Privacy Promise

We use your personal information for the purposes set out in this policy, which include:

Family Support and Family Services

We support our families during the time when their child or young adult is attending our education, and/or residential care and/or additional services listed below.  This includes the application process, transition to joining our services, using our services, planning for next steps and transition to leaving our services. Additionally, we provide support at meetings, events, deliver training and manage bookings for the Family Flat.  

To Provide Education

Whilst providing education for our learners we manage attendance, education targets and achievements and accreditations, multi-disciplinary meetings, spending money management, and provide activities to further learning including work placements. We communicate with families, professionals and the child’s or young adult’s support network, which requires us to report to regulators, local authorities and the Department for Education  

To Provide Residential Care

While providing support and care we create plans, record achievements, provide activities and attendance, support with health management and monitoring, medication management and multi-disciplinary meetings. We communicate with families, professionals and the child’s or young adult’s support network, which requires us to report to regulators and local authorities.  

To Provide Health and Wellbeing Services

This includes health support management and monitoring, multi-disciplinary meetings, medication management and therapeutic services.  We also coordinate with external health services, for them to deliver their central health support. We communicate with families, professionals and the child’s or young adult’s support network, which requires us to report to regulators and local authorities. 

To Provide Health and Wellbeing Services 

This includes applying to use our services and creating support plans to access facilities, health and wellbeing services and transition to join our services. We communicate with families, professionals and the child’s or young adult’s support network, which may also require us to report to those funding the opportunities and local authorities.

To Provide Learning and Development Services for Customers and Staff

This includes delivery of professionals and individual training courses in our areas of professional expertise, both onsite and at other organisations, accessing apprenticeship programmes, supporting learner specific service delivery knowledge and skills. This also includes us working with accreditation bodies for certified training.

To Provide Sensory Support Services

This includes applications to access our sensory PLP education services, assessment services and reports, supportive intervention services delivered online and offsite. 

Organisational Support Services

This includes recruitment, onboarding, human resources support to staff, payroll and finance, Date Protection and Cyber Security services, IT managing your access and use of systems and facilities support. See the employee privacy notice, to understand how data is used for staff/authorised users 

For all services at Seashell we also manage compliments, complaints, incidents and safeguarding and Health and Safety Management. 

Marketing

We will market our services to you through our Social Media platforms, for you to make a choice if you require further information. We only send you emails and text messages where you have consented to this; and will not send you marketing if you have asked us not to. To withdraw your consent or opt-out from receiving marketing at any time please contact us. Please see Direct Marketing for further information.

Fundraising

We will fundraise with individuals, groups, corporate supporters and volunteers and work with our ambassadors to achieve this. We also apply to trusts and foundations for support usually to  develop new projects for the benefit of our students and residents.

Profiling

We combine data that you have provided to us with information from publicly available sources to:

• understand our supporters better, so we can send you information you are interested in, to predict how you might be able to help us in future, and to make sure we do not send marketing to vulnerable individuals, meaning we can raise money in an efficient and ethical manner
• to research where the greatest need for funding is.

If you would prefer that we do not carry out this type of analysis, please contact us. Please see Profiling for further information.

Philanthropy and Relationship Management

We research, and profile potential or existing high value donors, to allow us to identify and engage with suitable high value donors. This allows us to focus our fundraising resources, and to ensure that our requests for support are tailored to each individual, ultimately helping us to maximise the efficiency of our fundraising. If you would prefer that we do not carry out this type of analysis, please contact us.

Online Advertising

We promote our aims and activities online, including via platforms such as Facebook, LinkedIn, X (previously known as Twitter), Instagram and YouTube. We may ask a platform to show our adverts to a particular group of individuals. We may also track when individuals click on our adverts.

We never use special category personal data (e.g. health data) to target individuals, and we do not track responses of individuals clicking on our adverts specifically related to our Health and Wellbeing  services at Seashell.  We may target ads to individuals searching for SEND support, or our Health and Wellbeing service support.

For information about the other purposes for which we process personal information, please see How We Use Your Personal Information

If you have questions about this Privacy Promise or if you would like to exercise any of your privacy rights, please contact us by email at data@seashelltrust.org.uk or write to the Information Manager Change and Governance,  Seashell Trust, Stanley Road, Cheadle Hulme, Cheshire SK8 6RQ

Usually, we will be the 'controller' of your personal information. This means that we are responsible for deciding how your personal information is used and ensuring that it is used in compliance with applicable Data Protection law (in conjunction with other parties, where applicable).

If one of our partners (or another entity) is also a controller, this will be explained where appropriate. In this regard:

Additional Joint controllers are:

The Local Authorities that we collaborate with to provide the Education and Care for our service users, NHS to provide the health services we are commissioned to provide, Local Authorities – commissioned other services, Manchester United Foundation, Sport England, British Cycling.

Our website may include links to other sites, not owned or managed by us. We cannot be held responsible for the privacy of information collected by websites not managed by us. Any links that are to our suppliers of services accessed via the website, will have been validated as part of our relationship with them.

We may change our Privacy Promise from time to time so please check back periodically. This Privacy Promise was last updated in September 2024.

Personal information is any information that can be used to identify you.

• Personal details (name, date of birth, email, address, telephone, and so on) when applying for our products and services; Financial information (payment information and whether donations are gift-aided);
• Becoming a student or applying to live at Seashell (or being part of a child’s or young adult’s support network) – medical history, medical diagnosis, current prescriptions etc; and
• Your image for demonstrating achievements in any of our services. 

  If you are the parent /carer/ legal guardian or a member of a team around a child or young adult who uses our services, your details and contact information and your relationship with that child/ young adult will also be recorded.

Data Protection law recognises that certain categories of personal information are more sensitive. These are known as 'special category data' and include information relating to health, race, ethnic origin, political opinions, religious beliefs, trade union membership, genetics, biometrics (where used for ID purposes), sex life and sexual orientation.

We process this data to meet our legal obligations in employment, equal opportunities, and similar legislation.

Personal data relating to criminal convictions and offences (including allegations of the same) is also subject to extra safeguards.

Seashell is using the lawful basis of legitimate interests for photos including people, with the exception of:

Photographs / filming for identification and security purposes, health and safety purposes and learning, teaching, service assessment purposes. In these circumstances the lawful basis is ‘for the performance of contract’.

Where people will be named or quoted in the photographs / film, and it is not part of their contract with us, in this circumstance the lawful basis is consent. We only ask for consent where another lawful basis is not applicable and do so considering the additional requirements of current Mental Capacity Legislation.

We may collect personal information when:

• You give it to us, or we collect it from you, directly - for example, when you or your representative are applying for one of our services and any associated assessments, medical conditions, and history, if you are part of the network of support for a service user;
• When you sign up for one of our events or donate to us, and where you visit our website or open our emails, with your consent where necessary: please see Cookies and similar technologies;
• It is generated during your relationship with us. For example: volunteering with us, during your application process, during your time with us and after you leave us if we are approached for a reference/financial information, paying for a service being provided, or when you kindly support us in our fundraising;
• We can access the information, as legislation requires us to be provided this information to meet our legal obligations. We will therefore contact professionals supporting our service users to provide and professionally validate information provided to us for accuracy;
• You give permission to other parties to share it with us - for example, when you apply to join our Education/Care/Health/Sensory or Active Services - we contact designated healthcare professionals, previous service providers, previous education, and social care providers.
• Or when you have told an event organiser or participation registration platform that you would like to hear from us, or where a friend, family member or legal representative has contacted us on your behalf; or
• Your information is available publicly, for example, from Companies House or the Land Registry or is available from external sources such as Experian, or, depending on your privacy settings, from social media services such as Facebook, YouTube etc, press articles and internet searches.

