Privacy policy
Introduction
Welcome to the Thrive at Five’s privacy policy (collectively referred to as “we”, “us”, “our”).
We respect your privacy and are committed to protecting your personal data. This privacy policy tells you about how we treat your personal data. It is important that you read this policy together with any other privacy policy or fair processing notice we may provide to you on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your personal data.
Our website is not intended for anyone under thirteen (13) years of age.
Who we are
Thrive at Five is a charity registered in England and Wales (charity number 1195059) and in Scotland (charity number SC054336). For data protection purposes, Thrive at Five is the controller of the personal information described in this notice. This means that we decide why and how that information is used.
Our contact details are:
- [email protected]
- Thrive at Five, 73 Cornhill, London, EC3V 3QQ
Questions about this notice, our use of personal information or your rights can be sent to the contact details above.
Who this notice is for
This notice applies when we use personal information about people outside our workforce, including:
- children, parents, carers and other family members involved in or affected by our work;
- people who take part in community activities, events, programmes, consultations, research or evaluation;
- people who appear in photographs, films, audio recordings, stories, case studies or other content;
- donors, supporters, funders;
- contacts at partner organisations;
- people who visit our website, contact us, make an enquiry, give feedback or raise a concern or complaint; and
- other people whose information is provided to us in connection with our work.
What information we may use
The information we use depends on how you interact with us. For example, it may include:
- your basic identifiers, such as your name, age and date of birth
- your contact details, such as your address, email, and contact number;
- information about a child, parent, carer or family circumstances;
- information about attendance, participation, support, outcomes and experiences;
- photographs, video, audio, case studies;
- donation, grant, funding, payment and transaction information;
- correspondence, enquiries, complaints and records of our contact with you;
- website and device information, such as an IP address, browser information and how our website is used; and
- any other information you choose to give us or that is reasonably needed for the activity concerned.
Information requiring extra protection
Some information is more sensitive and receives additional protection under data protection law.
Depending on the work involved, we may use information about health, disability, or other matters revealing a person’s circumstances or support needs. We may also occasionally receive information about criminal allegations, offences or safeguarding concerns.
We will only use such information where it is genuinely needed and where the law allows us to do so.
How we collect information
We may collect information:
- directly from you, including through forms, conversations, emails, surveys, events;
- from a parent, carer or another family member;
- from partner organisations, local services, practitioners, referrers, funders, researchers, evaluators or suppliers;
- when photographs, films, audio recordings or other content are created;
- from publicly available sources, including websites and social media; and
- automatically when you use our website, through cookies and similar technologies as explained in our cookies notice.
Why we use personal information
We use personal information only where we have a lawful reason. The main purposes and legal bases are set out below.
|
What |
Why |
Our legal basis |
|
Delivering our charitable work |
To plan, deliver, improve and evaluate programmes, activities and support for children, families and communities; manage participation; communicate with those involved; and work with local partners. |
Our legitimate interests in delivering and improving our charitable purposes; carrying out an agreement with you where relevant; and, where applicable, our public-interest or not-for-profit conditions for sensitive information. |
|
Understanding impact, research and evaluation |
To understand needs, experiences and outcomes; carry out research, evaluation, consultation and learning; report to funders and partners; and improve our approach. We use anonymous or aggregated information where this can meet the purpose. |
Our legitimate interests in understanding and demonstrating our impact and improving our work; consent where required for a particular project; and appropriate public-interest, research or not-for-profit conditions for sensitive information. |
|
Safeguarding and wellbeing |
To identify, record and respond to safeguarding, welfare or serious safety concerns, and to share information with appropriate services where necessary. |
Compliance with legal obligations; tasks in the public interest where applicable; and the substantial public-interest relating to safeguarding and protecting people at risk. |
|
Photography, filming, stories and communications |
To record and communicate our work, celebrate achievements, report impact, support learning and raise awareness. We use safeguards appropriate to the context, particularly for children, and may ask for separate permission for identifiable, named or more personal material. |
Our legitimate interests in communicating and promoting our charitable work; consent where we specifically rely on it. |
|
Fundraising |
To receive and administer donations and grants, thank and communicate with supporters, keep appropriate records, and understand and develop relationships with funders and donors. |
Our legitimate interests in raising and administering funds, performance of an agreement, and compliance with legal obligations. |
|
Events |
To organise events and meetings, manage invitations and attendance, maintain relationships with stakeholders |
Our legitimate interests in running our activities and maintaining effective professional and community relationships; and performance of an agreement where relevant. |
| Governance and Operations | To manage finance, contracts, governance, IT, security, fraud prevention, audits, insurance and legal claims. | Performance of an agreement; compliance with legal obligations; and our legitimate interests. |
| Website operation and analytics | To provide and improve our website and understand how it is used. | Our legitimate interests. Where cookies or similar technologies require consent, we rely on the choices you make through our cookie controls. |
Marketing
We may send news, invitations and information about our work where you have asked to receive it or where the law otherwise allows us to do so. You can unsubscribe from electronic marketing at any time by using the link in the message or contacting us.
Cookies
Our website uses cookies and similar technologies. Some are necessary for the website to work. Others may help us understand use of the website or provide additional features and will be used only in line with the choices available through our cookie controls. Our cookies notice explains what cookies are used, their purposes, how long they last and how you can change your choices.
Who we share information with
Where necessary, we may share personal information with:
- organisations helping to deliver programmes, activities, services, research or evaluation;
- local authorities, health services, education providers, community organisations and other services;
- funders, donors and evaluation partners, using aggregated or anonymised information where possible;
- photographers, communications agencies, event providers and publication or media platforms;
- IT, website, communications, database, survey, storage, payment and other service providers;
- our professional advisers, auditors, insurers;
- regulators, courts, law enforcement bodies and public authorities; and
- another organisation if out structure or activities are transferred, combined or reorganised.
International transfers of information
Some of our suppliers or partners may store or access personal information outside the UK. Where this happens, we take steps required by data protection law to protect the information. These may include using a country recognised as providing adequate protection, approved contractual safeguards and, where required, an assessment of the protections available in the destination country.
How long we keep information
We keep personal information only for as long as it is reasonably needed for the purpose for which it was collected, and to meet any legal, safeguarding, accounting, reporting or insurance requirements. Retention periods differ depending on the type of information and the context.
When deciding how long to keep information, we consider its nature and sensitivity, the risks from continued retention, the purpose for which it is used, relevant limitation periods and whether the purpose can be achieved with less information or anonymised information.
You can contact us if you would like information about the period that applies to a particular record.
Your data protection rights
Depending on the circumstances, you may have the right to:
- ask for access to your personal information;
- ask us to correct information that is inaccurate or complete information that is incomplete;
- ask us to delete personal information;
- ask us to restrict how we use personal information;
- object to processing;
- withdraw consent at any time where we rely on consent, without affecting earlier use of the information; and
- complain to the ICO.
These rights are not absolute and may not apply in every situation. We may need to confirm your identity and ask for information needed to understand and respond to your request. We will explain our decision if we cannot do everything you have asked.
To exercise a right, please contact [email protected] or write to us at the address above.
Complaints
Please contact us first if you have a concern about how we use personal information. You can also complain to the ICO, the UK regulator for data protection.
Changes to this notice
We may update this notice to reflect changes in the law or the way we use personal information. Latest versions will be published on our website.