This Privacy Notice sets out information about how we process information about you in order to comply with the Data Protection Act 2018 and the UK General Data Protection Regulation. It tells you what to expect us to do with your personal information when you make contact with us or use one of our services.
This notice is layered. So, if you wish, you can easily select the reason we process your personal information and see what we do with it.
We’ll tell you:
- why we are able to process your information
- what purpose we are processing it for
- how long we store it for
- where we store data
- whether there are other recipients of your personal information
- whether we use any data processors
- whether we do automated decision-making or profiling
The first part of the notice is information we need to tell everybody.
Family Lives is the data controller for the personal information we process, unless otherwise stated.
Family Lives is a national charity. We hold and processes information about our service users for various purposes. For example, to ensure our services are responsive to needs and to report to our commissioners and funders, to enable correspondence and communications, and for safeguarding purposes.
About Family Lives:
15-17 The Broadway,
Hertfordshire, AL9 5HZ
Tel: 020 7553 3080.
Family Lives is registered with the Information Commissioner’s Office as a Data Controller under number Z489744X.
Family Lives is registered as a company limited by guarantee in England and Wales No. 3817762 and a registered charity No.1077722.
Data which has been collected prior to the introduction of GDPR (25 May 2018) will be processed in accordance with this updated Privacy Notice.
Visitors to our website
Legal basis for processing data: The legal basis we rely on to process your personal data is either Article 6(1)(a) of the GDPR, for example when we require your consent for the optional cookies we use, or article 6(1)(f) of the UK GDPR, which allows us to process personal data when its necessary for the purposes of our legitimate interests. The purpose for implementing all of the below on our websites is to maintain and monitor the performance of our websites and to constantly look to improve the site and the services we offer to our users.
Analytics: When you visit our websites we use a third-party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out such things as the number of visitors to the various parts of the site. This information is only processed in a way that does not identify anyone. We do not make, and do not allow Google to make, any attempt to find out the identities of those visiting our website.
If we do collect personal data through our website, we’ll be upfront about this. We’ll make it clear when we collect personal information and we’ll explain what we intend to do with it.
If you are aged 16 or under‚ please get your parent/guardian's permission beforehand whenever you provide us with personal information.
Your rights: As we are processing your personal data for our legitimate interests as stated above, you have the right to object to our processing of your personal data. There are legitimate reasons why we may refuse your objection, which depend on why we are processing it.
If you contact us through the website
Why we process your data: we will only process your data in order to respond to your query (if applicable).
Legal basis for processing data: we process your data under the basis of ‘legitimate interests’.
Using our online forums
Why we process you data: we process the personal data you provide in order to be able to offer a forum service where individual posts can be responded to and moderated when necessary.
Lawful basis for processing data: we gain your consent to process your personal data when you sign up to use the forums.
How long we will store your data: we will store your data for as long as you are using the forums, and for up to three years after your last post. Users inactive for more than three years will be deleted from the system.
Your full name and email is not displayed on the forum. When you post personal information on a discussion board on our forum your information is publicly accessible. Such information can be viewed online and collected by third parties. We are not responsible for the use of information by such third parties.
When contributing to a discussion we strongly recommend you avoid sharing any personal information that can be used to identify you (such as your name, age, address, name of employer). We are not responsible for the privacy of any identifiable information that you post in our forum or other public pages of our websites.
We use third party data processors to host our forums. They are based outside the UK but hosted on AWS and comply to GDPR.
E-newsletters and social media
Why we process your data: in order to provide you with our enewsletter updates we have to process personal data you provide to us when you sign up to receive them.
Legal basis for processing data: we ask for your consent to process your personal data when you sign up for our newsletters. You can withdraw your consent at any time, meaning you will no longer receive the newsletters, by following the ‘unsubscribe’ links included on every newsletter.
If you chose to unsubscribe from our newsletters, you details will be kept on a specific ‘do not send’ list to ensure we comply with your wishes.
For all newsletters we gather statistics around email opening and clicks using industry standard technologies to help us monitor and improve our newsletters.
We use third party data processors MailChimp to deliver our enewsletter. For more information, please see MailChimp’s privacy notice.
People who contact us via social media
Why we process your data: we process data provided by you in order to respond to any messages you send via social media. We use a third part data processor, Hootsuite, to manage our social media interactions.
Legal basis for processing data: we rely on legitimate interests to process your data regarding social media. We would not be able to respond to your messages without doing so.
If you send us a private or direct message via social media the message will be stored by Hootsuite. It will not be shared with any other organisations. Hootsuite is based in Canada, but for the purposes of EU data protection law, Canada is considered a country which provides adequate protections for Personal Information, as confirmed by the European Commission in Commission Decision 2002/2/EC.
People who contact our Family Lives support helpline, email or livechat service
Why we process your data: We process your data in order to provide you with our services. For some calls where you have agreed you wish us to refer you to another service, we will, with your consent, process personal information which is shared with the other service provider.
