Organisations are permitted to process data if they have a lawful basis for doing so. Norwood processes information about the children and families that it supports, on the basis that:

We have a genuine and legitimate reason, the processing is in your legitimate interests, we will process your information in a way that you would reasonable expect and we will take extra responsibility for ensuring your rights and interests are protected.

This means that, when you provide your personal information to us, we have a compelling justification for the processing of your information and it is in our legitimate business interests to carry out our work providing children in need, young adults with learning disabilities and families with help for a range of personal, emotional and social issues. Before doing this, though, we have been careful to consider, and balance, any potential impact on you and your rights. We will also ensure that we do not do anything with your information that you would not reasonably expect.

Notwithstanding any change to this policy, we will continue to process your personal data in accordance with your rights and our obligations in law.

Norwood’s Children and Family Services uses the data it collects about you and/or your child/children to maintain accurate records of the service it provides. Such uses include:

• Assessing children and families prior to receiving support from Norwood’s Education, Social Work and Family Group services
• Delivering an Education, Social Work and Family Group service to children and families
• Maintaining records of support given to children and families by Norwood’s Education, Social Work and Family Group services
• Advocating on behalf of Children and Families to third parties such as CAMHS, Local Authorities, Schools.
• Such other purposes as are reasonably required by Norwood’s Children and Family Services

These records facilitate our activities run in accordance with our charitable objects. Norwood’s Children and Family Services work together to ensure the best possible level of support to you and/or your child/children.

In order to provide you and/or your child/children with support, we may share data to the extent necessary between our professionals in order to provide that support. Where this is the case we will always ensure that all of our staff work in accordance with this privacy policy. We may also need to talk to other agencies involved with your family, to both obtain and share information. These agencies include GPs, Child and Adolescent Mental Health Services (CAMHS), Schools, Local Authorities and any other relevant professionals. Where this is the case we will always ensure that you know we are doing it and that it is done lawfully.

Also, your personal information may be disclosed:

• as permitted or required by applicable law or regulatory requirements. In such a case, we will not disclose more personal information than is required under the circumstances
• to comply with valid legal processes such as a court order
• as part of Norwood’s regular reporting activities
• during emergency situations or where necessary to protect the safety of a person or group of persons
• where the personal information is publicly available
• with your consent where such consent is required by law

When you give us personal information, we take steps to ensure that there are appropriate technical measures in place to protect it. For example, access is restricted only to those who are entitled to see the data, our online forms are always encrypted and our network is protected and routinely monitored.

Sensitive personal data, such as health information, as well as credit or debit card details is given additional protection and, where necessary, encrypted.

Non-sensitive details (your email address etc.) are transmitted normally over the Internet, and this can never be guaranteed to be 100% secure. As a result, while we strive to protect your personal information, we cannot guarantee the security of any information you transmit to us, and you do so at your own risk. Once we receive your information, we make our best effort to ensure its security on our systems.

It is important that the information contained in our records is both accurate and current. If your personal information happens to change during the course of receiving support, please keep us informed of such changes.

Norwood endeavours to maintain physical, technical and procedural safeguards that are appropriate to the sensitivity of the personal information in question.

These safeguards are designed to protect your personal information from loss and unauthorised access, copying, use, modification or disclosure.

Except as otherwise permitted or required by applicable law or regulatory requirements, Norwood will retain your personal information only for as long as it believes is necessary to fulfil the purposes for which the personal information was collected (including, for the purpose of meeting any legal, accounting or other reporting requirements or obligations). Typically we retain children and family personal data for as long as we provide a service. Once you and your family no longer receive a service, your information is retained for a further period for audit and administrative purposes. After this time, all of the information we hold about you and/or your child will be securely destroyed.

You may request details of personal information which we hold about you or your child. Any such request must be submitted in writing (e-mail is fine) and be as specific as you can about the information you require. A small fee may be payable if an information request is particularly onerous. Once Norwood is satisfied that that you are entitled to this information, you should receive a response within 30 days. If we cannot provide you with access to you or your child’s personal information, we will try to inform you of the reasons why, subject to any legal or regulatory restrictions.

You, as the data subject (or as an adult with parental responsibility), may request deletion of you or your child’s information at any time in writing, subject to any overriding legal requirement for its retention.

You may choose to restrict or ‘block’ or repress the processing of you or your child’s personal information, subject to the circumstances and any other legal or statutory obligations Norwood may have.

We may use your personal information to send you information about Norwood and matters relating to Norwood’s activities which we think may be of interest to you. We will only share information with trusted third parties as stated above, or where necessary for us to communicate with you (such as mailing companies for postal communications or through email campaigns or newsletters) or as stated above, and only once we are satisfied that any such use of data will accord with our privacy policy. We will not sell or share your personal information with any other businesses or marketing companies without your explicit consent.

You can obtain further information about the General Data Protection Regulation (GDPR) and privacy laws from the Information Commissioner’s Office (ICO), the UK’s independent authority set up to uphold information rights in the public interest. The ICO’s contact details are:

Information Commissioner’s Office
Wycliffe House
Water Lane, Wilmslow
Cheshire, SK9 5AF
Tel: 0303 123 1113 (local rate)
Tel: 01625 545 745 (national rate number)
Website: www.ico.org.uk

If you would like to access the information we hold about you, please:

• Send an e-mail, to: dataprotectionofficer@norwood.org.uk
• Write to: Data Protection Officer, Broadway House, 80-82 The Broadway, Stanmore, HA7 4HB.

Please note, we may ask you to complete a form in order to help us locate the information that you would like access to.

We use your information to:

• provide you with the services, products or information you asked for
• provide updates relevant to any Norwood giving club you may belong to
• process a donation that you have made (including processing Gift Aid) or to support your fundraising
• claim a Direct Debit that you have authorised
• keep a record of your relationship with us
• carry out our obligations arising from any contracts entered into by you and us, for example with regards to your participation in a challenge event
• seek your views or comments on the services we provide
• include you in communications by telephone, SMS, email or post (subject to your communication preferences) that may be of interest to you, including information about campaigns, appeals, other fundraising activities, promotions of our associated companies goods and services
• ensure we know how you would like to be contacted
• detect and reduce fraud and credit risk.

Building supporter profiles

We can serve the people we support best by building an effective partnership with our valued donors and supporters.

We may analyse your personal information to create a profile of your interests and preferences so that we can contact you with information that we think is relevant to you, and to help us better target our communications. We will always take your communication preferences into account, which you can update at any time.

We may build a profile about you in order to enhance our existing relationship; to prepare for welcoming you to one our fundraising events; to prepare for a meeting we expect to have with you; or if we are expecting to be introduced to you by a mutual contact.

To build a supporter profile we may use information that we already have about you on our database, such as age, giving history, geographic information and your business or personal connections. We may also make use of publicly available information from reputable sources to obtain further information, such as your job, directorships, philanthropic involvements, property, wealth and networks.