotional media. We only do this with the explicit written consent of the parent/carer.
• With the consent of parents/carers, we are obliged to share the details of Early Education Parental Funding Declaration Forms with the local authority as a condition of the scheme.
• To handle online payments for this website, we may need to share your information with our service providers, associated organisations and agents. This website currently uses Stripe (https://stripe.com) to ensure your financial information is processed efficiently, securely and cost-effectively.
• There are some cases where we are obligated to share personal data, for example under safeguarding law.
• It is possible that we may also be required to share data with law enforcement, regulators or our professional advisers. We will only do this when her have a clear legal basis for doing so.

Website users – Cookies

Cookies are small pieces of information a website sends to your computer to be stored on your hard drive so that the website can recognise you when you next visit. The law states that we can store cookies on your machine if they are essential to the operation of this site but that for all others we need your permission to do so. By using this website you agree to these cookies being installed on your device. Please note: If you do not have cookies enabled for this website you may not be able to access all this website’s features or functions.

See our Cookie Policy for further details (the contents of our Cookie Policy form part of our Terms and Conditions).

How you can access the information we hold about you

As an individual you have the right to request any information we hold about you after providing appropriate proof of identity. You must give written notification of the request (see contact details below), and provide proof of identity. We will then respond within one calendar month.

Complaints

As an individual you have a right to complain. The charity has a procedure explaining how individuals may raise concerns or complaints regarding the processing of their personal data and how such complaints will be handled. For further information please refer to the Data Protection Complaints Procedure.

If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the Information Commissioner’s Office: https://www.ico.org.uk/make-a-complaint.

Data Protection contact details

• Data Protection Officer – John Atherton, Director of Finance & Operations
• Organisation name: The Elizabeth Foundation
• Registered office: Southwick Hill Road, Cosham, Hampshire, United Kingdom, PO6 3LL
• Email: accounts@elizabeth-foundation.org
• Telephone: 023 9237 2735