We also record some anonymous statistical information on each call where the caller agrees, to report on and improve our service. This includes information such as gender, age, income and how the call has helped you. This information never reports about specific people. We use anonymised statistical data about callers to our helpline and other services in our reports to the Data Controller and marketing material.
Email and livechat - we process the data provided when you contact us (eg name and email address) in order to respond to your request. Our workers can see your email address when you contact us.
Lawful basis for processing data: We rely on our legitimate interests to process your information, or on your consent, such as where you ask us to refer you to another service.
We’ll never pass on the information you provide during the call, email or chat to any other organisation, except in the following situations:
- We receive a call or correspondence about acts of terrorism or bomb warnings
- We receive a court order requiring us to share information
- We are working in partnership with another organisation and you have given consent for your information to be shared
- You threaten the safety of our call takers, email or livechat workers
- You are in a situation which has or could cause you harm, you have given us information that identifies you and you are unable to make decisions for yourself. This applies to all young people under 13, and in some circumstances to older children and adults. If we are worried about this situation, we will always talk to you about it first.
- You provide information that identifies someone who has caused harm or says they are going to cause harm to a child or vulnerable adult
How long we keep your data
Where we have your personal information, we will store this for a maximum of 18 months after which it will be deleted. We store emails and chat transcripts for up to 3 years after which they will be deleted.
Using our community services
This section explains what information Family Lives collects, keeps and stores about you and/or your family if you receive one of our services and your rights in relation to that information. You will also be given information by your service about the information they keep about you and what happens to it. Most of our services are provided on behalf of a local authority (the Data Controller).
Why we process your information: we hold personal information about you which may include your name, date of birth, address, gender, ethnicity, sexual identity and whether you have a disability, so that we can make sure our services meet your needs. We will also record information about the service provided to you, including case reporting, plans and reviews.
Legal basis: Our legal basis for processing personal data about you is for the legitimate interests of the Data Controller. We are providing this service under contract to the Data Controller and need to process your data in order to provide the relevant service to you.
To process any ‘special category data’ about you (such as your ethnicity or religion) we will always seek your explicit consent.
Where will you store my data? For most of our services your data will be stored in our internal system or online database accessed only by members of Family Lives staff and volunteers. Your information may also be stored in a paper file held securely by Family Lives. For some of our services, data is stored on the Data Controller’s databases. Data may also be stored on the Outcomes Star database or other systems which we use to track your progress, gather your data or evaluate your experience with our service. Only relevant staff and volunteers will have access to this data.
What personal data do we receive about you? For many of our services we receive referrals from other agencies. Please see information provided by your service for further information about the data we may receive about you and details of who we may share your personal data with.
What we do with your data? Family Lives will store and process your data for as long as you are accessing our services. Family Lives will keep some classes of information longer than others. These will include information held, for example, for reporting purposes in accordance with our contractual obligations and requirements of our funders and that retained in anonymous form, for statistical records, service development and research. Family Lives safely and securely disposes of personal data when it is no longer required. Family Lives will not rent or sell your personal information to other organisations.
When we may share or disclose your information: We may disclose your personal information to third parties if we are under a duty to disclose or share your personal data, or where there are safeguarding concerns regarding you or your child. In most circumstances, data provided to our contractors (the Data Controller) or funders is anonymised. There may be circumstances where the service contractor requests specific information about an individual. In these circumstances, we will ask for your permission to share specific personal information.
Using data processors: We may use data processors to collect, process and store your data when you are referred to the service and for monitoring and evaluation purposes. We have appropriate measures in place with these processors.
Applying for a paid or volunteer role
Why we process your information: As part of any recruitment process, Family Lives collects and processes personal data. Our purpose for processing this information is to assess your suitability for a role you have applied for. If you apply for a role with Family Lives we will only use the information you supply to us to process your application and to monitor recruitment statistics.
What information do we collect? We will collect a range of information about you, this may include:
- Your name, address and contact details, including email address and telephone number
- Details of your qualifications, skills, experience and employment history
- Information about your current salary
- Whether or not you have a disability for which we need to make reasonable adjustments during the recruitment process
- Information about your entitlement to work in the UK
- Equal opportunities monitoring information, including information about your ethnic origin, sexual orientation, health, and religion or belief.
For some roles Family Lives is obliged to seek information about criminal convictions and offences.This is necessary to carry out our obligations and exercise specific rights in relation to employment.
How do we collect your personal data? We collect it in a variety of ways. For example, you may have filled in an application form, or submitted a CV or resume, you may have provided your passport details or other identification documents, or we may have collected it through interviews or other forms of assessment, like online tests.
We may also collect information about you from third parties, such as references supplied by former employers. In all cases the application process will make clear at what point we will be contacting third parties.
