Privacy policy

We collect personal information from you when you:

• Give information to us directly – for example, when you interact with us on social media platforms such as Facebook or Twitter, make a donation to us, apply for a position, register for an event or otherwise provide us with personal information.
• Use our website – we collect information about how people use our website and the services that they use. Please see the 'Using our website' section of this Notice for further information.
• Referrals – we may be provided with information from you about third parties. For example, where a local authority refers you to us to receive our services. More about how we get and share information from third parties is set out below.
• Public Sources – we may use personal information that is available publicly, for example we may use contact details available publicly (including from publicly available social media posts) when organising a fundraising event.

We will treat all of your personal information confidentially and we will take all reasonable steps to keep your personal information secure once it has been transferred to our systems.

We adopt appropriate data collection, storage and processing practices and security measures to protect against unauthorised access, alteration, disclosure or destruction of your personal information.

Please note that whilst we take appropriate security measures we cannot guarantee the security of any data you disclose to us online. You accept the inherent security risks of providing information and dealing online and will not hold us responsible for any loss or damage that you incur.

We take steps to ensure that your personal data is not transferred outside of the European Economic Area (EEA). We are currently working with our existing suppliers to ensure that they do not transfer any data which they look after for us outside of the EEA. However, where this is unavoidable, we take a number of steps to ensure that any personal data that is transferred outside of the EEA is properly treated. Our standard practice is to ensure that any US-based suppliers are certified under the EU-US Privacy Shield scheme, or alternatively to use standard data protection contract clauses that have been approved by the European Commission.

We will generally only keep your information for as long as necessary for the purpose for which it is collected, or where we have a legal obligation to keep information for a certain period of time. Historically, we have archived information for longer periods for public record keeping.

For further information on our information collection and storage practices, international transfers or our retention policies, please contact our Data Protection Officer

When you make a donation to us, we collect and use the following information about you:

• full name
• contact details (your address, email and contact number)
• payment information (which may include your bank account details where you have set up a direct debit to support us, and information that we require to comply with Gift Aid requirements)
• the amount of your donation
• if you are a regular donor, we hold information about your donation history
• whether or not you have agreed to receive further information from us about news and events.

We use this information as necessary to process your donation and to ensure that your donation is properly recognised. Information may also be used on an anonymous basis for internal financial management purposes, so that we can validate our internal finance records and compare financial data against expectations, budget and previous years.

We may pass your information to our third party service providers, suppliers, agents, subcontractors and other associated organisations for the purposes of completing tasks and providing services to you on our behalf. For example to process donations/payment, send you postal mailings and where you have consented electronic marketing by email or phone. However, when we use these third parties, we disclose only the personal information that is necessary to deliver the services and we have a contract in place that requires them to keep your information secure and prevents them from using it for their own direct marketing purposes. Please be reassured that we will not release your information to third parties for them to use for their own direct marketing purposes, unless you have requested us to do so.

We may also need to share information with HMRC when reporting on our taxes, however information is only shared with HMRC on an anonymous basis.

If you use your credit or debit card to donate to us, buy something or pay for a registration online or over the phone, we will ensure that this is done securely and in accordance with the Payment Card Industry Data Security Standard. Find out more information about PCI DSS standards.

We offer the use of PayPal to make a donation, and have a payment gateway operated on behalf of and under contract to us by service providers which looks similar to our main website. Further information about the collection and use of the data will be provided on the relevant payment gateway for you.

If you enter your details into one of our online forms and you don’t “send” or “submit” the form we may contact you to see if we can help you with any problems you may be experiencing with the form or our website.

We do not store your credit or debit card details at all, following the completion of your transaction. All card details and validation codes are securely destroyed once the payment or donation has been processed. Only staff authorised and trained to process payments will be able to see your card details.

If we receive an email containing any credit or debit card details, it will be immediately deleted, no payment will be taken and you will be notified about this. All donations should be completed through the donation page on our website or by calling Children 1st supporter team on 0345 1080111.

We generally retain supporter information for 7 years, in line with HMRC requirements.

Prospect Research

As a fundraising organisation we undertake in-house research, and occasionally engage specialist external agencies, to learn more about our current supporters and to identify prospective supporters. The information we gather helps us to identify the interests of people and organisations and the potential for them to support Children 1st financially. We do this to better understand our supporters and retain their support, and to engage new supporters, enabling us to generate philanthropic income for the charity, in line with Children 1st’s strategic objectives. The legal basis we are relying on to conduct this research is legitimate interest.

