Family Fund’s General Privacy Notice

Introduction

We operate this Privacy Policy because we are committed to safeguarding the privacy of those individuals who provide any of their personal information to us via our ‘Website’ (the homepage of which is at www.familyfund.org.uk) or by any other means. We have created this Privacy Policy to explain what personal information we may collect about you and how we will use any such personal information.

This Privacy Policy applies to anybody who submits their personal data to us in any of the above circumstances (whether it is submitted via our Website, on a paper form, by email, over the telephone, in person or by any other means).

You will ensure that any information you supply to us is accurate and up to date, and inform us if any such information requires updating. You also promise that, if you submit any other person’s details to us, you have that other person’s permission to do so or are otherwise legally permitted to do so.

You have the right to lodge a complaint with the Information Commissioner’s Office if you have any concerns with regard to the way in which we process your personal information.

Who are we?

Family Fund is a working name of Family Fund Trust, a charity registered in England under registered charity number 1053866, Scottish Charity no. SC040810, and a company limited by guarantee in England under registered company number 03166627. Family Fund is licensed to operate lotteries and regulated in Great Britain by York City Council under account number 066579.

Our registered office is at Unit 3, Alpha Court, Monks Cross Drive, Huntington, York, North Yorkshire, YO32 9WN, United Kingdom.

Our Data Protection Officer can be contacted by post at our above registered office address or by email at [email protected].

For the majority of our activities and for most grant schemes we manage, Family Fund is the Data Controller. For grant applications assessed and awarded under the Department for Education’s (DfE) Support for Families Raising Disabled Children (SFDC) programme the DfE is the Data Controller and Family Fund is the Data Processor.

We are committed to ensuring that all personal information we hold is treated properly and in accordance with applicable data protection legislation. We are registered as a data controller with the Information Commissioner’s Office and our registration number is Z5314842. In accordance with applicable data protection legislation, we are required to explain to you how we will treat any personal data which we collect about you.

What information do we collect if you apply to us to be considered for grants, support or other assistance?

When you apply to us for grants, support or other assistance we need to assess your application against our eligibility criteria as explained in our terms and conditions. So to consider your application we may obtain sensitive personal information directly from you when you apply to us for assistance whether through your online account or on a paper application form (for example, details of your child’s disability and the level of support needed when carrying out day-to-day activities and details of your financial circumstances).

In order to consider your application for grants, support or other assistance we will also collect your contact details and personal details of any family members who we may need to speak to or who are relevant to your application.  We may also collect financial details if we are considering you for a cash grant.

We may also collect additional information from you over the phone, by email, social media or by post in support of your application. Depending on your settings or the privacy policies for social media and messaging services like Facebook, WhatsApp or Twitter, you might give us permission to access information from those accounts or services if you contact us using any of those services.

As well as the information that you provide directly to us about your family circumstances, where you permit us to do so we may also collect information about you and your family’s circumstances and your child’s disability from third party professionals linked to your child’s healthcare, education or social care.

In addition when you submit your application to us you will become subject to our terms and conditions and data protection statement for applicants, which state we that we may use the information on your application to arrange for an Assessor to contact you for an interview either by the phone or through a visit and write a detailed report for us on your family circumstances including how they are affected by your child’s disability. The report will contain the sensitive information that you provide in the course of the interview and the Assessor’s opinions on how this meets the criteria of the grant or service that you are applying for. The Assessors are contracted by us or by one of our service providers under a duty of confidentiality, with recognised qualifications or substantial proven work experience of working with children with disabilities. The Assessor will submit the report to us through our secure portal to be stored in our database.

We also have established a network of authorised healthcare professionals working in hospitals, hospices and other institutions that may refer you to us and will be able to help you complete an application for assistance from us whilst your child is receiving treatment or other support from those institutions. The referrer will make it clear to you what our terms and conditions and privacy policy states at that time and obtain your consent to submit your application to us on your behalf. Where you are referred to us in this way it is unlikely that we would require an Assessor to do a report.