Lawful basis for processing your data
For paid roles: we need to process your data in order to enter into a working agreement with you. In some cases we need to process your data to ensure we are complying with our legal obligations, eg checking an individual’s right to work in the UK.
The lawful basis we rely on for processing your personal data is article 6(1)(b) of the GDPR, which relates to processing necessary to perform a contract or to take steps at your request, before entering a contract.
To process any special category data, such as health or ethnicity information, we rely on article 9(2)(b) of the GDPR relating to our obligations under employment law and safeguarding your fundamental rights, and article 9(2)(h) for assessing your work capacity as an employee. Any data about criminal convictions is processed to comply with our legal obligations.
Under the Data Protection Act 2018, we process data under Schedule 1 part 1(1) and (2)(a) and (b) which relates to processing for employment, the assessment of your working capacity and preventative or occupational medicine.
For volunteers: To process your personal data we rely on our legitimate interests. To process any special category data about you we will seek your consent. Any data about criminal convictions is processed to comply with our legal obligations.
Family Lives will not use your personal information for any purpose other than the recruitment exercise for which you have applied.
How long will we keep your data? Personal information about unsuccessful candidates will be held for one year after the recruitment exercise has been completed, it will then be destroyed. Interview notes for all unsuccessful applicants are destroyed after one year. We retain de-personalised statistical information about applicants to help inform our recruitment activities, but no individuals are identifiable from that data.
If your application is successful, personal data gathered during the recruitment process will be transferred to your personnel file and will be retained in accordance with our retention policy.
Where will we keep your data?
Paid roles:Your personal information will be stored, securely, in several places: in our HR database and on other internal IT systems.
Volunteer roles: Your personal information will be stored securely in several places: our internal network and email system.
Who has access to your data? Your information will be shared internally for the purposes of the recruitment exercise. This includes members of the HR and recruitment team, interviewers involved in the recruitment process, managers in the business area with a vacancy and IT staff if access to the data is necessary for the performance of their roles.
As part of the recruitment process we may need to share your data with third parties in order to conduct any necessary background checks and vetting processes, such as contacting previous employers/referees to obtain a reference; and/or the Disclosure and Barring Service to conduct criminal record checks. As part of the recruitment process, we will make clear to you which checks will be required and at what stage of the process.
Compliments and complaints
When we receive a complaint from a person we make up a file containing the details of the complaint. This normally contains the identity of the complainant and any other individuals involved in the complaint.
We will only use the personal information we collect to process the complaint and to check on the level of service we provide. We do compile statistics showing information like the number of complaints we receive, but not in a form which identifies anyone. This information is only shared internally and with our funders.
We usually have to disclose the complainant’s identity to whoever the complaint is about. This is inevitable where, for example, the accuracy of a person’s record is in dispute. If a complainant doesn’t want information identifying him or her to be disclosed, we will try to respect that. However, it may not be possible to handle a complaint on an anonymous basis.
We will keep personal information contained in complaint files in line with our retention policy. This means that information relating to a complaint will be retained for two years from closure. It will be retained in a secure environment and access to it will be restricted according to the ‘need to know’ principle.
You can write to us about a compliment or complaint through our contact form.
Your rights to your data
Under data protection law, you have rights we need to make you aware of. The rights available to you depend on our reason for processing your information. You can find more information about this on the Information Commissioner’s Office website.
Accessing your data: You have the right to ask us for copies of your personal information. This right always applies. There are some exemptions, which means you may not always receive all the information we process.
Correcting your data: You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies.
Erasing your data: You have the right to ask us to erase your personal information in certain circumstances.
Restricting processing: You have the right to ask us to restrict the processing of your information in certain circumstances.
Object to processing: You have the right to object to processing if we are able to process your information because it is in our legitimate interests.
Data portability: This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another, or give it to you. The right only applies if we are processing information based on your consent.
You have a right to access data that Family Lives holds about you (personal data) and be given access to your information within 30 days of request in accordance with the Data Protection Act 2018 and the General Data Protection Regulations. You can request your personal information by email to firstname.lastname@example.org or by writing to: Data Controller, Family Lives, 15-17 The Broadway, Hatfield, Hertfordshire, AL9 5HZ.
There is no charge for this. It will help us to find your information if you can tell us something about the nature of your contact with us e.g. which service, your geographic area. We want to ensure that your personal information is accurate and up to date. You may ask us to correct or remove information you think is inaccurate. You may be asked to provide proof of your identity.
Your right to lodge a complaint with a supervisory authority
If you have a complaint about the way we process your data, you have the right to complain to the Information Commissioner’s Office. Please see the ICO website for more information.
Changes to this privacy notice
We regularly review and, where necessary, update our privacy information. If we plan to use personal data for a new purpose, we update our privacy information and communicate the changes to individuals before starting any new processing.
This privacy notice was last updated in February 2021