Data Protection & GDPR Policy

This policy explains how we collect, use, store and protect personal information, and the rights individuals have over their data. It applies to everyone acting for SEN Families Unite CIC and to all personal information we hold, whether digital or on paper.

We only process personal information where we have a lawful basis, which may be:

• Consent — for example, where someone signs up to receive updates
• Legitimate interests — running our community support work and responding to enquiries
• Legal obligation — where the law requires us to hold or share information
• Vital interests — where processing is necessary to protect someone's life or prevent serious harm

Depending on how you engage with us, the information we hold may include:

• Parent or carer contact details
• Names and relevant personal details
• Date of birth where required
• SEND-related information
• Support plans or session notes where applicable
• Emergency contact information
• Relevant medical information where necessary
• Safeguarding information where necessary

Some information — such as health, disability, SEND-related or ethnicity data — is special category data and needs additional protection. We collect it only where there is a clear need, with an appropriate lawful basis and additional condition for processing, and we limit access to those who need it.

• To respond to enquiries and requests for support
• To plan, deliver and improve our activities and services
• To keep people safe during activities, including emergency contact and medical needs
• To meet safeguarding and legal obligations
• To keep accurate records of our work, including anonymised reporting to funders and partners

We use appropriate technical and organisational measures to protect personal information. This includes secure digital storage with access controls and passwords, restricting access to those who need it, and keeping any physical records securely stored. Information is not stored on unsecured personal devices or shared through insecure channels.

We do not sell personal information and we do not share it for marketing. Information may be shared where there is a safeguarding concern, a legal obligation, or where an individual has agreed to a referral or joint support arrangement with another organisation.

Personal information is kept only for as long as necessary for the purpose for which it was collected, or for as long as the law requires. When information is no longer needed it is securely deleted or destroyed.

Under UK GDPR you have the right to:

• Access the personal information we hold about you
• Have inaccurate information corrected
• Request deletion of information where legally permissible
• Restrict or object to certain processing
• Withdraw consent where consent is the lawful basis
• Request a copy of certain information in a portable format
• Complain to the Information Commissioner's Office

To exercise any of these rights, email senfamiliesunite@senfamiliesunite.uk.

If a personal data breach occurs, we will act quickly to contain it, assess the risk to the people affected, record what happened and take steps to prevent a repeat. Where the breach is likely to result in a risk to people's rights and freedoms, we will report it to the Information Commissioner's Office without undue delay, and inform those affected where required.

The ICO is the UK's independent regulator for data protection. If you are unhappy with how we have handled your information, you can raise it with us first, and you also have the right to complain to the ICO at ico.org.uk.

This policy is reviewed periodically and updated when our practice, our services or the relevant law changes. Review and approval details are recorded internally by SEN Families Unite CIC and can be requested by emailing us.