Where we ask you to provide personal information to us on a mandatory basis, we will inform you of this at the time of collection and in the event that particular information is required by the contract or law this will be indicated. We will also explain the consequences of any failure to provide any mandatory information: for example, failure to provide us with your contact details will mean that we cannot provide a service, contact you, or failure to provide us with your payment details will mean that we cannot complete a transaction.

Apart from personal information relating to yourself, you may also provide us with the personal information of third parties, such as when you contact us on behalf of family about our services or send us photographs including other people. Before you provide such third-party personal information to us you must make sure that these third parties are aware that you will provide such data and of how it will be used by us, as detailed in this Privacy Promise. We may further contact them to seek clarification of the information and provision of further information.

You have a number of rights in relation to your personal information. You should note that these rights are not absolute, so we do not always need to comply with your requests, but we will make sure we explain our reasons to you if this is the case.

To exercise any of your rights, please contact us.

We may ask you to provide additional information to prove your identity, for example, to provide a copy of an identification document, before we allow you to exercise a right. This is for your security: we consider that we have a legitimate interest in ensuring that we only allow the correct individuals to exercise the rights to which they are entitled. This also aims to prevent fraudsters from accessing the information we hold about you.

We will respond to any such request within 1 month. If we cannot process a request, we will explain our reasons and let you know how you can challenge our decision. If you are unhappy with how we've dealt with your request or used your data, please tell us so we can rectify. However, if you are still unhappy you have the right to complain to the Information Commissioner’s Office (ICO). The ICO can investigate your claim and take action against anyone who has misused personal information. Please visit the ICO website or call the ICO helpline on 0303 123 1113 for further information.

You have the right to be informed about the collection and use of your personal information, and we are also required to ensure that we are transparent about how we use your personal information.

This Privacy Promise explains how we process your personal information.

You have the right to ask us to confirm whether we process any of your personal information, and to provide access to any personal information we do hold about you.

We aim to ensure that all personal information is correct. If any of the information that you have provided us with changes, for example if you change your email address, please do contact us so that we can keep our records up to date. We will update your records as soon as possible and in any event within one month.

You have a right to require us to correct any information about you that is inaccurate, and you may also ask us to remove information which is inaccurate or to complete information which is incomplete. We may seek to verify the accuracy of the personal information before rectifying it, and in some circumstances, we will need to keep a copy of the inaccurate data (for example, if we need to keep an audit trail).

If we do update inaccurate information, we will inform relevant third parties with whom we have shared your data so they may update their own records.

In some situations, you have a right to obtain your personal information from us in a structured, commonly used, and machine-readable format and reuse it for your own purposes, perhaps for another service, without hindering the usability of the data. This includes the right to require us, where technically feasible, to pass on information we obtained from you to another data controller.

This right applies when we are relying on your consent or the fact that the processing is necessary for the performance of a contract to which you are party as the lawful ground for processing, and we are carrying out processing by automated means.

You have the right to require us to erase your personal information in certain circumstances, for example:

• where it is no longer necessary for us to continue holding or processing your personal information for a particular purpose;
• if you withdraw your consent to certain processing (in relation to which we rely upon your consent as a lawful basis); or
• if you have objected to processing in relation to which we rely upon our legitimate interests, and we have no overriding interest, or that personal information is processed for direct marketing purposes (and this includes profiling to the extent that it is related to such direct marketing).

This right is not absolute: for example, we do not have to delete your data if we need to continue processing this information to comply with our legal obligations, or for the establishment, exercise, or defence of legal claims. We may also need to keep some information about you to, for example, comply with an instruction not to contact you again.

You have a right to ask us to restrict our processing of your information if:

• you contest its accuracy, and we need to verify whether it is accurate;
• the processing is unlawful, and you ask us to restrict use of it instead of erasing it;
• we no longer need the information for processing, but you need it to establish or defend legal claims; or
• you have objected to processing of your information being necessary for the performance of a task carried out in the public interest, or for the purposes of our legitimate interests. The restriction would apply while we carry out a balancing act between your rights and our legitimate interests. If you exercise your right to restrict processing, we would still need to process your information for exercising or defending legal claims, protecting the rights of another person or for public interest reasons.

This is an alternative right to the right to be forgotten and it is not an absolute right.

If we rely on consent as the legal basis for processing (see How We Use Your Personal Information?) you can withdraw your consent to that purpose of processing, and we will stop that particular processing.

However, we may still continue to use the same data for other purposes: for example, you withdraw your consent to receipt of direct electronic marketing from us, and also make a complaint, we may rely on our legitimate interests to process your personal information in order to investigate that complaint

You have the right to object to: processing that is based on legitimate interests or performance of a task in the public interest (including profiling); direct marketing (including profiling for the purposes of direct marketing) and processing for the purposes of scientific, statistical or historical research.

We must comply with any request to stop processing for the purposes of direct marketing. The right to object is not absolute in relation to processing for legitimate interests and research purposes.

If you would prefer us not to profile you for the purposes of targeting or tailoring our fundraising efforts, please contact us.

To make sure that we always have the most up to date information about you, we may from time-to-time request that you confirm your personal details in the records that we hold.

• to use this directly for your care, health, and education;
• to keep you safe fit and well using our facilities and services;
• to manage the services we provide, to audit and quality assure, investigate complaints, or to be used as evidence as part of any investigations;
• supporting the external organisation assessments for funding for Education/ Social care etc

From time to time we may contact you in relation to specific operational matters. For example, we may contact you about a query or complaint that you have raised, or waiting for an item to be provided, or to remind you that we will call you back. Depending upon how you have contacted us, we may get in touch via phone, post, email.

We rely on legitimate interest to send you this type of communication

At this time, we do not share any data for planning or research purposes for which the national data opt-out would apply. We review all of the confidential data subject information we process on an annual basis to see if this is used for research and planning purposes. If it is, then individuals can decide to stop their information being shared for this purpose. More information is available at https://www.nhs.uk/your-nhs-data-matters/ 

Data Security and Protection Toolkit

This is completed annually, and Seashell status can be found here: https://www.dsptoolkit.nhs.uk/OrganisationSearch

Research

At present we do not collaborate on health or education research activities.

We do however conduct impact assessments, and produce reports related to our work, and sometimes to demonstrate the difference larger funding donations have made. We may contact you for comments and permission for the use of specific images to use in these reports. When you opt to take part in one of our impact questionnaires you may give consent for your personal data to be used in the report. We have guidelines in place to look after your data in accordance with applicable Data Protection requirements, when creating these reports.

Partnerships

At present we are working with British Cycling, The FA, Greater Sport, Greater Manchester Local Pilot. Where we work together the processing of data where anonymised will be done so in Legitimate interest, or for certain aspects we will seek your consent to collect and process data.