If we do engage a specialist external agency, the work they do for us will be subject to a contract with Children 1st, which will specify that they will only use the data for the purpose they are engaged for, and that the data will be held securely and won’t be sold or reused for another purpose.

When we undertake in-house research we will use information you have already given us, or information from publicly available sources, such as the Electoral Register, Companies House, company websites, social networks such as LinkedIn and internet search engines.

When determining whether we will undertake this type of research we will always complete an assessment that considers your rights as an individual. Any research undertaken will never be excessive and will always go through a rigorous internal due diligence process. If you would prefer us not to use your data in this way, please email us at fundraising@children1st.org.uk or fill in the contact form at the top of this page and let us know.

Children 1st uses Mailchimp to send our e-newsletter out to our supporters. In every e-newsletter we send to you, you will have the option to update your consent preferences to decide how Children 1st can contact you. You can view Mailchimp’s privacy policy at the following link https://www.intuit.com/privacy/statement/

When you use any of our services, we may collect and record the following information:

• full name
• contact details (your address, email and contact number)
• details of any enquiry, compliment or complaint that may be provided to us
• information about personal experiences and circumstances, and information about health and wellbeing
• information given to us in the course of providing services, which may include:
  • special categories of personal data revealing race or ethnic origin, religious beliefs, political views, genetic information, health information, or information about an individual's sex life or revealing an individual's sexual orientation.
  • information about any criminal convictions that have been committed against an individual or which an individual has committed
  • information about an individual's finances and financial situation
• information about an individual's legal status (in terms of whether or not they are on a Child Protection Register, whether or not a supervision requirement is in place, or whether or not they are looked after at home or away from home)
• information about advocates or other representatives we may encounter in the delivery of services.

We use this information only to the extent necessary to provide the services to you that you have requested from us.  We may also be under legal obligations to record certain information in connection with an individual's legal status.  

Where this involves the use of special category information (such as information about your health and wellbeing) or criminal convictions information, our basis for using such information is for the substantial public interest of counselling and safeguarding children and individuals at risk of neglect or physical, mental or emotional harm and for protecting their economic well-being.

If you do not provide us with information that we ask for and that we require, we may not be able to provide services to you. If you are uncomfortable about disclosing certain information to us or if you have any concerns or queries about why we require certain information, we are happy to discuss this in further detail with you.

In limited circumstances, we may ask for your consent to use your information (for example, for your experience with us to be used in Children 1st materials or on our website).  We will always ask for your explicit consent beforehand, and we will tell you how you can withdraw your consent if you change your mind (which you can do at any time).

The information we use to deliver services will either be provided to us by you, created by us in the delivery of services (for example by way of notes made by our staff), or provided to us by a third party.

We will only share special category information with other organisations where that is necessary for legal reasons, or where there are other substantial public interest grounds. We may be required to share your information with other parties, such as:

• local council social work departments
• Police Scotland
• safeguarders and other parties in connection with Children's Hearings
• other charities and public sector organisations that may be providing services to you or that we may be working in partnership with
• advocates or other representatives that may be acting on your behalf
• health and education professionals (such as health visitors or head teachers)
• other family members (where you are comfortable with this)
• statutory bodies in connection with legal and formal processes.

Your information will be processed and stored on our secure IT systems, which are supported by our third party IT providers. Information may also be held by our document management service providers.

Case records are generally kept on our live system for up to 5 years, after which time they are anonymised so that any identifiable information is removed.  In certain circumstances we may be required to keep records for a longer period, depending on the nature of the case and whether or not we are subject to separate legal obligations which require us to do this.

Historically, some case records held by us were archived for public record-keeping purposes. Please see further details below.

Prospective Employees

If you want to work with us as an employee, we may collect the following information about you:

• full name
• contact details (your address, email and contact number)
• information from your CV or about your background and experience
• information from your references
• information obtained through our application and
• interview processes 
• information about any health conditions or disabilities that you may have which are relevant to the role you are applying for or if you have any particular needs we need to be aware of for your interview
• information about your race or ethnic origin and gender in our equalities monitoring form
• if you are appointed, depending on the nature of the role you are applying for, we may be required to obtain information about any criminal convictions from a Disclosure Scotland or Protecting Vulnerable Groups (PVG) background check.

We use this information as necessary to process your application and to decide whether or not to offer you a position. Once you begin working with us, we will provide you with further details about how we may use your information as an employee.

Where we are required to use special category information (such as information about your health or information about criminal convictions), our basis for using such information is either:

• it is necessary for carrying out our obligations and exercising our rights as an employer
• it is necessary for protecting your vital interests or those of others you may be working with
• it is necessary for the prevention or detection of unlawful acts
• it is necessary for monitoring equal opportunities
• it is necessary for supporting individuals with a particular disability or medical condition.

