At Thriving Beyond the Label, protecting the privacy, dignity and personal information of children, young people, parents, carers and members of our community is extremely important to us.

This Privacy Policy explains what personal information we collect, how we use it, how we keep it secure and the rights available to you.

Throughout this policy, the terms “we,” “us” and “our” refer to Thriving Beyond the Label.

For the purposes of applicable UK data protection law, Thriving Beyond the Label is responsible for deciding how and why the personal information described in this policy is used.

1. Personal information we collect

We may collect personal information when you:

• Contact us with a question or request
• Register your child for the ThrivingInterests Holiday Club
• Join a waiting list
• Attend an activity, event or workshop
• Purchase or download a resource
• Subscribe to updates or newsletters
• Complete a survey or feedback form
• Make a donation
• Apply to volunteer or work with us
• Communicate with us by email, telephone, social media or through our website

The information we collect may include:

• Your name
• Your child’s name
• Your relationship to the child
• Postal address
• Email address
• Telephone number
• Emergency contact information
• Your child’s age or date of birth
• School or educational information
• Interests and preferred activities
• Communication preferences
• Accessibility and support requirements
• Dietary requirements and allergies
• Medical or health information relevant to safe participation
• Photographs, videos or examples of children’s work, where appropriate permission has been provided
• Feedback, opinions and information shared in surveys
• Purchase, donation and transaction information
• Records of your communications with us

We only ask for information that is reasonably necessary to provide our activities, resources and support safely and effectively.

2. Information about children and young people

Much of our work involves neurodivergent children and young people. We recognise that children’s personal information requires particular care and protection.

Registration information will normally be provided by a parent, carer or other authorised adult. We do not intentionally ask children to submit sensitive personal information through our website without appropriate adult involvement.

We use information about a child only for purposes connected with their participation, safety, support and experience. This may include:

• Understanding their interests and strengths
• Identifying reasonable adjustments or support requirements
• Planning suitable activities
• Supporting communication and participation
• Managing dietary, medical or accessibility needs
• Contacting a parent or carer in an emergency
• Meeting safeguarding responsibilities

Where privacy information is provided directly to children or young people, we aim to explain it in language that is clear, accessible and appropriate for their age and level of understanding. ICO guidance states that privacy information intended for children should be concise, transparent and written in a child-appropriate style.

3. Health and support information

Information about health, disability, neurodivergence, allergies, medication or support needs may be considered special-category personal data under UK data protection law.

We collect this information only where it is relevant and necessary, for example to:

• Help your child participate safely
• Understand communication or sensory preferences
• Make appropriate adjustments
• Respond to a medical or safeguarding concern
• Protect the wellbeing of a child or another person

Where required, we will ask for explicit consent from the parent, carer or appropriate individual. In exceptional circumstances, we may use such information where necessary to protect someone’s vital interests or meet a legal or safeguarding obligation.

Special-category information requires both an appropriate lawful basis and an additional legal condition before it can be processed.

4. How we use personal information

We may use personal information to:

• Respond to questions and enquiries
• Process Holiday Club registrations and waiting-list applications
• Assess whether an activity is appropriate for a child
• Plan and deliver inclusive activities, events and workshops
• Provide appropriate support and adjustments
• Communicate programme dates, locations and availability
• Manage attendance and emergency contacts
• Process purchases, downloads, donations or refunds
• Deliver digital resources and activity packs
• Send newsletters and programme updates where permission has been provided
• Collect feedback and evaluate our services
• Improve our website, resources and activities
• Manage volunteers, staff and partner relationships
• Prevent misuse, fraud or security incidents
• Maintain appropriate administrative and financial records
• Meet safeguarding, insurance and legal responsibilities

We will not sell your personal information to another organisation.

5. Our lawful reasons for using information

Depending on the circumstances, we may rely on one or more of the following lawful bases:

Consent

We may rely on consent when you:

• Subscribe to marketing communications
• Give permission for photographs or videos
• Provide optional sensitive information
• Agree to a particular use of your information

You may withdraw consent at any time by contacting us.

Contract or steps before entering a contract

We may need to use information to process a registration, purchase, booking or request that you have made.

Legitimate interests

We may use information where it is reasonably necessary to operate, improve and protect our organisation and services, provided that these interests do not override your rights and interests.

This may include managing enquiries, improving our programmes, maintaining appropriate records and protecting our website.

Legal obligation

We may use or retain information where required to comply with applicable laws, financial requirements, safeguarding responsibilities or regulatory obligations.

Vital interests

In an emergency, we may use or share information when necessary to protect someone’s life, health or safety.

A privacy notice should identify the lawful basis relied upon because the chosen lawful basis can also affect which data-protection rights apply.

6. Holiday Club registration forms

Registration forms may request information about the parent or carer and the child being registered.

This information helps us:

• Review the registration
• Understand the child’s interests
• Identify relevant support requirements
• Communicate with the family
• Plan a safe and inclusive experience

Submitting a registration form does not automatically guarantee a place. Availability may depend on capacity, programme criteria, staffing and the suitability of the available activities.

Our online forms may be provided through a specialist form service such as Jotform. Information submitted through these forms may therefore be processed and securely stored by that service on our behalf.

7. Photographs, videos and children’s work

We may occasionally take photographs or videos at our activities or display examples of children’s creative work.

We will seek appropriate permission before using identifiable photographs, videos, names, stories or children’s work for purposes such as:

• Our website
• Social-media pages
• Promotional materials
• Programme reports
• Community events
• Funding or partnership communications

You may refuse permission without affecting your child’s ability to participate, unless photography or recording is an essential and clearly explained part of a specific activity.

You may also withdraw permission for future use by contacting us. We may not be able to remove materials that have already been printed, distributed or lawfully published by another organisation.

8. Email communications and marketing

We may send service-related messages when they are necessary to manage your enquiry, registration, booking, purchase or participation.

We will send promotional newsletters or general marketing updates only where we have an appropriate lawful basis, normally your consent.

You can unsubscribe at any time by:

• Using the unsubscribe option in an email, or
• Contacting us at [email protected]

Where enabled, our email platform may record limited engagement information, such as whether a message was opened or a link was selected. We may use this information to understand whether our communications are useful and improve future updates.

9. How we share information

We may share limited personal information with trusted organisations or individuals where this is necessary to operate our services.

These may include:

• Authorised staff and volunteers
• Activity leaders and programme facilitators
• Website and hosting providers
• Online-form providers, including Jotform
• Email and communication providers
• Payment-processing providers
• IT and technical-support providers
• Professional advisers
• Funders or delivery partners, where appropriate
• Schools, local organisations or activity partners, where permission or another lawful basis exists
• Insurers, auditors or regulatory bodies
• Emergency services, safeguarding teams, local authorities or law-enforcement agencies where necessary

Anyone processing information on our behalf is expected to protect it, use it only for the agreed purpose and follow applicable data-protection requirements.

We will not share identifiable information with funders, partners or researchers where anonymous or aggregated information would be sufficient.

10. Safeguarding and legal disclosures

We may disclose personal information where:

• We are required to do so by law
• We receive a valid court order or official request
• Disclosure is necessary to prevent or investigate a serious offence
• We reasonably believe that a child or another person may be at risk of serious harm
• Information is required by a safeguarding authority, emergency service or law-enforcement agency

Where possible and appropriate, we will inform the affected person before making a disclosure. However, this may not be possible where doing so could increase risk, interfere with an investigation or breach a legal obligation.

11. International data transfers

Some technology providers may store or process information outside the United Kingdom.

Where personal information is transferred internationally, we will take reasonable steps to ensure that an appropriate legal safeguard is in place. This may include:

• Transfers to a country recognised as providing adequate protection
• Approved contractual protections
• Other safeguards permitted under applicable data-protection law

12. Data security

We use reasonable organisational and technical safeguards to protect personal information from:

• Unauthorised access
• Accidental loss
• Misuse
• Alteration
• Disclosure
• Destruction

Measures may include restricted access, password protection, encryption, secure hosting, staff guidance and controlled access to registration records.

Access to sensitive information is limited to people who need it to perform their duties.

Although we take reasonable precautions, no website, email system or online transmission method can be guaranteed to be completely secure.

13. How long we retain information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected.

The retention period may depend on:

• The type and sensitivity of the information
• The child’s participation in a programme
• Safeguarding considerations
• Insurance requirements
• Financial and accounting obligations
• The possibility of a complaint or legal claim
• Contractual or regulatory requirements
• Whether consent has been withdrawn

When information is no longer required, we will securely delete, anonymise or destroy it.

UK privacy information should explain either the applicable retention period or the criteria used to determine it.

14. Cookies and website analytics

Cookies are small files stored on a device when someone visits a website. They can help a website function correctly, remember preferences and provide information about how visitors use the site.

We may use:

• Essential cookies required for the website to operate
• Preference cookies that remember selected settings
• Analytics cookies that help us understand how visitors use the website
• Third-party cookies connected with embedded forms, videos, payment services or social-media features

Where required, we will request permission before using non-essential cookies. Visitors must generally be told what cookies are used, what they do and why; non-essential cookies normally require consent.

You can manage cookie choices through our cookie banner or your browser settings. Disabling certain cookies may affect how some parts of the website operate.

15. Your data-protection rights

Depending on the circumstances and lawful basis being used, you may have the right to:

• Ask for a copy of the personal information we hold about you
• Ask us to correct inaccurate or incomplete information
• Ask us to delete personal information
• Ask us to restrict how information is used
• Object to certain uses of your information
• Request transfer of information in a portable format
• Withdraw consent at any time where consent is the lawful basis
• Complain about how your information has been handled

Children also have data-protection rights in relation to information held about them. Depending on the child’s age and understanding, a request may be made by the child or by a parent or carer acting appropriately on their behalf.

To exercise a right, email:

[email protected]

We may need to ask for information to confirm your identity before responding.

16. Complaints

Please contact us first if you have concerns about how we have used personal information. We will review the matter and aim to respond appropriately.

You may also have the right to complain to the Information Commissioner’s Office, the UK’s data-protection regulator. UK organisations are expected to tell individuals about their right to complain to the ICO.

17. Links to external websites

Our website may contain links to websites, services or platforms operated by other organisations.

This Privacy Policy applies only to Thriving Beyond the Label. We are not responsible for the privacy practices, security or content of external websites. Please review the relevant organisation’s privacy notice before providing personal information.

18. Changes to this policy

We may update this Privacy Policy to reflect changes to:

• Our activities and services
• The information we collect
• Our technology providers
• Legal or regulatory requirements
• Our safeguarding and security practices

The latest version will be published on our website with the updated revision date.

19. Contact us

For questions, requests or concerns about this Privacy Policy or the way we use personal information, contact:

Thriving Beyond the Label
Email: [email protected]