Impact Reports

Where we have received a larger donation, or when working with a National Governing body, Trust Funds - we work together to produce an impact report to demonstrate the use of investments at Seashell.

If you make a donation or payment directly to Seashell or use one of our third party payment processors such as Blackbaud Payments, Just Giving Worldpay, TYL, Stripe these payment processors will receive certain  personal data (for example, your name, address and card details, amount ) to allow them to process your payment, and will also provide us with some of that information to allow us to match you to your transaction, your name and amount of payment. This is necessary for our internal accounting, administrative and record keeping purposes. We may also share information with, or receive information from, these payment processors, as required to resolve any technical issues. All our payment processors are PCI DSS compliant. We never hold your card details. These payment processing providers also have their own terms and conditions or privacy policies, which they will share with you at the time you make your payment.

We have a legal obligation to keep records of transactions for tax purposes, and also to keep records of Gift Aid donations. We have a legitimate interest in being able to accept payments and donations, as this funding is vital to allow us to continue to support, also to keep records of donations made to allow us to identify how engaged individuals are, as this allows us to ensure that our fundraising is effective.

Payment Invoicing

For some services we issue invoices to collect payment. The payment terms for monies owed by invoicing is 30 days. We will contact you as part of our legitimate interests to receive and follow up the payment of monies owed.

We may also use your personal information for our own internal purposes. This includes to allow us to manage our IT systems (and to test / develop new systems), for internal training, reflective practice, professional development or to deal with legal claims or other issues, for statistical analysis, research and service development, for security and access control, accounting, internal recordkeeping and auditing purposes.

In general, we consider that we have a legitimate interest to ensure that our internal processes are managed efficiently, and to ensure that we have the people, skills and systems in place to allow us to support individuals we support to the best of our ability (our core aim).

We may also process your personal information where we have a legal obligation to do so, such as for VAT record keeping purposes, or where we consider we have a legitimate interest in, for example, co-operating with law enforcement, regulators or the like.

Some areas we would like to draw your attention to are Health and Safety, Safeguarding, SEND Care and Education provision, Data Protection, Cyber Security and Caldicott Principles.

Due diligence for donations – right to refuse policy, money laundering, reputational risk

We consider that we have a legitimate interest in investigating suspected or alleged frauds, both inside and outside of the organisation. To the extent that such processing involves criminal offence data, we consider that this is necessary in order for preventing or detecting unlawful acts or to comply with regulatory requirements relating to unlawful acts or dishonesty.

Examples include investigations into false fundraising events, stealing collection boxes, interfering with banking (e.g. intercepting cheques or changing bank details), and stealing equipment.  Legal obligations for money laundering – Know Your Customer- identification.

Internally, we may also investigate issues such as misuse of credit cards, inflating business expenses, or diverting electronic payments to incorrect bank accounts.

We may report our suspicions, any allegations and/or the results of our internal investigations to the police.

We also hold information about you so that we can respect your preferences for being contacted by us. You can update this at any point. Contact us

Profiling means gathering information about an individual or a group of individuals and analysing their characteristics or behaviour patterns to place them in a certain category or group, and/or to make predictions or assessments about their ability to perform a task, their interests or likely behaviour.
We believe that we have a legitimate interest in profiling supporters and potential supporters as explained below. Profiling allows us to understand our supporters better, so we can send you information that you are interested in and is relevant to you and predict how you might be able to help us in the future, to make sure we don’t send marketing to vulnerable individuals, and to raise more funds, sooner, and more cost-effectively, than we otherwise would. It allows us to be more efficient with our resources, which donors consistently tell us is a priority for them, and to assess and improve our services more generally.

We will also use profiling to identify which areas of the UK have a particular need for our external service support, and we consider that we have a legitimate interest in carrying out this analysis to help us target our support to those areas where it is most needed.

Please see the section on online advertising for information about how your personal data may be used in this context.

If you would prefer us not to use your personal data in this way, please contact our Information Manager Change and Governance,  contact us

In order to create a profile of you, we may use the information which you give us and which we collect from external resources, such as social media, including information that is publicly available about you. We may also combine your information with data already held internally by us.

This information may include:

Information you give us/ we collect from you such as name, age, gender, address, donation history, the events, campaigns and products you have engaged with, the results of any surveys you have completed for us, your volunteering status and any previous categorising of your interest areas.

Information from external sources such as age, gender, property prices and average earnings where you live, your job, directorships, your financial circumstances, networks, any previous donations you have made, your philanthropic interests (trusteeships and/ or support to other charities), and your estimated wealth.

For example, if you support us, we may match your postcode to get information about you which market section you fall into (which includes categories such as household income band, household composition and other demographic information).

Categorising of your interest areas

We may also use this information to help us determine whether and in what ways you might be interested in getting involved in our other fundraising activities.

Profiling allows us to understand the background of the people who support us and use our services and helps us to:

• ensure communications are relevant and timely, and to provide an improved experience to our supporters, for example, to send information about campaigns and services in your area (with your consent, where required);
• find potential new supporters and invite them to be involved in supporting our cause.
• determine whether and in what ways you might be interested in getting involved in our other fundraising activities;
• better tailor our services to our supporters, for example by sending tailored communications which may be of interest to you, and making appropriate requests to supporters who may be able and willing to give more than they already do; and
• to exclude people who may be vulnerable from marketing, for example minors, any adults who are identified as vulnerable.

High value donors

We identify potential high value donors by:

• Carrying out research on donors who have given £5,000 or more to us;
• Asking our existing high value donors to give again;
• Inviting potential high value donors to attend our supporter events as a way of engaging them with us. We also identify potential new donors by researching event attendees who were previously unknown to us;
• Researching people who have not given to us in the past but who we believe may have a connection to our cause and have the capacity to give at a high level;
• Asking our donors and influencers to open up their networks to us; or
• Asking our donors and influencers to introduce us to potential donors we have identified through our research and that they have a link to.
• Our initial research is undocumented and involves some basic checks looking at publicly available information, e.g. using Google, a public LinkedIn profile and Zoopla.

We do not process special category data at this stage, unless the individual in question has manifestly put it in the public domain (e.g. have themselves given interviews to media outlets or published articles/ public blog posts revealing this information). Fundraising teams do not have access to any information given to Seashell Health, Sensory, Education and Care teams and we never use this information in any research into potential high value donors.

Creating Research Profiles

If our initial research is promising, or if someone has donated £5,000 or more to us, we will create a research profile of the individual using information sources such as, Internet searches, Companies House, The Charity Commission, Social Media platforms.

We also use these information sources to identify potential new donors who have previously given at a high level and may have an interest in our cause (e.g. we would search for someone who would be a good fit at a 'Women of Influence' event being hosted in Stockport). If we discover that someone in our network knows a potential donor that we have identified, we might ask them to facilitate an introduction.

We sometimes ask existing supporters whether they would be prepared to open their networks up to us. An existing supporter may tell us about an individual previously unknown to us and facilitate an introduction. In this scenario we would advise our existing supporter about our data responsibilities and ask them to ensure that the individual in question is happy for an introduction to take place. Following the introduction, we would direct the individual to this Privacy Promise and ask them to confirm how they would like to hear from us.

In the two scenarios above, we may create a research profile on someone who we have never had any contact with before. In this case our facilitator will work to make the initial contact, this may take up to two years, during this time our team will regularly make contact with the facilitator for updates, and if the introduction does not happen during this time period then we will delete the profile.  If the introduction is successful, we will within 30 days tell the person about this Privacy Promise, and we will seek to gain their consent to continue the relationship.

After we've created a research profile, we score potential donors under each of the following headings:

• Ability;
• Interest; and
• Links that they have to our purpose

These scores are an estimation of an individual's capacity to give to us, their interest in giving to us and any links they have to our purpose. This helps us to prioritise our resources and develop more relevant funding proposals as we seek to generate support for Seashell and the work we do.

Lawful grounds for processing

We rely on legitimate interests as our lawful basis for identifying, researching, and otherwise processing the personal data of our potential high value donors as set out above.

If an individual tells us directly about their own health details or shares any other special category data with us, we would only capture this data when we have their consent to do so.

Our Relationships team foster long term relationships with our existing and potential donors. However, we are committed to only keeping data on individuals with whom we have an active relationship. We therefore remove the data captured in the ways described above if the existing or potential donor has not interacted with the team in the previous two full calendar years.

In all our donor acquisition work we follow our Due Diligence policies and Ethical Fundraising policy.

Online Identifiers

We do currently use cookies, and you are able to consent to which can be active. We are not responsible for cookies on any sites that are signposted from our sites unless they are our supplier.  See Cookies and similar technologies;

For all individuals that connect to Seashell systems we record device information, for example the MAC address and IP address, and device name that has been given.

To contact you and to promote our cause, this does not include any operational emails when using our services.

When you receive an email from us, we may receive certain information about how you interact with that email.

The information we collect includes the number of times you have opened the email; if you have clicked links in the email or read it.

We use this information to assess how successful our email communications and campaigns are; to identify what you are interested in and target further marketing campaigns more accurately; to potentially reduce the frequency with which we contact you if appropriate; and to remove you from our mailing lists where you have asked to unsubscribe.

We use an email service provider through Raiser’s Edge, and our Sports system Legend to do this.

Lawful basis for processing: We consider that we have a legitimate interest in carrying out email engagement tracking as this ensures you do not receive irrelevant or unwanted emails, as well as allowing us to use our resources and fundraise efficiently.

Sometimes we may send you communications about our work and how you can help us, for example, information about our campaigns, volunteering, fundraising activities and how you can donate to us. We may also get in touch to tell you about services available to you at our site or online. Occasionally, we may include information from partner organisations or also include other organisations who support us.

We will only send you marketing information electronically (e.g., by email or text/SMS) if you have specifically agreed to us doing so. We rely on consent for this processing, and you can withdraw your consent at any time by clicking the 'unsubscribe' link in any of our messages to you. We use our Raiser’s Edge and Legend systems to send marketing emails.

We may send marketing information by post or call you for marketing purposes, unless you have previously opted out or said that you don't want to be contacted. When we use an external provider to send postal mailing they will  ensure that our address records are accurate and up to date, and to stop mailings to people who have died. We rely on legitimate interests for this processing, as we consider that we have a legitimate interest to promote Seashell’s work and opportunities to potential and actual supporters.

You can change your marketing preferences at any time by emailing data@seashelltrust.org.uk  or calling us on 0161 610 0170.

If you ask us to stop sending marketing information, we will update our records to stop further mailings as quickly as we can. However, you may still receive further mailings which were already in progress before you asked us to stop.

Please see the section on Profiling for further information about how we decide what marketing to send to whom.

We advertise on Meta and Google as well as some other online platforms and other websites. For recruitment via LinkedIn and other profession specific sites.

We differentiate and manage differently our online advertising activities between promoting and supporting our fundraising events and making information available to about Seashell.

There are various ways that you may see our online advertising:

Advertising on particular types of websites - for example newspapers and magazine websites. This is 'contextual advertising' - we buy space on these websites and our adverts are shown based on other content displayed on the page: it is not targeted to particular individuals.

Advertising to people signed up with an online platform (such as Facebook) based on what the platform knows about them, e.g., we may ask Facebook to show a particular advert to people interested in running events living around Stockport. We also use this method to promote general awareness of Seashell fundraising and information about our services available for people that we work with. In the latter case we do not track individual responders, we collect how many people clicked through to our information so that we understand whether our advertising and communications are effective. We do not target individuals based upon any special category personal data.

If you click to accept cookies for advertising, the information stored in these cookies may also be used to: create a 'lookalike' or 'similar audience' of people with similar interests and characteristics to the group of people who clicked on the same thing; or to send a remarketing message to you about the same thing you clicked on before. This helps us to ensure that our digital advertising campaigns are as cost-effective as possible. We only use this method for our fundraising campaigns. We rely on consent for this processing.

We track people's interactions with our adverts so that we know when an individual has clicked on an advert. This allows us to measure the effectiveness of our campaigns, and in some cases (as explained above) to make sure you see more adverts which are relevant to you. We do not track the responses of individuals clicking on our adverts offering support to our health services.

We have a strict policy for approving cookies and similar technologies and will never permit cookies that collect any special category information. We do not share special category data with external companies such as ad tech providers or media brokers for targeted digital advertising purposes.

For more information on our use of cookies please see Cookies and similar technologies; and how we use cookies.

We keep a database of journalists, which includes contact details and employers.

We believe the privacy impact on journalists is small and we only use this information to build relationships with journalists who can help us to promote our charitable aims.

We rely upon our legitimate interest in promoting our charitable aims for this purpose.

Our Media Relations Policy outlines how and when we work with media for the purposes of promoting Seashell and it's work.

If you choose to donate to us using Gift Aid, we ask you to complete a Gift Aid declaration which includes your name, home address, and a statement that you have paid at least the donation amount in Income Tax or Capital Gains Tax in that tax year and agree to Gift Aid being claimed. We rely on your consent to process these Gift Aid declarations.

We are required by HMRC to collect the information in this form in order to allow us to reclaim Gift Aid on your donation and are legally obliged to keep a record of all declarations for minimum six years.

Where our charity is potentially the beneficiary of a legacy, we will obtain the names and contact details of executors, a copy of the will, and a grant of probate. We may also obtain contact details and data, including special category data such as health data, relating to other beneficiaries and third parties in order for us to engage in relevant correspondence to secure payment of a gift.

We consider that it is in our legitimate interests to take all steps necessary to ensure the safe receipt and follow specific instructions related to the gift, and its’s use by us in accordance with the donor's wishes to allow us to continue our work.

Keeping this information enables us to communicate effectively with people potentially planning on leaving legacies, or the families of those leaving legacies.

Our Trustees have a legal obligation under the Charities Act 2011 and Trustee Act 2000 to take necessary steps to ensure full payment of legacies and to ensure all funds gifted to Seashell are used to support those accessing our services.

See How long we keep data

When you sign up to participate in one of our fundraising events, (or if you are part of a team, a representative signs you up), we will ask you to provide certain information so that we can confirm your place and send you information about the event. To claim Gift Aid (if you choose to donate in this manner). We may also ask you for health information, for example whether you have particular dietary or access requirements.

For special events, such as Seashell dinners or balls, we will be the organiser and the controller. For some events (e.g., challenge events where you are raising sponsorship for us), we may take registrations on behalf of the organiser. When you are registering for these events, we will make it very clear who is the event organiser and if we are sharing the information you provide with the event organiser.

When you pay to enter an event, we may work with payment processors such as Worldpay/Tyl /Stripe/PayPal/ Blackbaud Payment processing who process your payment on our behalf, or you send us a cheque, pay by cash or make a direct payment. We never store your payment details, although we will receive certain information from payment processors to allow us to match you to your transaction.

If a third party is organising the event, then we will share your details with that third party, or you will have applied for the event yourself with them.

If you have also chosen to donate to us through giving platforms and agree to Gift Aid, your full name and home address, and details of your donation will be shared with HMRC: if you do not provide this information, your Gift Aid declaration will be invalid.

Please see the sections on Payment Processing and Gift Aid for further information.

Depending on the event, we may rely on performance of a contract or your consent to process your information to enable you to take part in the event, and to claim Gift Aid. We also rely on explicit consent where you provide us with health information, for example, to allow us to meet any special dietary or access requirements you may have.

We rely on our legitimate interest in raising funds for processing payments and for sending you information about the event.

When you make a donation to us, we ask you to provide certain information so that we can process your donation (including setting up a direct debit or Standing order where you choose to do so), claim Gift Aid (if you choose to donate in this manner), and, if appropriate, add you to our marketing lists please see the section on direct marketing.

We work with payment processors such as Worldpay, Blackbaud Payment processing/TYL/Stripe, Just Giving (for one-off transactions) and Committed Giving (for regular direct debit transactions) who process your payment on our behalf. We never store your payment details, although we will receive certain information from the payment processors to allow us to match you to your transaction.

If you have chosen to donate to us through Gift Aid, your full name and home address, and details of your donation will be shared with HMRC: if you do not provide this information, your Gift Aid declaration will be invalid.

We rely on your consent to claim Gift Aid, and on our legitimate interest in raising funds for processing payments. Please see the section on Processing Payments and Gift Aid for further information.

If you make a donation of over £5,000, we will provide your name to the Relationship Team who may carry out some basic research on you from publicly available sources such as Google, Zoopla and LinkedIn, to determine if your profile is of interest for our Relationship programme. This research is undocumented, and it does not include searching for sensitive data or on social media platforms. We rely on our legitimate interest in identifying suitable high value donors for this processing activity.

If you make a high value donation, we will conduct additional due diligence on you, and may also profile you as part of our Relationship programme (unless you have let us know that you would prefer us not to do this). This applies to donors who make donations of £10,000 - £99,999, as well as for prospects who we are close to contacting for a donation within the same range.

It also applies to any donor, potential donors, volunteers or sponsors where there is a low-level public association with Seashell (e.g. where their name is mentioned in our Annual Report, or where the individual is a secondary sponsor of an event. We may also refresh our due diligence for previous donors.

We conduct due diligence because we have a legal obligation to ensure that we are compliant with money laundering law. However, we carry out further due diligence to ensure that there are no reputational or ethical risks associated with the donor or the donation. We consider that we have a legitimate interest in ensuring that our charity is not associated with persons or causes which could affect our reputation or contradict our values. Further details are included in our Ethical Donations Policy, and Gift Acceptance Policy.

When and to the extent that we process Criminal Offence Data or Special Category Data, we will usually rely on the fact that you have manifestly made your information available in the public domain, or if you have provided us with your explicit consent to process such data.

Seashell as a charity has an obligation to assess the types of donations covered by the legislation /tainted charity donation rules these include Gift Aid donations, payroll giving, gifts of trading stock, and gifts of shares and securities.  

Additionally we have a responsibility to address ethical issues associated with fundraising and to comply with the Fundraising Regulator, to determine whether Seashell should be involved in opportunities connected with accepting donations, grants, sponsorships, or other partnerships. 

For these purposes therefore we collect donor information to complete our due diligence. 

A legacy gift is where someone leaves a donation in their Will to Seashell. This is a legal obligation and can be done in numerous ways. They can give in their Will in two ways, either a pecuniary gift which is a specific value or a residuary gift which is a percentage of their estate after they die. 

Where you make bid via a third-party auction site or sales platform Seashell will again be a controller of your personal data, but the relevant auction site or sales platform will also be a controller of such data, and you should refer to their privacy policies for information about how they use your personal data.

We ask you to provide certain information so that they can process your payment and we can arrange delivery of your items either obtained via a fundraising event or purchased via our education services – if you do not take the item away at point of purchase.

You may also provide personal information directly to us when you get in touch for help with queries about the purchase of items from fundraising events e.g., refunds, complaints, etc.

If you choose to make a Gift Aid donation, then we will share your Gift Aid declaration and the information it contains with HMRC.

We work with payment processors such as Worldpay, Tyl, Blackbaud Payment Processing, Just Giving, Committed Giving, who process your payment on our behalf. We never store your payment details, although we will receive certain information from the payment processors to allow us to match you to your transaction.

Please see the section on Payment Processing and Gift Aid for further information.

We rely on performance of a contract to process your personal information in order to fulfil your order. We consider that we have a legitimate interest in providing our customers with support, for example to let you know if your order has been delayed.

When you enter the lottery that Seashell participates in Sterling lotteries will process your data, check eligibility to participate and administrative tasks. They also provide your details to us where you have consented to hear more from Seashell so that we may also send you marketing communications in line with your communication preferences.

When you enter our raffles/lotteries or prize draws we will process your data to send out prizes or complete other administrative tasks.

We have a legal obligation to check that you are old enough to enter these activities, and to retain certain information relating to them to satisfy our recording keeping obligations to the Gambling Commission and HMRC.

In relation to raffles, we rely on performance of a contract to process your information and to subscribe you to the raffle. We rely on legitimate interests to process your payment. Please see the section on Payment Processing and Gift Aid for further information.

In relation to prize draws, we rely on legitimate interests to process your information, including to enter you into the prize draw and to notify you if you have won a prize.

You may contact us about our lotteries, raffles and prize draws.

We also work with payment processors such as Worldpay Blackbaud Payment Processing, TYL, Just Giving, Committed Giving, PayPal who process your payment on our behalf. We never store your payment details, although we will receive certain information from the payment processors to allow us to match you to your transaction. Please see the section on Payment Processing and Gift Aid for further information.

When you sign up to an event, service, training course or webinar we collect personal information from you to assess whether you are eligible and then to register you and to provide information about the course/event or webinar.  Also, if applicable to allow you to reclaim your expenses incurred in attending the course. We also regularly review who is signing up for our events/courses. We may also, if appropriate, add you to our marketing lists with your consent (please see the section on direct marketing) so that we can send you information about other training courses or Seashell events in the future.

Examples of services we provide include Training: MSI Intervenors, Tactile Communication, CHARGE, Usher, Positive Looking British Sign Language (BSL) , Sign along, First Aid,  Sleep and Supporting Autistic Students in Educational and Residential Provisions, Autism Awareness training. Examples of events include Family Services Webinars to support SEND families /Active – all of our sports facilities and courses.

Some of the events/courses we offer are free to attend if we have managed to source funding.

If we are using an independent training provider, we will manage the attendance and only share your information with them for certification if applicable. It will be clear when you sign up who this training provider will be. We will manage your attendance at alternative venues.

We sometimes use third party company event registration tools (e.g. Legend) and online survey tools such as Survey Monkey. Please check their privacy terms and conditions as some, such as Eventbrite, also collect certain information for their own purposes (such as their own marketing), and Seashell does not have control over this.

We usually rely on performance of a contract to book you onto the training course and to provide you with the details that you need to prepare from the course (unless there is no contract with you in which case, we rely on our legitimate interests in increasing knowledge about the services we provide, or your consent). We rely on legitimate interests to evaluate who is doing the course, and to assess the impact we are having, as it is important to us to understand how we can provide the best service possible.

We may also collect information about your reasonable adjustments, food allergies where events involve meals, support for your learning. This may involve us collecting and processing special category data, for example, if you tell us, you have an allergy, or a health condition which requires us to make special arrangements. Where we process this type of information we rely on your explicit consent.

We have specific Bursary schemes that can be applied for in Education and Care. We rely on your consent to provide us with information to enable us to assess your eligibility for a finding including your explicit consent where we process your health data as part of this process.

If we do pay the bursary to you, we rely on our legitimate interest to retain your information: we need to keep records of who we make payments to as this is necessary for keeping efficient financial records.

If we believe that you may be eligible for a charitable grant from another organisation, we will signpost you to that organisation to apply.

Trust Funds

Sometimes we apply for funding for the benefit of an individual, this is usually for equipment that will be used for their time at Seashell and will then remain to be beneficial to others.

The information we collect and then provide may vary depending upon the funding being applied for. In addition to the name, contact details of the individual we will sometimes need your health and diagnosis details we rely upon your consent.

We also apply for funding to Trusts for groups of individuals who may benefit from funding if we are awarded it. When we do this, we anonymise the information about you, if we use any images as part of the application these are not identifiable in the application made.

Visitor registration

Upon arrival we will collect your name, care registration, company name if applicable and you will be issued with a badge. If visiting our homes or education buildings a record of you being in that building will also be made.

CCTV

We have CCTV cameras onsite at Seashell, so you may be captured on CCTV. These cameras are managed by our IT team. Access to these images is strictly limited, and they overwrite any images every 14 days, unless they are required to retain a copy for longer in specific circumstances, this is explained in our CCTV policy.

We rely on our legitimate interest in ensuring the safety and security of our visitors and staff, and of our assets, when processing CCTV footage. CCTV footage may be shared with law enforcement where we have a legal obligation or a legitimate interest in doing so (or, occasionally, with other individuals and authorities where we have a lawful basis for doing so).

As a participant

Where our facilities have been hired by an organisation, they are responsible for the data collection and processing for your activities onsite. Seashell will only collect information should we need to be notified about Health and Safety reportable incidents related First Aid incidents, safeguarding incidents, data breaches/security incidents. If you connect to our Wi-Fi service whilst onsite your device and contact details will be processed by Seashell.

As a hirer

Seashell will collect the relevant information to make the booking and use our facilities safely and securely. If required as above you will share specific accident, incident, data breaches, security incidents. If you connect to our Wi-Fi service whilst onsite your device and contact details will be processed by Seashell.

As our customer (if you are using our Active sports facilities)

You will have booked your participation via our Legend Booking system, and we rely on performance of a contract to provide these services, or consent that you have provided to marketing our services to you. We rely on Legal obligation to process any Health and Safety, Safeguarding data.

When you contact us, whether by telephone, email, letter, or social media, with a query or a complaint/compliment, we will collect certain personal information from you (including contact details and why you are contacting Seashell).

We use this information to provide you with advice and support, to find out the answer to your query (if we don’t already know), or to investigate your complaint (as appropriate), pass on your compliment, and also to create a record on our systems so that we have this available if you contact us again, and so we can follow up in relation to any outstanding issues. This is done in line with our Compliments and Formal complaints policy and procedure.

We will usually rely upon our legitimate interests for these purposes: we believe that we have a legitimate interest in advising and supporting persons accessing  Seashell and our services, including by providing information, and in ensuring that any queries and complaints are quickly and appropriately dealt with as this is important for maintaining our reputation, which is important if we are to continue providing these services and developing related ones.

We have our website and online resources including our YouTube channel, closed Facebook group for families and supporters to access.

Our Communications team may also collect information where you have publicly posted about us on social media, or recruitment boards, and respond to these. This also includes where we work in partnership with other organisations, we will onward share and respond to posts.

Please remember that when you post personal information on social media, recruitment boards, your information is publicly accessible. Such information can be viewed online and collected by third parties. We are not responsible for the use of information by such third parties.

When contributing to a discussion we strongly recommend you avoid sharing any information that can be used to identify you (such as your name, age, address, name of employer). We are not responsible for the privacy of any information that you post.

We have the right to disclose your identity to any third party claiming to own any content that you post or send.

When you are invited to join the group we can view certain information about you e.g. name, contact details, age, gender. In the group we moderate and respond to questions and queries raised in the group, this also provides you with a parent/guardian forum to make contact with other Seashell families. As this forum is moderated any personal data contained in your posts may be processed as part of the moderation process. Our Social Media policy provides further details on this.

If there are specific service user queries these will be dealt with on an individual basis, with the Family Services team making contact with you to support, outside of the group.

We rely on performance of a contract for participation in the groups and for moderating your posts.

If you choose to post any special category data (such as health data), we consider that you are manifestly making such information public.

If you post a comment about Seashell on other platforms we may respond publicly to your comments, and then seek to engage with you to help or further answer questions. We do this by your consent to agree to contact us via our email  info@seashelltrust.org.uk

We operate various social media accounts across multiple platforms (Facebook, X previously known as Twitter, Instagram, LinkedIn, YouTube) in order to bring to your attention to our various services and events. When you interact with our social media (for example, by liking or sharing our content, or posting a comment), we may collect personal information from you including your username, as well as any posts you make on our platforms. We also moderate your posts.

If you message us privately via social media, we collect an explicit consent for our processing of special categories of data.

Please note that any relevant platform will also act as a controller in relation to information you post please see their privacy policy for information about their use of your personal information. For example, Facebook’s privacy policy is available at Meta Privacy Policy – How Meta collects and uses user data | Privacy Centre | Manage your privacy on Facebook, Instagram and Messenger | Facebook Privacy  LinkedIn: LinkedIn Privacy Policy

The way we behave on social media, both as Seashell and as individuals employed by Seashell, is outlined further in our Social Media Policy, which includes Online Safety.

Sometimes we will pay the social media platform to promote our online posts further. We do this in line with our approach to Online advertising.

Donations on social media

By us using Facebook and in partnership with agencies such as Social Sync, House Digital for our challenge fundraisers you can participate in an event and make donations to Seashell.

Some social media platforms offer their subscribers the opportunity to donate to charity. If you create a fundraiser, or in memory of... for Seashell and your profile is public. We may use this information in order to suggest ways to contact us about your fundraising and (where privacy settings allow) post a public thank you message. If your followers make a public donation through a social media platform we may collect this information upon request from the fundraiser, in order to send you a thank you message and/or process your Gift Aid if you have kindly also provided that.

We consider that we have a legitimate interest in processing your donation, in contacting you about your fundraising, and in thanking you for any donation that you may make.

If you have any questions about Fundraising please contact the team on 0161 610 0170.

Seashell uses cookies (and similar technologies such as tags) on our website and other software solutions including social media, email solutions, booking and communication systems. We do this to  ensure  the website social media and communication channels work effectively, gives you a more personalised interaction with our service by providing more personalised experience, sometimes including advertising and to help us to have insight into the effectiveness of our content (for example, to establish how many people saw, opened or liked certain content). Please see the section on Online Marketing for further information.

When you first visit our website, social media and communication channels you will be able to consent to set cookies (and any personal data collected by these cookies) where these are not strictly necessary to make our pages work: you will be able to set your preferences at this stage.

Where cookies are strictly necessary, we consider that we have a legitimate interest in processing the personal data they collect, as having a working website, social media and communication channels is vital Seashell.

You can at any time amend your consent by clearing cookies from the cache in your computer and rejecting them next time you access our website and software solutions.

We may also use similar technologies/tags to identify when our emails or social media direct messages are opened when you have agreed to participate in an online event. This allows us to identify whether our marketing/fundraising campaigns are effective, and we consider that we have a legitimate interest in doing so.

For more information about our use of cookies and tags, different types of cookies, the information they collect and further information about how you can control the types of cookies that are placed on your browser, please see How we use Cookies.

Individuals

When you commence your individual Volunteering journey via our website, we collect initial information to progress your enquiry. Once we have identified if we can support your request to match our opportunities you then create your volunteering profile.

To set up this profile you will need to provide, name, address, date of birth, emergency contact details, references. Please note that we will ask for the references and details to process and DBS check, and to follow Safeguarding onboarding process.

When you apply for a specific volunteering opportunity, we will collect additional information about you to process your application and to allow us to support the placement opportunity. The information will vary depending on the role, but this will always be clear from the opportunity description.

Additionally, then if you agree, we will use your contact details to keep in touch with you about Seashell. Please see the section on direct marketing for further information.

For some roles, we provide mandatory and/or specific training: we record attendance at training sessions/completion of online training as we need to make sure that all our volunteers have received appropriate training for any role they are undertaking. We will also record information about your volunteering journey with us.

If you choose to reclaim expenses associated with your role from us, we will process information about any expenditure, including amount and type of expense, as well as your name and bank account details, in order to determine whether your expenses should be refunded and to make any resultant payments to you.

We consider that it is in our legitimate interests to process your personal data in connection with your volunteering journey with us as described above, as this helps us to support our people. The above information is stored in our volunteer database, Kinetic and in our internal SharePoint.

Group volunteers

If you are volunteering as part of a group from a company/ organisation we will collect information that is required to support your visit on the day – car registrations, name, email address, Health and Safety information – group risk assessments etc.

Again for this we consider that it is in our legitimate interests to process your personal data in connection with your volunteering opportunity with us as this helps us to support you and our people onsite.

Health and Safety information – for specific risk assessments that we need to put in place to safely accommodate the volunteering opportunity. We have a legal obligation to support our volunteers and rely on this lawful basis to the extent applicable.

If our processing goes beyond our legal obligation to support our volunteers, and in relation to other processing, we rely on our legitimate interest.

If you are an individual or group volunteer and have agreed to hear more from us when commencing your participation, we will contact you as you will have provided your consent to do so. Please see the section on direct marketing for further information.

We process various personal information that you provide to us in order to support you as one of our volunteers, to run an effective committee, to ensure that the activities of the committees are legally compliant, and suitable governance is in place to ensure that we effectively deliver our services effectively manage funds donated and to safeguard our assets.

As a governor/trustee you may also receive information from our services and other ways you can help, including opportunities to donate, volunteer or fundraise, we rely on Legitimate Interest for this, unless you have provided consent (please see direct marketing)

As some of the Social Media platforms do facilitate children over the age of 13 to be able to sign up to and use the platforms. We will not include anyone under the age of 18 in any digital media categorisation of audiences.

Our external communications content is about our work, events and activities and is published in line with relevant lawful reason and in line with current Mental Capacity legislation.

Fundraising

If you are interested in fundraising for us and you are under 18, we may need to speak to a parent/guardian/representative instead of, or before, speaking to you, and may need to record your date of birth so we know how old you are.

0-15 years old: If you are aged 15 or under, we will need to speak to your parent or guardian regarding your enquiry. We will not process any personal data about you. Any information provided will be recorded under the name of your parent / guardian.

16-17 years old: If you are aged 16-17, then we may need to record your date of birth to create your record. We will not send you any marketing or carry out any processing that would require consent.

16-17 years old : You may look to complete work experience at Seashell, this will require us to collect and process information regarding your time here including risk assessments to keep both you and our service users and staff safe and well.

We can talk to your parent/guardian/representative over the phone and then receive written permission either in forms sent via post or electronically, or agreement via email.

Our Fundraising activities may sometimes include competitions or ideas involving children about how to raise money. Where this is the case, we will ensure that any communication/application will also include an adult parent/carer, following the guidelines above

If you are a performer/activity or service provider or a celebrity performing for Seashell, we will process some of your personal data, including your name and contact details. Additional information collected will vary depending upon the specific arrangements with you. This information will be used to make arrangements for your performance/provision of the activity /services and supporting logistics. Your performance may also be recorded where we have agreed this with you.

Our legal basis for processing your personal data will be contract performance – specifically, the performance of our contract with you (which will either be a standard release form or a contract for services).

If you are working with our children and young adults, we will also process your personal data in line with requirements in our Safer Recruitment policy and procedures, the legal basis for this is to meet our legal obligations.

However, to ensure that we provide you with the best service possible and that we use our resources as efficiently as possible, we make use of external expertise/suppliers and agencies where appropriate. This involves us sharing your information with our trusted service providers who are authorised to act on our behalf, associated organisations who work on our behalf, or with whom we work with in partnership to deliver and improve services, for the purposes set out in this Privacy Policy. This includes organisations who fundraise on our behalf. Some of these organisations act as controllers (for example, banks) and others as processors who act solely on our instructions.

Who we share information with....

While you are living at Seashell

Local and Central Government, Integrated Care Boards, Ofsted, Public Health, CQC, activity providers, Department of Health, Department for Work and Pensions, Health and Safety Executive, NHS services, multi- disciplinary teams around a child/young person, safeguarding boards, Seashell Trust staff and representatives, families, advocates, shared care providers, professional services, trust fund providers where applications are made specifically for you, professional services consultants and  professional services. 

While you are learning at Seashell/on a placement

Local and Central Government, Integrated Care Boards, Department for Education, Public Health, Health and Safety Executive, Department of Health, Health England, Health placement – affiliated university, Ofsted, NHS Services, EFA (Education Funding Agency), exam and course accreditation organisations, multi-disciplinary teams around a child/young person for competency, activity providers, our governors, technology solution providers, safeguarding boards, Seashell staff and representatives, professional services consultants and professional services. 