Where you are applying for a voluntary position, we may ask for your consent to use special category information. If we need your consent, we will always ask for it before collecting the personal information, and we will tell you how you can withdraw your consent if you change your mind.

If you do not provide us with information that we ask for and that we require, we may not be able to process your application to work with us or offer you a position.

Your information will be processed and stored on our secure IT systems, which are supported by our third party IT providers. Information may also be held by our document management service providers.

If your application is unsuccessful, your information may be retained for up to 6 months.

Prospective volunteers

When you apply to volunteer with us, we will collect the following information about you:

• full name
• contact details (your address, email and contact number)
• date of birth
• information about your background, experience and availability
• information from your references
• information obtained through our application and
• interview processes
• information about any health conditions or disabilities that you may have which are relevant to the role you are applying for or if you have any particular needs we need to be aware of for your interview
• if you are appointed, depending on the nature of the role you are applying for, we will also be required to obtain information about any criminal convictions and other relevant information to complete a Basic Disclosure check or a Protecting Vulnerable Groups (PVG) background check. We are legally obliged to collect this information so that we can adhere to our legal obligation with regard to the Protection of Vulnerable Groups Act (Scotland) 2007.

We use this information as necessary to process your application and to decide whether to offer you a position or not.

Throughout the recruitment process information will be stored securely and in line with the General Data Protection Regulation (EU) 2016.

If you do not provide us with information that we ask for and that we require, we may not be able to process your application to volunteer with us or offer you a position.

If you do not take up a voluntary role with Children 1st we will retain this information for 6 months after which time it will be securely destroyed.

During recruitment we will also collect statistical information to monitor our compliance with equalities including:

• Gender
• Trans status
• Ethnicity
• Age
• Religion or belief
• Sexual orientation
• Disability

This information is held separately from application information and not seen by staff who are involved in recruitment. It is used only for statistical purposes and in no way relating to recruitment of volunteers.

Current Volunteers

Once you begin volunteering with us, recruitment information will form the basis of your volunteering file, and we will use it to enable you to undertake your volunteering role with us.

We will also collect some other information such as:

• An emergency contact
• Any health or disability information relevant to your role
• Training information

Where we are required to use special category information (such as information about your health), our basis for using such information is either:

• it is necessary for protecting your vital interests or those of others you may be working with
• it is necessary for supporting individuals with a particular disability or medical condition.

Your information will be processed and stored on our secure IT systems, which are supported by our third party IT providers. Information may also be held by our document management service providers.

Former volunteers

When you cease volunteering with Children 1st we will retain your volunteer file for 6 years or for 25 years if you did direct work as part of your role, in line with our retention and destruction policy.

If you want to fundraise in aid of Children 1st, we may need to collect and use the following personal information about you:

• full name
• contact details (your address, email and contact number)
• payment information
• the amount you have raised for us
• details about any fundraising events or challenges you may be conducting
• details of any feedback, enquiry, compliment or complaint you may make to us
• if you are a regular fundraiser, we hold information about your history with us
• whether or not you have agreed to receive further information from us about news and events.

We use this information as necessary help keep in contact with you about your activities in aid of us, to process any funds you raise in aid of us and to ensure that you are properly recognised for your support.

In limited circumstances, we may need your consent to use your information (for example, for your story to be used in Children 1st materials or on our website). We will always ask for your explicit consent beforehand, and we will tell you how you can withdraw your consent if you change your mind (which you can do at any time).

We receive this information either directly from you, or from third parties – such as where you are fundraising in aid of Children 1st via use of a third party fundraising website (such as JustGiving, everydayhero, Virgin Money Giving or BT MyDonate). Please note that we do not have any control or oversight over any of the personal information that you may provide or submit to any such third party website. We would recommend that you check the privacy policies issued by these websites to see how they handle your information.

Your information will be processed and stored on our secure IT systems, which are supported by our third party IT providers. Information may also be held by our document management service providers.

In the course of our activities, we may collect and use names and professional contact details of various people who we encounter for commercial purposes, such as:

• individuals who work at our suppliers
• individuals who work in local council social work department, the Scottish Government, or with other organisations and charities that we work in partnership with
• individual MSPs, MEPs and MPs that we work with in connection with lobbying activities
• our professional advisors and consultants (such as our lawyers, accountants and auditors).

This information is used for the day-to-day running of our organisation and in connection with the promotion of our aims and values.