How do we use the information that you provide to us in applying for grants, support or other assistance?

We will use the information described above (whether received directly from you, from referrers, from third parties you have permitted us to speak to or from our Assessors) as appropriate to understand whether:

• your child meets the requirements of our eligibility criteria, and
• whether you and your family circumstances meet specific criteria associated with the provision of those grants and services and, if so,
• how we can help you and best provide support to you.

By providing us with your information, including sensitive personal information, signifying consent on the application form or verbally you will be providing your explicit consent to us using any sensitive personal information contained within your application for the above purposes and for the purposes of discussing with you your application and any subsequent grants, services or support services that we are able to provide within 12 months of the date we award you with assistance. 

We will further use your information where necessary for our legitimate interests as follows:

1. In dealing with any enquiries and requests that you send to us.
2. To inform you of the availability of additional grants, advice and support services that may be relevant to you, including any information events that we run. We will only contact you for this purpose within 12 months of the date we last provided assistance to you. To receive further advice and support after this date you will have to submit a new application and we may send you a reminder in this respect within the following 12 months if we have funding available to further assist you.
3. To remind you to redeem any grant that we have agreed to provide if it is near its expiry date.
4. To generate evidence reports and summaries of our completed work for publication on our Website, and performance data for inclusion in our annual report. We may do this by sending you a link to a survey. You do not have to complete the survey and can opt out of this communication by unsubscribing to the email, by writing to our First Contact Team at our registered address above or by emailing us at [email protected]. Please note that any such reports and summaries will contain general information on trends and/or issues. We may contact you to ask you if you would like to provide a case study or tell your story so we can report the impact of what we do to our funders. If you are happy to do this we will only use the information that you provide with your explicit consent.
5. Responding to appeals or complaints. Where we process any sensitive personal data for this purpose, it will be to the extent necessary for the substantial public interest in us ensuring that we carry out our activities in an appropriate manner.
6. Our own research purposes (or for the legitimate research purposes established by organisations which we are associated with, including our Government funders). This may involve providing your contact details to a trusted research organisation conducting research on our behalf. If you’re contacted for research purposes and you don’t want to be involved, you can say that you don’t want to be contacted again as set out in section 4 above. Please note that any such research reports will contain general information on trends and/or issues and will not identify you.
7. Our own audit and assurance purposes and our continuous desire to improve our services. For example to prevent and detect fraud and misuse and to ensure that grant processing is carried out by our staff to a high standard and continuously improved.
8. Our own administrative purposes. For example keeping our business systems and records up to date.

We will also use your personal information:

• to provide you with grant-making, advice and support services that you have requested or which we otherwise agree to provide to you; and
• where necessary for the substantial public interest in us ensuring that we can effectively and efficiently administer our related funding agreements with Government and other funders.

What other information do we collect and how do we use it?

People who make enquiries to us who have not previously applied for grants or services

If you have not applied to us before and you contact us by phone, email, social media, post or to make an enquiry then we will make you aware of any information that we are going to record on our database.  We will use the information that you provide as necessary for our legitimate interests in dealing with your enquiry, training, and quality monitoring or evaluating the services we provide. We will only process any sensitive personal data provided within your enquiry where we have your explicit consent to do so or where necessary for the substantial public interest in us ensuring that we can effectively and efficiently administer our related funding agreements with Government and other funders.

People who register for an online account with us

We will obtain limited personal information from you which will enable us to check that you do not already hold an account with us. For example, the names of you and your child, contact details and dates of birth.  In addition we will require a password to be set up and your contact preferences. You can make choices about what we can contact you about, for example fundraising, volunteering or campaigning. You can change these choices at any time. When an account is registered we only use the data for this purpose where necessary for our legitimate interests in maintaining and administering your account. Any further information that you provide through the account will be collected and used in accordance with the purpose that you supplied it as set out in this privacy policy or as we otherwise notify you.