While you are working at Seashell

Ofsted, HMRC, Public Health,  Disclosure and Baring Service, Health and Safety Executive (HSE), Local and Central Government, Department for Work and Pensions, Office for National Statistics, financial audit services (internal and external), banking services, staff benefit package providers, occupational health/physio service providers, total benefit package providers, learning and development providers, apprenticeship scheme providers, EFA (Education Funding Agency), qualification accreditation providers, activity providers, reference service providers, legal services, law enforcement bodies, trade unions (where you are a member), our governors, technology solution providers, safeguarding boards, current, past and prospective employers and work experience (for references), parents and prospective parents, professional services consultants, regulatory body inspectors, professional bodies that you are registered with and partner organisations. 

As a service provider/partner/agency working with Seashell

Ofsted, CQC, local authorities, Government departments, Public Health, Health and Safety Executive, legal services, law enforcement bodies, our governors, technology solution providers, safeguarding boards, professional services, Disclosure and Baring services, financial checking services, service accreditation providers, customers, Seashell employees, software providers, credit and fraud prevention check providers, Seashell staff and representatives, professional services consultants and professional services. 

As a Visitor/or Accessing our Facilities Services to Seashell

Public Health, Seashell employees, partner organisations, law enforcement authorities, external catering providers, technology solution providers and safeguarding boards. 

While you are volunteering at Seashell

Volunteer portal provider, Public Health, background check and reference providers, Disclosure and Baring Service, Seashell Trust staff and representatives, our governors, technology solution providers, safeguarding boards, law enforcement bodies, regulatory body inspectors, Health and Safety Executive, learning and development systems, professional services and off-site location providers for Health and Safety purposes. 

While you are supporting us at Seashell

HMRC – Gift Aid, shared with our authorised users, helping at events where applicable, event partners, external catering services, trust fund providers where applications are made, Government departments (when bidding for funding), offsite location providers for Health and Safety purposes, email marketing systems, fundraising regulators, legal representatives, Health and Safety Executive, Seashell Trust staff and representatives, our social media platforms, our governors, technology solution providers and safeguarding boards. 

While you are using Seashell Active, our Community Services and Hiring our Facilities

Seashell Trust staff and representatives, Public Health, NHS Services, national governing bodies, referral organisations, activity providers, background check and reference providers, law enforcement bodies, regulatory body inspectors, partnership activity providers, safeguarding boards, Health and Safety Executive, software providers, multi-disciplinary teams around a child or young person and off-site location providers for Health and Safety purposes.  

While you are using Seashell Sensory or Health Services

Seashell Trust staff and representatives, Public Health, CQC, Integrated Care Boards, service commissioners, local authority multi-disciplinary teams where commissioned by a local authority, Health and Safety Executive, safeguarding boards, NHS Services, activity providers, learning and development providers, accreditation providers and off-site location providers for Health and Safety purposes. .

When we use an external service provider to process data on our behalf, we disclose only the personal information that is necessary to deliver the service and will have a contract in place that requires the provider to comply with Seashell and Data Protection and Information Security requirements.

By way of example, we may:

• share your information with payment processors, to pay for a service, to allow you to make a donation, pay for entry to an event,  they will then share certain information about the transaction with us to allow us to keep appropriate financial records and to match you to the transaction (so we know you have paid) – please see Processing Payments and Gift Aid for further information; and
• share your information with mail service providers and fulfilment companies to contact you and/or to provide items to you.

From time to time we may also need, or be required, to share your information with law enforcement, public authorities, regulators and/or our professional advisers. We will only do so where we have a clear, lawful basis for doing so.

You should be aware that there are certain circumstances where we cannot guarantee confidentiality, for example:

• where we are subject to a legal obligation under safeguarding law. Please see our Safeguarding Policy for further information.
• Sometimes a court order may direct us to share your information.

Overview

Those entities with whom we share your information may be located in the EU, EEA and elsewhere in the world including the US and other countries with more lenient Data Protection rules than those in the UK. Wherever they are located, we only work with companies we trust to keep your information safe.

We will always seek to ensure that appropriate or suitable safeguards are in place to protect your personal information and that transfer of your personal information is in compliance with applicable Data Protection laws. We usually rely on standard contractual clauses and related adequacy agreements when transferring personal data to other countries

Further information

You can obtain further details regarding this by contacting us (please see Contact Us) although some details may be redacted for confidentiality reasons.

We are committed to protecting the security of the personal information you share with us. In support of this commitment, we have implemented appropriate technical, physical and organisational measures to ensure a level of security appropriate to the risk.

For example, we use strict procedures and security features to prevent unauthorised access to your personal information.

• We have policies, processes and procedures in place for Data Protection and Information Security;
• We have staff who are responsible for Data Protection and Information Security;
• Confidentiality clauses are included in staff, third party and volunteer contracts and agreements;
• All authorised users of Seashell data complete training for Data Protection and Information Security;
• Restricted access to physical data and access to systems, and therefore data is defined by the role of the authorised user;
• Internal reporting systems ensure any incidents are recorded and managed by those responsible for serious incidents reported to the Information Commissioner’s office;
• IT protection systems are in place to identify and respond to Cyber Security threats;
• We assess the suppliers that we engage with to ensure that they provide acceptable levels of Data Security and Protection when processing Seashell information; and
• Additionally in order to protect Seashell Information we perform and meet an annual assessment/accreditation to ensure that our systems meet the standards defined in the NHS Data Security and Protection Toolkit, and Cyber Essentials.

We have a retention policy which sets out how long we will keep your information for. In some cases, the retention periods are governed by law, in other cases by best practice.

We will not retain any information for longer than is necessary in relation to the purposes for which it was originally collected, or for which it was further processed, subject to all relevant legal obligations of the Trust for example the collection of Gift Aid or to support certain financial transactions. We retain personal data in accordance with our data retention schedules.

All service at Seashell have and maintain retention schedules. For further information about retention please Contact us

Keeping data to support legacy administration and work.

In order for us to be able to receive the gifts our kind supporters leave to us in their Wills, we’ll keep just the following information for up to 85 years based on the ages of our youngest supporters.

• most recent and previous names and addresses, (ii) donations made, (iii) communications sent and received, (iv) legacy conversations and Will-writing appointments held and (v) legacy status (enquirer, intender, pledger).

See Legacy Giving

We store some of your data on our own servers. This is held in line with our Information Security and Data Protection, and Retention policies.

Where we work with service providers to process and hold your data for us we will ensure this is defined in a contract/sharing agreement and we will take reasonable steps to make sure that your data is treated securely in accordance with this Privacy Promise. We will protect your personal data and ensure that it will be held compliantly with legislation.

We implement security for our own servers, and requires specific security levels with our service providers please do remember that information transmission over the internet is inherently insecure, and we cannot guarantee the security of information sent over the internet.

The personal information collected from you may be transferred to and stored at a destination outside of the European Economic Area (EEA). By submitting your personal data, you agree to this transfer, storing and processing outside of the EEA. Where in-country accreditation certificates are available for Data Protection and Information Security we will use the companies holding these certifications.

In cases where we use software products provided by other organisations e.g. X previously known as Twitter, Facebook, Legend, Raisers Edge each service will define how we manage/store our data in those products.