Privacy policy

We currently collect and process the following information:

• Personal identifiers, contacts and characteristics (for example, name and contact details)
• Diversity information about you and any child/ren with SEND we support a parent carer with, such as gender, ethnicity, religion, disabilities, sexual orientation and age or age range
• Details about your, or your child’s, health issues
• Details about your, or your child’s, school and GP
• If we are helping you or your child to apply for benefits, we may need to ask for information such as hospital number, national insurance number and bank details for you to receive payments.

Most of the personal information we process is provided to us directly by you/your parent carer in order for us to provide a service.  The lawful bases we rely on for processing this information are your consent and legitimate interests.  We will always ask for your consent to store and process your personal information and you may give this consent verbally or in writing. You are able to remove your consent at any time. You can do this by emailing us [email protected].

We may also receive personal information indirectly, from the following sources, in the following scenarios:

• If you are a child or young person and we are working with your parent carer, we may receive this information directly from the person(s) who has Parental Responsibility for you. If you are over 16 years, we will ask your parent/carer to check with you that you consent to us processing your data.  Where a person over 16 does not have capacity to make this decision we will follow the principles set out in the Mental Capacity Act 2005 and take consent from the appropriate decision maker. For this decision, this is likely to be the primary carer.
• From an external agency referring you to access one of our services. They must obtain consent from you first, before they pass us your data.  We will request personal contact details, and details about why the referral is being made.
• From other agencies working with you/your child. If we are supporting you to apply for benefits or to make an appeal against a benefits decision, we may need more information.  With your consent, we may gather supporting information on your behalf such as clinic letters, assessments, reports and therapy programmes.

When you contact Amaze we will ask you for basic personal information in order to support you and to collect information that we report in an anonymised format to our funders.  If we need to share information such as with a benefits application, we will ask for this additional/explicit consent from you.

We have a designated fundraising database called Beacon CRM.  We always ask for specific consent to communicate with you about fundraising.  We do not hold bank account or card details, we use third party software to do this.   We do keep a record of what you have donated and any direct debit reference.  The lawful bases for processing your data are ‘consent’, ‘legitimate interests’ and ‘contract’.  We will process your data on our fundraising database if:

• You have consented to receive communications about Amaze fundraising.
• You are fundraising for Amaze.
• You have donated to Amaze through a third party site such as ‘Just Giving’ and agreed to share your details with us.
• You have contacted us directly about making a donation or leaving a legacy.
• You have taken part in the Amaze Lottery.

No. Unless we have your permission to do so, we won’t share your personal information with any organisations or individuals outside of Amaze. The only exception would be where a failure to share your personal information would lead to a risk of significant harm to you or others.

There will be some occasions we will need your consent to pass on personal information in order to submit or process applications on your behalf e.g. for DBS checks, registering trustees with Charity Commission, supporting applications for disability benefits etc. These are ‘legitimate interests’ where an individual would reasonably expect us to use their information.

We will never sell, rent, or trade your personal data.

The services listed above, receive funding from the NHS.  In order that the NHS can monitor the value of the services, they ask us to share anonymised information about who is accessing our service.  Data sharing is optional and we check with every individual that they and or their young person consent to this data sharing.  For more details of what is shared, please see this page, https://amazesussex.org.uk/data-sharing-nhs/.

We follow national best practice and retention periods vary according to the nature of the record.

Amaze operates the following websites https://amazesussex.org.uk; https://amazingfuturessussex.org.uk; www.compasscard.org.uk; www.registercompasscard.org.uk; www.paccbrighton.org.uk; www.espcf.org.uk and at the bottom of each website there is a link to the privacy statement for that website. These will tell you what information Amaze gathers from visitors to our websites, and what we do with it.

If you have any concerns about our use of your personal information, you can make a complaint to us at [email protected] or using the contact details above.

You can also complain to the ICO if you are unhappy with how we have used your data.

The ICO’s address:

Information Commissioner’s Office; Wycliffe House; Water Lane; Wilmslow; Cheshire; SK9 5AF

Helpline number: 0303 123 1113

ICO website: https://www.ico.org.uk