Your information will be processed and stored on our secure IT systems, which are supported by our third party IT providers. Information may also be held by our document management service providers.

We may contact you for marketing purposes by email or text message if you have agreed to be contacted in this manner.

If you have provided us with your postal address or telephone number we may send you direct mail or telephone you about our work, unless you have told us you do not wish to receive calls or mail from us.

It is your choice as to whether you want to receive information about our work, how we raise funds and the ways you can get involved. If you want us to use your personal information in these ways please tick the relevant box on the form on which we collect your data.

You may opt-out of our marketing emails at any time by clicking the ‘unsubscribe’ link at the end of our marketing emails, and can opt-out of receiving marketing texts by sending us an "opt-out" text message, following the instructions we provide you in our initial text.

You can also change any of your contact preferences at any time letting us know what types of information you wish to receive. When you contact us we will quickly recap the types of communications that we send out and tailor your record according to your preference. Please call 0345 1080111, email: fundraising@children1st.org.uk, write to Children 1st, 83 Whitehouse Loan, Edinburgh, EH9 1AT or fill out our online form to say how you would prefer us to keep in touch.

We will not use your information for marketing purposes if you have indicated that you do not wish to be contacted for such purposes. However, we may retain your details in accordance with legal requirements and to help ensure that we do not continue to contact you.

When someone visits www.children1st.org.uk we use a third party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site.

This information is only processed in a way which does not identify anyone. We do not make, and do not allow Google Analytics to make, any attempt to find out the identities of those visiting our website. If we do want to collect personal information through our website, we will make this clear and explain what we will do with it.

We use cookies to help us make our website better and to keep track of what you are interested in. Cookies mean that our website will remember you from visit to visit. A cookie is simply a small text file. It isn't a program and doesn't actively do anything on your computer. You can read more about the cookies we use and how to manage them on our cookies page. 

Google Analytics also allows us to manage remarketing campaigns via Google Ads. We use this service to target online adverts to recent visitors to our website.

We ensure your data is kept secure by using up-to-date security features and procedures and we respect the privacy of all visitors to our website.

If you post or send any content that we believe to be inappropriate, offensive or in breach of any laws, such as defamatory content on our forums or social media pages, we may use your personal information to inform relevant third parties such as your internet provider or law enforcement agencies.

Our websites may also include links to other websites, not owned, associated or managed by Children 1st. While we try our best to only link to reputable websites we cannot be held responsible for the privacy of information collected by sites not managed by us, nor can we accept responsibility or liability for them.

For this reason you should consult the privacy policy on any external website you link to before you submit any personal information to those websites.

As Scotland's national children's charity, historically we have archived certain information about child protection cases we have worked on for public records. This helps public organisations and historians track how children's care has changed over the years in Scotland.

Generally, archived information is not kept in an identifiable manner. However, it may be that certain information has been retained (such as location information, dates and other information about the circumstances of a particular case) and as a result individuals may be identifiable.

Information is held by the National Archives of Scotland, the National Records of Scotland and by Glasgow Caledonian University for archiving purposes.

From time to time we may contact you and ask you to complete a survey online where we are seeking feedback about your experiences with us. We will only collect personal information in the context of online services where this is necessary for us to receive adequate feedback from you. All of our surveys are optional – you do not need to complete a survey if you do not wish to do so.

Our online surveys are powered by SurveyGizmo survey software. SurveyGizmo are certified under the EU-US Privacy Shield certification scheme, and more information about how they handle personal information is available here.

Data protection laws give you a number of rights as set out below. If you would like to exercise any of your rights, please contact us using the details located above.

• Access your personal information: you may request access to a copy of your personal information. All requests for access to personal information should be made to us in writing.
• Withdraw consent: if you have given us consent to use your personal information to send you communications, you can withdraw your consent at any time.
• Rectification: you may ask us to rectify and update any inaccurate information we hold about you or to complete any information that is incomplete.
• Erasure: you may ask us to delete your personal information.
• Portability: you may ask us to provide you with the personal information that we hold about you in a structured, commonly used, machine readable format, or ask for us to send such personal information to another data controller.
• Restriction: you can ask us to restrict the personal information we use about you where you have asked for it to be erased or where you have objected to our use of it.
• Object: you may object to our processing of your personal information in accordance with this Notice. Please contact us, providing details of your objection.

You may make a complaint about our data processing activities by contacting us using the details above. Alternatively, you may make a complaint to the UK supervisory authority, which is the Information Commissioner's Office, by visiting their website at www.ico.org.uk/concerns, by phoning 0303 123 1113 (local rate) / 01625 545 745 (national rate), or by writing to the:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF