Family Fund’s General Privacy Notice

Introduction

We operate this Privacy Policy because we are committed to safeguarding the privacy of those individuals who provide any of their personal information to us via our ‘website’ (the homepage of which is at www.familyfund.org.uk) or by any other means. We have created this Privacy Policy to explain what personal information we may collect about you and how we will use any such personal information.

This Privacy Policy applies to anybody who submits their personal data to us whether it is submitted via our website, on a paper form, by email, over the telephone, in person or by any other means.

You will ensure that any information you supply to us is accurate and up to date, and inform us if any such information requires updating. You also promise that, if you submit any other person’s details to us, you have that other person’s permission to do so or are otherwise legally permitted to do so.

You have the right to lodge a complaint with the Information Commissioner’s Office if you have any concerns about the way we process your personal information.

Who are we?

Family Fund is a working name of Family Fund Trust, a charity registered in England under registered charity number 1053866, Scottish Charity no. SC040810, and a company limited by guarantee in England under registered company number 03166627. Family Fund is licensed to operate lotteries and regulated in Great Britain by York City Council under account number 066579.

Our registered office is at Unit 3, Alpha Court, Monks Cross Drive, Huntington, York, North Yorkshire, YO32 9WN, United Kingdom.

Our Data Protection Officer can be contacted by post at our above registered office address or by email at [email protected].

For most of our activities and for most grant programmes we manage, Family Fund is the Data Controller. For grant applications assessed and awarded under the Department for Education’s (DfE) Support for Families Raising Disabled Children (SFDC) programme the DfE is the Data Controller and Family Fund is the Data Processor.

We are committed to ensuring that all personal information we hold is treated properly and in accordance with applicable data protection legislation. We are registered as a data controller with the Information Commissioner’s Office and our registration number is Z5314842. In accordance with applicable data protection legislation, we are required to explain to you how we will treat any personal data which we collect about you.

What information do we collect if you apply to us to be considered for grants, support or other assistance?

If you submit an application for one of our grant programmes, we will look at your information to check for you are eligible. For more information on how we use your data for grant applications, please read the Grant Terms and Conditions and the Data Protection Statement.

What other information do we collect and how do we use it?

People who make enquiries to us who have not previously applied for grants or services

If you have not applied to us before and you contact us by phone, email, social media, post or to make an enquiry then we will make you aware of any information that we are going to record on our database.  We will use the information that you provide as necessary for our legitimate interests in dealing with your enquiry, training our staff, and quality monitoring or evaluating the services we provide.

We will only process any sensitive personal data provided within your enquiry where we have your explicit consent to do so, or where necessary for the substantial public interest in us ensuring that we can effectively and efficiently administer our related funding agreements with Government and other funders.

We will obtain limited personal information from you which will enable us to check that you do not already hold an account with us. For example, the names of you and your child, contact details and dates of birth.  In addition, we will require a password to be set up and your contact preferences. You can make choices about what we can contact you about, for example fundraising, volunteering or campaigning. You can change these choices at any time.

People who register as or become referrers for applicable grant programmes

If you apply to register as a referrer to make applications on behalf of families to a grant programme managed by Family Fund, then we will obtain contact and professional status information about you. We will use the information that you provide for our legitimate interests in confirming your eligibility to be a referrer and to manage your registration. Where a grant programme has a requirement for an audit to be conducted on grant awards. We may contact you to request the relevant evidence, this will be confirmed when you register to a relevant programme.

People who support us

If you support us, for example make a donation, register to fundraise or sign up for an event, we will usually collect (for use where necessary in connection with our legitimate interests of processing and administering the donation, registration or sign up):

• Your name
• Your contact details
• Your date of birth

When you make a payment, such as a donation, to us using our website, your financial information will not be stored by us (it will be stored and processed by our third-party payment providers). Our payment providers are accredited in accordance with industry standards. We only receive basic information from them to identify who has donated to us and the amount. These providers keep your details secure.

Where it is appropriate we may also ask for:

• Information relating to your health. If we require this information, we will tell you how we plan to use it. (For example, if you are attending a high risk event, we may ask for information about your health to comply with our health and safety duties, and we will tell you about this).
• Why you have decided to donate to us. We will never make this question mandatory, and only want to know the answer if you are comfortable telling us (in which case you will be consenting to us using that information to further understand the reason(s) for your donation).

We will also use your data where necessary for our legitimate interests in:

• Providing you with the services, products or information you asked for;
• Administering your donation or supporting your fundraising, including processing gift aid;
• Keeping a record of your relationship with us;
• Ensuring we know how you prefer to be contacted; and
• Understanding how we can improve the services, products or information you asked for, for example by reviewing our processes or documentation or training our staff.

We may also analyse supporter trends to help us offer you communications that are most appropriate to you and your interests. We may make use of profiling and screening methods for our legitimate interests in producing relevant communications that provide a better experience for our supporters. Profiling can help us target our resources more effectively through gaining an insight into the background of our supporters and helping us to build relationships that are appropriate to their interests and capacity to give. We will not share your information with any third parties for this purpose. We will store these details and manage our contact with you using our CRM software.

We may also use your personal information in detecting and reducing fraud and credit risk where it is necessary and in the public interest for us to do so.

People who share their story with us

You may choose to tell us about your experiences to help further our work. This may include setting up a webpage for fundraising, writing a blog for our website or posting your story on social media. This may include sharing sensitive information related to your health and family life in addition to your biographical and contact information. Where you share this information on social media on our public page, please note this information will be shared with our followers.

By sharing your story you will be providing your consent to being contacted by us so we can best understand how this information can help us further our work.

This information will not be shared outside our organisation without your explicit and informed consent. If we have your explicit and informed consent, or that of your parent or guardian if you are under 18, this information may be made public by us at events, in materials promoting our campaigning and fundraising work, or in documents such as our annual report and on our website.

People who play the Family Fund Lottery

Family Fund’s lottery is operated by Sterling Management Centre Ltd (“Sterling”). When registering to play you consent to Sterling using your personal details to manage your participation in the lottery. Family Fund will receive weekly reports from Sterling which contain the personal information of registered players.

People who apply for a role with us

We regularly post details of vacant positions at Family Fund on our website.

When you submit your application to us (either on our website, or through a third-party recruitment website or agency working on our behalf) we will have access to your information and will process it for recruitment purposes.

We will retain the information you submit or send to us for as long as we need to use it for the purpose of considering you for a vacancy with Family Fund. This will not be longer than 12 months.

If we determine that we cannot offer you a job at that time, we may (provided that you have given us your consent) retain your details on file for up to 12 months and contact you if any future vacancies within our organisation arise that you may be interested in. You may withdraw your consent to us doing this at any time. However, if you do so, we will no longer be able to consider you for any such opportunities. Job applicants’ information is processed in accordance with our Job Applicant Privacy Policy (a copy of which is available from us upon request).

People who wish to volunteer for us

We also advertise volunteering opportunities on our website. If you are successful in becoming a volunteer, your personal information will be processed in accordance with our Volunteer Data Protection Policy (a copy of which is available from us upon request). If we determine that we cannot accept your offer of volunteering at that time, we may (provided that you have given us your consent) retain your details on file for up to 12 months and contact you if any future volunteering opportunities within our organisation arise that you may be interested in. You may withdraw your consent to us doing this at any time. However, if you do so, we will no longer be able to consider you for any such opportunities.

People who register for our newsletter

You may choose to sign up to our newsletter (for example by registering via our website). If so, we will use your name and email address to send you newsletters in accordance with your mailing preferences (which can be amended at any time – please see the ‘Your Choices’ section below for further details).  

Visitors to our website

Our Website uses cookies – please see our Cookies policy (a copy of which can be accessed here) for further details.

Our website may also collect information about where you are on the Internet (e.g. the URL you came from, IP address, and domain names like .co.uk and.com), your browser type, the country where your computer is located, the pages of our website that were viewed during your visit and any search terms that you entered on our website. We may collect this information even if you do not submit any information capture forms or make any transactions using our website, and will use it where necessary for our legitimate interests in administering and improving the accessibility of our website, carrying out internal operations (including troubleshooting, analysis of how our website is used, testing, research, statistical and survey purposes) and as part of our efforts to keep our website safe.

Use of Meta Pixel

We use Meta Pixel (formerly Facebook Pixel) on our website to help us understand how visitors interact with our content and to improve the relevance of our advertising on Meta platforms. Meta Pixel collects information such as your IP address, browser and device details, pages visited, and actions taken on our site. This data may be combined with other Meta services and transferred to Meta servers outside the UK, including in the United States. We only activate Meta Pixel after you have given consent for marketing cookies through our cookie banner. You can withdraw your consent at any time by adjusting your cookie preferences. For more information about how Meta processes data, please see https://www.facebook.com/policy.php. You can also contact us at [email protected] to exercise your rights under data protection law, including access, deletion, and opting out of targeted advertising.  

Automated processing and artificial intelligence

Automated Processing is when data is processed by a computer system without manual input by a person. Automated Decision Making is when a decision is made on a form of application by a computer system without manual review by a person. 

Guidance on your rights relating to Automated Processing and Automated Decision Making may be found on the website of the ICO (data protection regulator for the UK): https://ico.org.uk/for-the-public/your-rights-relatingto-decisions-being-made-about-you-without-humaninvolvement/ 
 
Further information on Automated Processing by Family Fund in a grant application is available in the Data Protection Statement for each grant programme. 

Artificial Intelligence (AI) is a collective name for any system which allows a computer to simulate human problem-solving or creative abilities. This is often paired with a Large Language Model (LLM) – an algorithm or set of rules a computer follows to produce text which sounds more “human”. 

Family Fund uses AI and LLMs to review and improve processes, as well as to generate some media content. AI may also be used in some automated processing involving your personal data, such as document management or updating workflows. 

Whilst AI and LLMs may access systems which contain personal data, they are not currently used for our decision-making processes. 

Family Fund’s AI Chatbot 

Our website uses an AI chatbot to help with questions about Family Fund and our services. The technology used to provide this AI Chatbot is ChatGPT Version 4. Any gathering, handling, or other processing of personal data by this AI assistant will comply with UK GDPR, the Data Protection Act 2018, and all other relevant legislation.  

To improve the service and help provide consistent responses some chat data is kept when the conversation has ended. Chat data and chat history is retained for a maximum of 12 months. After this time, it will be either anonymised or deleted.  

The AI Chatbot does not provide medical, legal, or financial advice and is not a real person.  

To use the AI Chatbot, you must accept the Terms of Use specified when you first launch the tool. This is to ensure that the AI Chatbot continues to supply consistent and appropriate responses and answers to questions.  

The AI Chatbot has limited access to our databases, so it may not be possible for it to answer all queries, depending on what information is available to it. We limit its access so that we can ensure data is kept safe and secure.  

If you do not wish to use this service, then there will always be alternate ways for you to raise any queries. You can email us at [email protected] call us at 01904 550 055 or write to us at our address at Unit 3 Alpha Court, Monk’s Cross Drive, Huntington, York, YO32 9WN.  

Your choices

You have a choice about being contacted for the following purposes. If you provide us with your consent to do so we will contact you by email, post and/or telephone from time to time as follows:

• To send you our newsletter.
• To promote and administer our Fundraising and Volunteering activities.
• To make you aware of and allow you to contribute to campaigns being run by us or trusted third parties.
• To promote the goods and services of our trading subsidiary Family Fund Business Services.

Where we are processing your information on the basis that we have your consent, you can withdraw your consent at any time (for example, if you no longer want to receive further contact from us in respect of fundraising). This can be done by emailing us at [email protected], writing to First Contact Team at Family Fund, Unit 3, Alpha Court, Monks Cross Drive, Huntington, York, North Yorkshire, YO32 9WN or clicking on the appropriate link of any related email. Any such withdrawal will not affect the lawfulness of our processing based on your consent before you withdrew it.

Please note that if you withdraw your consent to us processing your personal information for any of the purposes described above, this may result in us being unable to carry out a relevant action or provide you with any related feedback or response. For example, if you withdraw your consent to us using your personal information in connection with a fundraising activity, we may need to remove any related fundraising webpage that we have set up for you.

If you withdraw your consent to us processing your information in connection with an application for grants, support or other assistance, we will be unable to consider your application any further.

Who will we disclose your personal information to?

As well as disclosing information about you to health, education and social care professionals in connection with requests of the nature referred to in the section ‘What information do we collect if you apply to us to be considered for grants, support or other assistance?’, we may disclose information about you to:

• the Government departments and other funders which provide us with funding (where necessary for the substantial public interest in us ensuring that we can effectively and efficiently administer our related funding agreements with Government and other funders); and
• any third-party which is involved in the provision of the assistance we are providing to or procuring for you. For example, if you receive goods or services from us we will pass information about you to our relevant supplier(s) so that they can provide you with these goods or services and any associated services which we ask them to provide. We will provide our quality assurance assessors with your contact and order details, under a duty of confidentiality, so that they can monitor the performance of, and your satisfaction with, our suppliers. A list of suppliers and quality assurance assessors is available by writing to our address for correspondence (as shown at the beginning of this Statement) with details of your request.
• with your explicit consent, and where applicable to the grant you have applied for, the Department for Work and Pensions (DWP) so that confirmation of your income can be received directly from them, rather than you providing this evidence.

We may also share personal information about you:

1. With third parties who are directly involved in dealing with any request, enquiry or correspondence submitted by you;
2. With third parties who are providing us with professional advice and support where necessary for our legitimate interests in obtaining such advice or support;
3. Where we are legally required to do so, including reporting the results of lottery draws to the regulator
4. In connection with criminal investigations, legal proceedings or prospective legal proceedings where necessary for our legitimate interests and permitted by law;
5. Where necessary for our legitimate interests in establishing, exercising or defending our legal rights (including providing information to others for the purposes of fraud prevention) and permitted by law; and
6. Where we state or inform you otherwise (e.g. in this policy or on our website).

Where we engage third parties to process data on our behalf, information is only shared for the purpose of the third-party providing services on our behalf. For financial and technical reasons, we may, on occasion, decide to use the services of a supplier outside the United Kingdom (UK), which means that your personal data is transferred, processed and stored outside the UK. For example, we may use third-party software for our ‘contact us’ forms, or for surveys that we do. We take steps to ensure that these organisations have in place suitable technical and organisational safeguards through the agreements we hold and through the use of International Data Transfer Agreements (IDTAs) where necessary.

If you provide us with feedback regarding our activities, we may disclose that feedback to those of our suppliers who are involved in those activities.

We may also disclose your personal information to third parties in the event that we sell, merge or buy any business and/or assets (in which case we may disclose your personal information to the prospective seller or buyer of such business or assets) or if we or substantially all of our assets are acquired by a third-party.  Any such disclosure will be made where necessary for the legitimate interests of us and/or the third-party in respect of the proposed transaction; however we will not transfer your personal information to any such third-party unless we are satisfied that they are able to provide an adequate level of protection in respect of your personal information.

We may disclose information about you to, and obtain information about you from, Government departments and agencies, debt collection agencies and tracing agencies to assist in the detection and prevention of fraud. Except as provided in this Privacy Policy, we will not provide your information to third parties without your express consent for any purpose (including but not limited to direct marketing). We do not sell personal information under any circumstances.

Your rights

You have a legal right to see a copy of the personal data that we keep about you and to require us to correct any inaccuracies, subject to certain exemptions.  In some circumstances you may also have the right to:

1. Request that we erase any personal data held about you;
2. Restrict our processing of your personal data (for example to ask to suspend the processing of personal information to establish its accuracy or the reasons for processing it);
3. Data portability (i.e. to request the transfer of personal data to a third-party); and
4. Object to our processing of your personal data.