Online Application Tracking: Should you wish to use the Online Application Tracker to check the progress of your application, this will record your device’s IP Address, your Browser UserAgent, and your postcode. These will not be accessible to staff outside of our IT department and will be deleted in line with our retention and deletion procedures.

People who register as or become referrers for applicable grant programmes

If you apply to register as or become a referrer to make applications on behalf of families to a grant programme managed by Family Fund, then we will obtain contact and professional status information about you. We will use the information that you provide for our legitimate interests in confirming your eligibility to be a referrer and to manage your registration. Where a grant programme has a requirement for an audit to be conducted on grant awards we may contact you to request the relevant evidence, this will be confirmed when you register to a relevant programme.

People who support us

If you support us, for example make a donation, register to fundraise or sign up for an event, we will usually collect (for use where necessary in connection with our legitimate interests of processing and administering the donation, registration or sign up):

• Your name
• Your contact details
• Your date of birth

When you make a payment, such as a donation, to us using our Website, your financial information will not be stored by us (it will be stored and processed by our third party payment providers). Our payment providers are accredited in accordance with industry standards. We only receive basic information from them to identify who has donated to us and the amount. These providers keep your details secure.

Where it is appropriate we may also ask for:

• Information relating to your health (for example if you are taking part in a high risk event). We will use this information for the purposes that we notify you of at the time that we ask you for such information (which may include, for example, use of the information where necessary to comply with our health and safety duties in connection with a high risk event).
• Why you have decided to donate to us. We will never make this question mandatory, and only want to know the answer if you are comfortable telling us (in which case you will be consenting to us using that information to further understand the reason(s) for your donation).

We will also use your data where necessary for our legitimate interests in:

• Providing you with the services, products or information you asked for;
• Administering your donation or supporting your fundraising, including processing gift aid;
• Keeping a record of your relationship with us;
• Ensuring we know how you prefer to be contacted; and
• Understanding how we can improve the services, products or information you asked for, for example by reviewing our processes or documentation or training our staff.

We may also analyse supporter trends to help us offer you communications that are most appropriate to you and your interests. We may make use of profiling and screening methods where necessary for our legitimate interests in producing relevant communications to provide a better experience for our supporters. Profiling can help us target our resources more effectively through gaining an insight into the background of our supporters and helping us to build relationships that are appropriate to their interests and capacity to give. We will not share your information with any third parties for this purpose. We will store these details and manage our contact with you using our CRM software.

We may also use your personal information in detecting and reducing fraud and credit risk where it is necessary and in the public interest for us to do so.

People who share their story with us

You may choose to tell us about your experiences to help further our work. This may include setting up a webpage for fundraising, writing a blog for our Website or posting your story on social media. This may include sharing sensitive information related to your health and family life in addition to your biographical and contact information. Where you share this information on social media on our public page please note this information will be shared with our followers.

By sharing your story you will be providing your consent to being contacted by us so we can best understand how this information can help us further our work.

This information will not be shared outside our organisation without your explicit and informed consent. If we have your explicit and informed consent, or that of your parent or guardian if you are under 18, this information may be made public by us at events, in materials promoting our campaigning and fundraising work, or in documents such as our annual report and on our website.

Automated processing and artificial intelligence

Automated Processing is when data is processed by a computer system without manual input by a person. Automated Decision Making is when a decision is made on a form of application by a computer system without manual review by a person.

Guidance on your rights relating to Automated Processing and Automated Decision Making may be found on the website of the ICO (data protection regulator for the UK): https://ico.org.uk/for-the-public/your-rights-relatingto-decisions-being-made-about-you-without-humaninvolvement/

Further information on Automated Processing by Family Fund in a grant application is available in the Data Protection Statement for each grant scheme.

Artificial Intelligence (AI) is a collective name for any system which allows a computer to simulate human problem-solving or creative abilities. This is often paired with a Large Language Model (LLM) – an algorithm or set of rules a computer follows to produce text which sounds more “human”.

Family Fund uses AI and LLMs to review and improve processes, as well as to generate some media content. AI may also be used in some automated processing involving your personal data, such as document management or updating workflows.

Whilst AI and LLMs may access systems which contain personal data, they are not currently used for our decision-making processes.

People who play the Family Fund Lottery

Family Fund’s lottery is operated by Sterling Management Centre Ltd (“Sterling”). When registering to play you consent to Sterling using your personal details to manage your participation in the lottery. Family Fund will receive weekly reports from Sterling which contain the personal information of registered players.

People who apply for a role with us

We regularly post details of vacant positions at Family Fund on our Website. When you click on a link to apply for a position you will be redirected to the website of our third party recruitment agent. We will be able to log in and access that information to consider you for the vacant position. Alternatively, you may send your application to us through the post or electronically. We will retain the information you submit or send to us for as long as we need to use it for the purpose of considering you for a vacancy with Family Fund (which will not be for longer than 12 months).

If we determine that we cannot offer you a job at that time, we may (provided that you have given us your consent) retain your details on file for up to 12 months and contact you if any future vacancies within our organisation arise that you may be interested in. You may withdraw your consent to us doing this at any time; however if you do so we will no longer be able to consider you for any such opportunities. Job applicants’ information is processed in accordance with our Job Applicant Privacy Policy (a copy of which is available from us upon request).

People who wish to volunteer for us

We also advertise volunteering opportunities on our Website. If you are successful in becoming a volunteer, your personal information will be processed in accordance with our Volunteer Data Protection Policy (a copy of which is available from us upon request). If we determine that we cannot accept your offer of volunteering at that time, we may (provided that you have given us your consent) retain your details on file for up to 12 months and contact you if any future volunteering opportunities within our organisation arise that you may be interested in. You may withdraw your consent to us doing this at any time; however if you do so we will no longer be able to consider you for any such opportunities.

People who register for our newsletter

You may choose to sign up to our newsletter (for example by registering via our Website). If so, we will use your name and email address to send you newsletters in accordance with your mailing preferences (which can be amended at any time – please see the ‘Your Choices’ section below for further details).  

Visitors to our website

Our Website uses cookies – please see our Cookies policy (a copy of which can be accessed here) for further details.

Our Website may also collect information about where you are on the Internet (e.g. the URL you came from, IP address, and domain names like .co.uk and.com), your browser type, the country where your computer is located, the pages of our Website that were viewed during your visit and any search terms that you entered on our Website. We may collect this information even if you do not submit any information capture forms or make any transactions using our Website, and will use it where necessary for our legitimate interests in administering and improving the accessibility of our Website, carrying out internal operations (including troubleshooting, analysis of how our Website is used, testing, research, statistical and survey purposes) and as part of our efforts to keep our Website safe.

Your choices

You have a choice about being contacted for the following purposes. If you provide us with your consent to do so we will contact you by email, post and/or telephone from time to time as follows:

• To send you our newsletter.
• To promote and administer our Fundraising and Volunteering activities.
• To make you aware of and allow you to contribute to campaigns being run by us or trusted third parties.
• To promote the goods and services of our trading subsidiary Family Fund Business Services.

Where we are processing your information on the basis that we have your consent, you can withdraw your consent at any time (for example, if you no longer want to receive further contact from us in respect of fundraising). This can be done by emailing us at [email protected], writing to First Contact Team at Family Fund, Unit 3, Alpha Court, Monks Cross Drive, Huntington, York, North Yorkshire, YO32 9WN or clicking on the appropriate link of any related email. Any such withdrawal will not affect the lawfulness of our processing based on your consent before you withdrew it.

Please note that if you withdraw your consent to us processing your personal information for any of the purposes described above, this may result in us being unable to carry out a relevant action or provide you with any related feedback or response. For example, if you withdraw your consent to us using your personal information in connection with a fundraising activity, we may need to remove any related fundraising webpage that we have set up for you.

If you withdraw your consent to us processing your information in connection with an application for grants, support or other assistance, we will be unable to consider your application any further.

Who will we disclose your personal information to?

As well as disclosing information about you to health, education and social care professionals in connection with requests of the nature referred to in the section ‘What information do we collect if you apply to us to be considered for grants, support or other assistance?’, we may disclose information about you to:

• the Government departments and other funders which provide us with funding (where necessary for the substantial public interest in us ensuring that we can effectively and efficiently administer our related funding agreements with Government and other funders); and
• any third party which is involved in the provision of the assistance we are providing to or procuring for you. For example, if you receive goods or services from us we will pass information about you to our relevant supplier(s) so that they can provide you with these goods or services and any associated services which we ask them to provide. We will provide our quality assurance assessors with your contact and order details, under a duty of confidentiality, so that they can monitor the performance of, and your satisfaction with, our suppliers. A list of suppliers and quality assurance assessors is available by writing to our address for correspondence (as shown at the beginning of this Statement) with details of your request.
• with your explicit consent, and where applicable to the grant you have applied for, the Department for Work and Pensions (DWP) so that confirmation of your income can be received directly from them, rather than you providing this evidence.

We may also share personal information about you:

1. With third parties who are directly involved in dealing with any request, enquiry or correspondence submitted by you;
2. With third parties who are providing us with professional advice and support where necessary for our legitimate interests in obtaining such advice or support;
3. Where we are legally required to do so, including reporting the results of lottery draws to the regulator
4. In connection with criminal investigations, legal proceedings or prospective legal proceedings where necessary for our legitimate interests and permitted by law;
5. Where necessary for our legitimate interests in establishing, exercising or defending our legal rights (including providing information to others for the purposes of fraud prevention) and permitted by law; and
6. Where we state or inform you otherwise (e.g. in this policy or on our Website).

Where we engage third parties to process data on our behalf, information is only shared for the purpose of the third party providing services on our behalf. For financial and technical reasons we may, on occasion, decide to use the services of a supplier outside the United Kingdom (UK), which means that your personal data is transferred, processed and stored outside the UK. For example, we may use third party software for our ‘contact us’ forms, or for surveys that we do. We take steps to ensure that these organisations have in place suitable technical and organisational safeguards through the agreements we hold and through the use of International Data Transfer Agreements (IDTAs) where necessary.

In the event that you provide us with feedback regarding our activities, we may disclose that feedback to those of our suppliers who are involved in those activities.

We may also disclose your personal information to third parties in the event that we sell, merge or buy any business and/or assets (in which case we may disclose your personal information to the prospective seller or buyer of such business or assets) or if we or substantially all of our assets are acquired by a third party.  Any such disclosure will be made where necessary for the legitimate interests of us and/or the third party in respect of the proposed transaction; however we will not transfer your personal information to any such third party unless we are satisfied that they are able to provide an adequate level of protection in respect of your personal information.

We may disclose information about you to, and obtain information about you from, Government departments and agencies, debt collection agencies and tracing agencies to assist in the detection and prevention of fraud. Except as provided in this Privacy Policy, we will not provide your information to third parties without your express consent for any purpose (including but not limited to direct marketing). We do not sell personal information under any circumstances.

Your rights

You have a legal right to see a copy of the personal data that we keep about you and to require us to correct any inaccuracies, subject to certain exemptions.  In some circumstances you may also have the right to:

1. Request that we erase any personal data held about you;
2. Restrict our processing of your personal data (for example to ask to suspend the processing of personal information to establish its accuracy or the reasons for processing it);
3. Data portability (i.e. to request the transfer of personal data to a third party); and
4. Object to our processing of your personal data.

Requests in respect of the above should be made in writing to the Data Protection Officer at Family Fund, Unit 3, Alpha Court, Monks Cross Drive, Huntington, York, North Yorkshire, United Kingdom YO32 9WN.  Please contact us at the same address if you have any reason to believe that information we hold about you is inaccurate.  We will respond to your request as soon as possible and, in any event, within one month from the date of receiving the request.  Please note that we may, where legally permitted, reject any such request or limit the scope of our response (for example if, in the circumstances, the right does not apply to you).

In accordance with applicable data protection legislation, we follow security procedures in the storage and disclosure of your information.  We may therefore request proof of your identity before complying with any other request of a nature described above.

You will not generally have to pay a fee to exercise any of your rights described above. However, we may charge a reasonable fee if you make a request to see a copy of your personal information which is clearly unfounded or excessive. Alternatively we may refuse to comply with your request in such circumstances.

Retention of your data

We keep the information we hold about you for as long as we need it for the purpose we collected it. For example, if your application for a grant, support or other assistance is successful we will retain your information for up to seven years after your child ceases to be eligible to receive help from us for audit, assurance and administration purposes (in connection with the substantial public interest in us ensuring that we can effectively and efficiently administer our related funding agreements with Government and other funders).

Should circumstances change that require amendments or deletions of any contact information held on your file then it is your responsibility to notify us either in writing or over the telephone as soon as those changes in circumstances occur. Should you perceive the changes to your circumstances as being particularly sensitive you must take extra care with how you notify us of those changes (e.g. using recorded delivery and following up any written request with a phone call etc). If you have registered for an online account with us you will be able to process some changes online at any time, for example address details. Full guidance is provided in the ‘Apply for my Family’ section of the website, www.familyfund.org.uk.

If you have consented to receiving our newsletter or further contact from us as described above, your relevant personal details will be used by us to provide this to you unless or until: (i) we cease producing our newsletter or making the further contact in respect of which we have obtained your consent; or (ii) you withdraw your consent, following which we will suppress such personal data without delay following the date that (i) we cease producing the newsletter or making the further contact, or (ii) you withdraw your consent (as appropriate).

Following the expiry of the relevant retention period, except where otherwise stated we will securely destroy the information or pseudonymise the data so that you and your family can no longer be identified from it (for example, where pseudonymised information will be useful for our statistical research purposes).

A copy of our data retention policy is available from us upon request.

Security of your data

We take appropriate measures to ensure that the personal information disclosed to us is kept secure, accurate, and up to date.  We will ensure that your personal information is kept only for so long as is necessary for the purposes for which it was collected and is securely destroyed in accordance with our data retention policy.

Third Party Websites and Services

Our Website contains links to other websites which are outside our control and are not covered by this Privacy Policy. If you access other websites using the links provided, the operators of those websites may collect personal information from you which will be subject to their respective privacy policies (which you should read). We are not liable for the privacy policies or practices of such third party website operators in respect of your personal information. 

You acknowledge that any information that you post using our social media facilities will be viewable by anybody who accesses those facilities and that such information is also subject to the relevant social media provider’s privacy policy.  You are advised to consult each such privacy policy to see how they will use your data.

Please note that where:

1. we signpost or refer you to any third party for information, advice or support; or
2. you register to attend or compete in an event organised by a third party in our aid,

then in each case that third party will be the controller of any information that you provide to them and will assume corresponding responsibilities under applicable data protection legislation. Such information will be subject to the third party’s privacy policy (which you should read). We are not liable for the privacy policies or practices of such third parties in respect of your personal information.

How will you know if we make any changes to this Privacy Policy?

We may amend this Privacy Policy from time to time. If we make any changes to the way in which we use your personal information we will notify you by posting a notice on our Website’s homepage, by writing to you or by sending you an email. You can view the current version of our Privacy Policy at any time by clicking on the Privacy Policy link on our Website’s homepage.

Queries

If you have any questions about this Privacy Policy or our treatment of your personal information, please contact our Data Protection Officer at the contact details given above.

Updated in October 2023: Please note that the privacy policy has been updated and whilst it has not changed the way we collect and use data, there are changes to meet the requirement of new data protections regulations.