Privacy Policy
Spectrum Socials CIC Privacy Policy
Effective date: 1st July 2026
Next review due: 1st July 2027 or sooner if required
Document Owner: Maya Luisa Yglesias H
Approved by: Board of Directors, Spectrum Socials CIC
1. Who we are
Spectrum Socials CIC provides therapist-led social events, peer-led activities, and therapeutic or wellbeing workshops for autistic and neurodivergent children and young people.
Organisation: Spectrum Socials CIC
Company number: 16355751
Registered office: 45 Kingswood Road, London, England, SW2 4JE
Website: https://spectrumsocials.co.uk
General email: info@spectrumsocials.co.uk
Data protection contact: [First name Surname, role, and email address]
Safeguarding contact: [First name Surname, role, and email address]
For most of the information outlined in this policy, Spectrum Socials CIC is the data controller. This means we decide why and how personal information is used.
2. Who this policy is for
This policy explains how we use personal information relating to:
● children and young people who attend, apply to attend, or take part in Spectrum Socials activities;
● parents, carers, guardians, and emergency contacts;
● people who contact us;
● people who appear in photographs, videos, audio recordings, feedback, or case studies
● website visitors;
● staff, volunteers, facilitators, directors, partners, and professionals where their information appears in our records.
We also provide a shorter privacy summary for children and young people.
3. What information we collect
We collect only the information we reasonably need to run our activities, keep people safe, communicate with families, meet legal and safeguarding responsibilities, manage our organisation, and report on our work.
3.1 Personal information
We may collect:
● Names;
● age, date of birth, or age group;
● parent, carer, guardian, and emergency contact details;
● address, postcode, email address, and phone number;
● booking, attendance, waiting list, and participation records;
● communication preferences;
● records of messages, enquiries, feedback, and complaints;
● payment, donation, or booking information, where relevant;
● consent, permission, refusal, and withdrawal records;
● website, cookie, device, and usage information.
3.2 Health, disability, access, and support information
We may collect information about:
● disability, diagnosis, or health conditions;
● access needs and reasonable adjustments;
● communication needs;
● sensory needs;
● allergies, medication, mobility needs, or medical risks;
● emotional wellbeing or mental health, where relevant to safe participation;
● information shared in therapeutic, wellbeing, or peer-support settings.
This information is treated with particular care because it may be special category data under data protection law.
3.3 Safeguarding information
We may collect and record information about:
● concerns about a child or young person’s safety or welfare;
● incidents at, before, or after activities;
● disclosures made by children, young people, parents, carers, volunteers, facilitators, or professionals;
● behaviour, welfare, or risk concerns;
● safeguarding referrals, decisions, advice, and actions;
● allegations or concerns involving adults working with or near children.
Safeguarding information may include sensitive information, third-party information, professional opinions, or information about alleged criminal conduct.
3.4 Images, recordings, and case studies
We may collect:
● Photographs;
● Video;
● audio recordings;
● Testimonials;
● case studies;
● social media content;
● records of media consent and withdrawal.
Media consent is optional and separate from attendance.
4. How we collect information
We may collect information:
● directly from children and young people;
● from parents, carers, guardians, and emergency contacts;
● through registration forms, event forms, consent forms, feedback forms, and website forms;
● by email, phone, messaging, video call, or in person;
● during events, workshops, activities, or incidents;
● from staff, volunteers, facilitators, venues, partners, or professionals;
● from safeguarding professionals, schools, local authorities, social care, NHS bodies, police, or emergency services;
● through website cookies and similar technologies.
Where we receive information from someone else, we will provide privacy information where required by law. In safeguarding situations, we may delay, limit, or withhold information where giving it would place someone at risk, prejudice safeguarding, prejudice a legal process, or be restricted by law.
5. Why we use personal information
We use personal information to:
● respond to enquiries;
● assess whether an activity is suitable and safe;
● register children and young people for activities;
● manage attendance, waiting lists, cancellations, and event updates;
● provide inclusive activities and reasonable adjustments;
● support communication and access needs;
● keep participants safe;
● contact parents, carers, guardians, or emergency contacts;
● respond to medical, welfare, or safeguarding concerns;
● record and manage incidents, complaints, and safeguarding matters;
● share safeguarding information where necessary;
● manage photographs, recordings, media consent, and case studies;
● produce anonymised or aggregated reports for internal review, funders, and impact reporting;
● manage venues, facilitators, suppliers, volunteers, and professional advisers;
● maintain records for insurance, legal, accounting, regulatory, and governance purposes;
● operate, protect, and improve our website and digital systems;
● respond to data protection requests and complaints.
6. Our lawful bases for using information
We use personal information only where we have a lawful basis under UK data protection law.
Depending on the purpose, we may rely on:
● contract or steps before participation, where there is a participation agreement or booking arrangement requiring us to use the information – for example, registering someone for an activity they have asked to attend;
● legitimate interests – for example, running activities, communicating with families, managing records, protecting our organisation, and keeping activities safe;
● recognised legitimate interests – for example, safeguarding vulnerable individuals, where the legal conditions are met. Recognised legitimate interests will be used only where the relevant statutory condition applies;
● legal obligation – where the law requires us to keep or share information;
● vital interests – where information is needed to protect someone’s life or immediate safety;
● consent – for optional uses, including some media use, optional communications, and non-essential cookies.
Where we use health, disability, access-needs, wellbeing, safeguarding, or similar sensitive information, we also rely on an additional condition for special category data. This may include explicit consent, substantial public interest, safeguarding, vital interests, or legal claims, depending on the circumstances. Where a health, social care, counselling, or similar condition is relied on, we will do so only where the legal requirements are met.
7. Consent, parental permission, and young-person views
We do not rely on consent for every use of children’s information.
We may ask for:
● parent or carer permission for attendance;
● the young person’s assent, meaning they are given an appropriate explanation for their age and their views are considered;
● young person consent where the young person has sufficient understanding and consent is the right lawful basis;
● explicit consent for some optional sensitive information;
● separate media consent for photographs, videos, audio, case studies, or promotional use;
● cookie consent where required.
A child or young person’s views matter. We consider their age, maturity, understanding, welfare, and the nature of the activity.
The UK age-13 rule applies only in specific circumstances involving online services offered directly to children where consent is used. It is not a general rule for all Spectrum Socials activities.
8. What happens if information is not provided
Some information is necessary. If we do not receive it, we may be unable to:
● respond to an enquiry;
● register a child or young person;
● assess whether an activity is safe and suitable;
● provide access support or reasonable adjustments;
● contact a parent, carer, guardian, or emergency contact;
● respond properly in an emergency;
● meet safeguarding responsibilities;
● meet insurance, legal, or governance requirements.
Media consent is optional. Refusing media consent will not stop someone attending activities.
Optional feedback, surveys, newsletters, and promotional communications are also optional.
9. Safeguarding and confidentiality
We take confidentiality seriously. Confidentiality is not absolute.
Where we believe a child, young person, adult at risk, staff member, volunteer, facilitator, or another person may be at risk of harm, we may record and share relevant information with appropriate people or organisations.
This may include:
● children’s social care;
● Police;
● NHS bodies;
● emergency services;
● Schools;
● local authorities;
● safeguarding partners;
● a local authority designated officer, where relevant;
● professional advisers;
● Insurers;
● regulators.
We will try to be open with families about safeguarding disclosures where safe and appropriate.
We may share information without consent where:
● seeking consent would place someone at risk;
● seeking consent would prejudice a safeguarding enquiry;
● consent cannot reasonably be obtained;
● the person does not have capacity to consent;
● there is a serious risk of harm;
● there is a legal or regulatory reason to share;
● we need to protect someone’s life, physical safety, mental wellbeing, or welfare.
We will record safeguarding decisions, including what was shared, with whom, when, why, and who authorised it.
10. Photographs, video, audio, and case studies
We will not use photographs, videos, audio recordings, testimonials, or case studies for public or promotional purposes without appropriate consent.
Media consent is:
● optional;
● separate from attendance;
● specific to the type of use;
● recorded;
● capable of withdrawal for future use.
Examples of media use may include our website, social media, newsletters, reports, printed materials, or fundraising materials.
If consent is withdrawn, we will take reasonable steps to stop future use and remove material from platforms we control. We may not be able to remove printed materials already distributed, screenshots, third-party reposts, archive copies, or material already lawfully published before consent was withdrawn.
We will not publish images or recordings where publication would create a safeguarding risk, reveal sensitive information unnecessarily, identify a child’s regular location pattern, or undermine dignity.
11. Who we share information with
We do not sell personal information.
We may share relevant information with:
● parents, carers, guardians, and emergency contacts;
● staff, directors, volunteers, and facilitators who need the information;
● venues, where needed for access, safety, or event delivery;
● therapeutic facilitators, workshop leaders, or activity providers;
● safeguarding professionals and safeguarding partners;
● children’s social care, local authorities, NHS bodies, police, emergency services, schools, or other relevant services;
● digital service providers, such as email, website, forms, hosting, storage, booking, analytics, and security providers;
● insurers, accountants, lawyers, auditors, and professional advisers;
● funders, normally using anonymised or aggregated information; identifiable information will be shared only where necessary, lawful, and explained;
● regulators, courts, public authorities, or law enforcement where required or justified;
● other organisations involved in a joint activity, where this is explained where appropriate.
Some organisations act as our service providers and handle information only on our instructions. Other organisations are responsible for their own use of information.
12. International transfers
We aim to store and use personal information in the UK where reasonably possible.
Some digital providers, including cloud, email, website, booking, form, analytics, or security providers, may process information outside the UK or allow support access from outside the UK.
Where this happens, we will use appropriate safeguards required by UK data protection law. These may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK addendum to EU standard contractual clauses, transfer risk assessments, supplier checks, and contractual controls.
13. How we keep information secure
We use security measures appropriate to the sensitivity of the information. These may include:
● access controls;
● two-factor authentication;
● restricted shared drives;
● password protection;
● encryption where appropriate;
● separate safeguarding folders;
● limited access on a need-to-know basis;
● confidentiality rules for staff, volunteers, facilitators, and directors;
● secure disposal of paper records;
● supplier checks;
● incident logs;
● regular review of access permissions.
No system is risk-free. We therefore limit access and keep sensitive information only where there is a clear need.
14. How long we keep information
We keep personal information only for as long as we reasonably need it for the purposes for which it was collected.
Registration information:
We keep the information provided when families register with Spectrum Socials while they remain registered with us. We periodically review the information we hold and may contact families to check that their details, including information about their child's needs, remain accurate and up to date.
Mailing list information:
We keep your name and contact details for as long as you remain subscribed to our mailing list. You can unsubscribe at any time. If you unsubscribe, we may retain your email address on a 'do not contact' list to make sure that we do not send you further marketing emails.
Photos and videos:
Photos and videos will normally be retained for up to 3 years after they are taken. Some photos or videos may be retained for longer where they continue to be used for legitimate organisational purposes, for example on our website or in reports about our work. We will periodically review this material and delete it when it is no longer required.
If Spectrum Socials stops operating:
If Spectrum Socials CIC stops operating, we will securely delete or anonymise personal information that we no longer need. Information that we are required to retain for legal, financial, safeguarding, insurance or other legitimate purposes will be securely retained only for as long as necessary.
Asking us to delete your information:
You can contact us at any time to ask us to delete personal information that we hold about you or your child. We will comply with requests for deletion where required under data protection law. In some circumstances, we may need to retain certain information, for example where this is necessary for safeguarding, legal, financial, insurance or record-keeping purposes.
Unsubscribing from our mailing list is different from asking us to delete your information. If you unsubscribe, we will stop sending you marketing emails, but this will not automatically delete other information that we hold about you or your child.
15. Anonymised and aggregated information
We may use anonymised or aggregated information to understand attendance, access needs, outcomes, demand, and service impact.
Where information is truly anonymised, it no longer identifies a person. Where information could still identify someone, directly or indirectly, we treat it as personal information.
We will not give funders identifiable information about children, young people, or families unless this is necessary, lawful, and explained.
16. Website, cookies, and similar technologies
Our website may use cookies or similar technologies.
Essential cookies are used where needed for the website to work or to provide a service requested by the user.
Non-essential cookies, such as some analytics, advertising, embedded media, or tracking technologies, will be used only where lawful. Where consent is required, we will ask before setting those cookies.
Our Cookie Policy is available on our website.
The Cookie Policy explains:
● what cookies we use;
● who sets them;
● what they do;
● how long they last;
● whether third parties are involved;
● how users can accept, reject, or change cookie choices.
We will not use analytics or tracking in a way that is hidden, unfair, or inconsistent with children’s privacy.
17. Service messages and marketing
We may send service messages about bookings, event changes, safety, cancellations, access arrangements, or participation. These are not marketing messages.
We will send newsletters, fundraising updates, promotional messages, or marketing communications only where lawful. Where consent is required, people can withdraw it at any time.
18. Data breaches
A personal data breach is a security incident that leads to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal information.
If a breach occurs, we will:
● contain and investigate it;
● assess the risk to individuals;
● keep a breach record;
● notify the Information Commissioner’s Office without undue delay and, where feasible, within 72 hours, if the breach is likely to result in a risk to people’s rights and freedoms;
● tell affected individuals without undue delay if the breach is likely to result in a high risk to their rights and freedoms;
● take steps to reduce harm and prevent recurrence.
19. Your rights
Depending on the circumstances, you may have the right to:
● ask for a copy of personal information;
● ask us to correct inaccurate information;
● ask us to delete information;
● ask us to restrict how information is used;
● object to certain uses;
● ask for certain information in a portable format;
● withdraw consent where consent is the lawful basis;
● complain to us;
● complain to the Information Commissioner’s Office.
These rights are not absolute. For example, we may need to keep some information for safeguarding, legal, insurance, complaint, or regulatory reasons. We may also need to protect another person’s information when responding to a request.
Parents and carers may make requests about a child’s information. We will consider the child’s age, maturity, understanding, welfare, and rights before responding.
20. Complaints and questions
Please contact us first so we can review the issue.
Email: info@spectrumsocials.co.uk
Data protection contact: [First name Surname, role, and email address]
Postal address: Spectrum Socials CIC, 45 Kingswood Road, London, England, SW2 4JE
You can also complain to the Information Commissioner’s Office.
ICO website: https://ico.org.uk
ICO telephone: 0303 123 1113
21. Accessibility
We want this policy to be understandable.
We can provide information in other formats where reasonably possible, including a shorter summary, easy-read version, larger text, or an explanation by phone or email.
Please contact info@spectrumsocials.co.uk if you need help understanding this policy or exercising a data protection right.
22. Changes to this policy
We will review this policy at least once a year and sooner if our activities, systems, suppliers, law, or safeguarding arrangements change.
We will tell families and relevant partners about material changes where appropriate.
Children and young people’s privacy summary
How Spectrum Socials uses your information
Spectrum Socials needs some information about you so we can help you take part safely.
What we may ask for
We may ask for:
● your name;
● your age;
● your parent or carer’s contact details;
● emergency contact details;
● what support you need;
● health, allergy, communication, sensory, or access information;
● whether you came to an event;
● what you tell us if you need help.
Why we need it
We use this information to:
● book you onto activities;
● help you take part;
● keep you safe;
● contact your parent, carer, or emergency contact;
● make activities more accessible;
● deal with worries, complaints, or safeguarding concerns.
Who may see it
Only people who need the information should see it. This may include Spectrum staff, volunteers, facilitators, or safeguarding leads.
Sometimes we may need to share information with social care, police, doctors, emergency services, or another safeguarding professional.
Keeping people safe
If we are worried that you or someone else may be unsafe, we may need to share information even if you do not want us to. We will only share what is needed.
Photos and videos
You do not have to agree to photos, videos, audio, or stories being used. Saying no will not stop you attending activities.
Your choices
You can ask:
● what information we have about you;
● for wrong information to be corrected;
● for some information to be deleted, where the law allows;
● for help understanding this policy.
Contact: info@spectrumsocials.co.uk