Most of the information we hold and process will have been provided by you:

When you provide your personal information directly to us
If you sign up to one of our training events, request some information, purchase a product, or communicate directly with our teams for another reason, whether online, on paper, in person, or over the phone, you will be sharing your personal information with us.

When you provide your personal information through a third-party organisation
For example, when we are commissioned to deliver training and your name and details are sent as part of an attendance list.

Publicly available personal information
If your contact details are recorded online in a public website.

Family Action will only use your information in a fair and transparent manner and where we have a legal basis for doing so.

With your Consent
Where you have consented for us to do so, we will use your data to:

• Send you information about Family Action and our services that we think may be of interest to you.
This may be by mail, email, telephone or SMS, but we will offer you the chance to opt in or out of receiving these messages.
• Direct marketing (if you requested to be added to a list)
• Sending you relevant information e.g. about legislative changes, research etc.
• Preparing conference packs
• Arrange Training, workshop and conferences
• Prepare attendance certificates and analyse evaluations
In order to perform our obligations in a contract that we hold with you
We may use and process your personal data where it is necessary for the performance of a contract or agreement that we have with you (For example where you have signed up for a workshop or training course) to:
• Run our training, workshops and conferences
• Process payments
• Provide you with the services, products or information you asked for (including consultancy work);
• Keep a record of your relationship with us;
• Make sure we know how you prefer to be contacted;

For our own Legitimate Interests or those of our clients and customers
Family Action have legitimate interests in:
• Operating our business efficiently
• Marketing our services to potential customers
• Ensuring the safety and security of our staff and customers
• Informing our commissioners about the performance of our services

In pursuit of these interests we may:

• Ask you to give feedback on your use of our services
• Provide information about similar products and services that may be of interest
• Provide summarized information about our services to the organization that commissioned us
• To keep you informed about courses workshops and conferences that are relevant to you
• Recruit staff, associate trainers and volunteers

When Legally Obliged to Do So
Under certain, limited conditions we may be obliged by law to disclose data to the relevant authorities for example

• Keeping financial records
• Public interest concerns about a vulnerable child or vulnerable adult

We will never share your information with a third party who intends to use it for their own marketing purposes and there are very limited instances where we will share your personal data with a third party.

This could include:

• If a third party provides a service to us, such as running an event on our behalf or providing an element of a contract for us, such as email distribution;

• For the administration of events. For example, an event venue may require the provision of the names of attendees in advance, for security purposes;

• Where there is a legal or regulatory requirement to disclose your personal information such as from HMRC or the courts, we have a genuine and real concern regarding a person’s well-being, or where disclosure is necessary for taxation and criminal investigation purposes;

• In order to prevent fraud and crime, we may perform due diligence checks to ensure we are not being abused, such as by fraudsters or criminals posing as genuine donors for example money laundering proceeds of crime and tax avoidance. We do these checks to help protect Family Action from abuse.

Family Action has a number of steps in place to keep your personal information as safe as possible.

• We train all of our staff in data protection and data security to increase awareness of its importance.
• We keep our data protection and data security policies and practices under constant review and review the personal data that we hold, where we hold it and what we do with it.
• Family Action requires the third parties it works with to comply with data protection laws and puts controls in place to ensure that your information is handled safely and appropriately.
Where is my personal data stored?
Wherever possible, we ensure that your personal data is kept in the UK. We minimise use of servers outside of the EEA and in some limited instances if we need to transfer your personal information to a third party for processing in countries that aren’t listed as ‘adequate’ by the European Commission we’ll only do so where we have appropriate contracts or other appropriate safeguards in place.
By communicating electronically with us, you acknowledge and agree that your data may be processed in this way.

How long will you keep personal information about me?
We will only keep information about you for the length of time it is necessary to do so to engage with you in the way that you have requested and in accordance with our legal requirements and tax and accounting rules. When your personal data is no longer needed, we will ensure that it is disposed of in a secure manner. If you would like us to delete any information we hold about you, please contact us using the details in the “Contact us” section below.

The GDPR legislation provides you with a number of rights in relation to your personal data.

Right to Withdraw Consent
Where you have consented to our processing of your data, you have the right to withdraw that consent at any time. To do so, please contact dataprotection@family-action.org.uk or write to us using the details below.

Right to Access
You have a right to obtain copies of the information that we hold about you.
To request access to any data, please email dataprotection@family-action.org.uk or write to us at the address below explaining which data you require. In the interest of security, you will need to prove your identity before any information can be shared with you.

Under certain circumstances we may not be able to disclose all of the information you request, for example if it contains information about other people or there are legal reasons for us to withhold the data.

Right to Rectification
We would like to ensure that the data we hold about you is accurate and up-to-date. 
If you believe the data we hold is inaccurate, please tell us in the first instance. However, you may also ask us formally to correct your data by emailing dataprotection@family-action.org.uk or writing to us at the below.

Right to Erasure or the Restriction of Processing
In certain circumstances you can ask us to remove your data from our systems by emailing dataprotection@family-action.org.uk or writing to us at the below address. If there is a legal reason for us to continue holding the data we will let you know, otherwise we will make efforts to comply with your request.
You may ask us to restrict our processing of your data if:
• We are using the data for marketing
• You believe that our processing of the data is unlawful
• You object to us using your data (pending investigation)

In these circumstances, we may continue to store your information, but will otherwise only process it with your consent or where we have a legal reason to do so.

Right to Complain
If you are concerned about the way we have processed your personal information, you have the right to complain to the Information Commissioners Officer (ICO). To do so please refer to the ICO website.

‘Corporate Subscribers’ are people who Family Action might contact in a professional context, using their work contact details, including phone, email and post.

These contact details may be obtained from public domain sources (company websites etc.), from our own business records or from other companies and business contacts.

Family Action may contact Corporate Subscribers under the legal basis of Legitimate Interests and as permitted under the PECR (2003) legislation.

We may contact corporate subscribers by email or telephone provided that the subscriber has not previously opted out and is not registered with the Telephone Preference Service (TPS) or its corporate equivalent (CTPS).

Direct Mail is not covered by PECR. We may contact subscribers by mail if they have not previously opted out of receiving such communications.

You have a right to object to the processing of your data for direct marketing.
We will provide opt-out notices on our communications to you, or you can advise our team at DataProtection@family-action.org.uk.

Family Action understands that PECR (2003) legislation will be replaced by the EU e-Privacy Regulation (ePR) in due course and reserves the right to review this privacy notice accordingly.

Family Action does not have any control over how any third-party websites handle and use your data. Therefore, if you follow any links to third party sites from Family Action websites, you must check the Privacy Policy for that organisation in order to understand how your data could be used. This policy does not cover third party websites.

To make sure that this policy and our practices stay legally compliant and up-to-date, we may make changes from time to time. If we make any substantial changes, we will make this clear on our website, or by contacting you directly, if appropriate.

If you would like to speak to someone at Family Action about how you collect, use and store my personal data.
If you have any questions, comments, requests or suggestions, please contact the data protection officer at dataprotection@family-action.org.uk, by post at Family Action, 24 Angel Gate, London EC1V 2PT or on 020 7241 7608.
If you would like to change your contact preferences, please get in touch with us at:
TandC@family-action.org.uk or telephone 07469 660 479