To request any of the above, write to the Data Protection Officer at Family Fund, Unit 3, Alpha Court, Monks Cross Drive, Huntington, York, North Yorkshire, United Kingdom YO32 9WN. You can also email us at [email protected] or telephone us on 01904 550055.

Please contact us by one of these same methods if you have any reason to believe that information we hold about you is inaccurate.  We will respond to your request as soon as possible and, in any event, within one month from the date of receiving the request.  Please note that we may, where legally permitted, reject any such request or limit the scope of our response (for example if, in the circumstances, the right does not apply to you).

In accordance with applicable data protection legislation, we follow security procedures in the storage and disclosure of your information.  We may therefore request proof of your identity before complying with any other request of a nature described above.

You will not generally have to pay a fee to exercise any of your rights described above. However, we may charge a reasonable fee if you make a request to see a copy of your personal information which is clearly unfounded or excessive. Alternatively, we may refuse to comply with your request in such circumstances.

Retention of your data

We keep the information we hold about you for as long as we need it for the purpose we collected it. For example, if your application for a grant, support or other assistance is successful we will retain your information for up to seven years after your child ceases to be eligible to receive help from us for audit, assurance and administration purposes (in connection with the substantial public interest in us ensuring that we can effectively and efficiently administer our related funding agreements with Government and other funders).

Should circumstances change that require amendments or deletions of any contact information held on your file then it is your responsibility to notify us either in writing or over the telephone as soon as those changes in circumstances occur. Should you perceive the changes to your circumstances as being particularly sensitive you must take extra care with how you notify us of those changes (e.g. using recorded delivery and following up any written request with a phone call etc).

If you have consented to receiving our newsletter or further contact from us as described above, your relevant personal details will be used by us to provide this to you unless or until:

• We stop producing our newsletter
• We stop the type of contact under which you provided your consent
• You withdraw your consent, after which we will use your information in a reduced format to ensure we stop sending you the newsletter.

When the retention period expires, except where otherwise stated, we will either securely destroy your information, or we will pseudonymise your data so you and your family can no longer be identified from it. An example of where we pseudonymise data is when we use statistical information for research and reporting purposes. 

A copy of our data retention policy is available from us upon request.

Security of your data

We take appropriate measures to ensure that the personal information disclosed to us is kept secure, accurate, and up to date.  We will ensure that your personal information is kept only for so long as is necessary for the purposes for which it was collected and is securely destroyed in accordance with our data retention policy.

Third-party websites and services

Our website contains links to other websites which are outside our control and are not covered by this Privacy Policy. If you access other websites using the links provided, the operators of those websites may collect personal information from you which will be subject to their respective privacy policies (which you should read). We are not liable for the privacy policies or practices of such third-party website operators in respect of your personal information. 

You acknowledge that any information that you post using our social media facilities will be viewable by anybody who accesses those facilities and that such information is also subject to the relevant social media provider’s privacy policy.  You are advised to consult each such privacy policy to see how they will use your data.

Please note that where:

1. we signpost or refer you to any third-party for information, advice or support; or
2. you register to attend or compete in an event organised by a third-party in our aid,

then in each case that third-party will be the controller of any information that you provide to them and will assume corresponding responsibilities under applicable data protection legislation. Such information will be subject to the third-party’s privacy policy (which you should read). We are not liable for the privacy policies or practices of such third parties in respect of your personal information.

How will you know if we make any changes to this Privacy Policy?

We may amend this Privacy Policy from time to time. If we make any changes to the way in which we use your personal information we will notify you by posting a notice on our website’s homepage, by writing to you or by sending you an email. You can view the current version of our Privacy Policy at any time by clicking on the Privacy Policy link on our website’s homepage.

Queries

If you have any questions about this Privacy Policy or our treatment of your personal information, please contact our Data Protection Officer at the contact details given above.

Updated in December 2025