Privacy Policy 2026

We currently collect and process the following information, some of it is special category or sensitive data:

• personal identifiers, contacts and characteristics (for example, name and contact details)
• diversity information about you and any child/ren with Special Educational Needs and Disabilities (SEND) we support you with, such as gender, ethnicity, religion, disabilities, sexual orientation and age or age range
• details about your, or your child’s, health issues
• details about your, or your child’s, school and GP
• if we are helping you or your child to apply for benefits, we may need to ask for information such as hospital number, national insurance number and bank details for you to receive payments.

Most of the personal information we process is provided to us directly by you/your parent carer so that we can provide a service.  The lawful bases we rely on for processing this information are your consent, public task, legitimate interests and contract.  We ask for your consent to store and process your personal information and you may give this consent verbally or in writing. Once we have made you aware of this policy, if later you give us details of other children you would like support with, we will assume that consent applies extends to recording their details too. You can remove your consent at any time, where we rely on consent to process your data. You can do this by emailing us [email protected]. We fulfil a public task when providing the SENDIAS service and where we cannot ask for your explicit consent, we rely on this basis to process your data and provide you with advice.

We use legitimate interests as a legal basis for collecting the following data:

• SEND details of a child or young person’s SEND. Amaze’s purpose is to support families with SEND, this information allows us to evidence the needs of our families and to offer relevant support
• GP, school and address, we need this information to ensure families are eligible for our services which are funded by regions. It also helps us know the reach of our services which can lead to us identifying gaps in provision
• collecting emergency contact details for young people accessing groups. This is in the best interests of the young person.

We may also receive personal information indirectly, from the following sources, in the following scenarios.

• If you are a child or young person and we are working with your parent carer, we may receive this information directly from the person(s) who has parental responsibility for you. If you are over 16 years, we will ask your parent/carer to check with you that you consent to us processing your data.  Where a person over 16 does not have capacity to make this decision we will follow the principles set out in the Mental Capacity Act 2005 and take consent from the appropriate decision maker. For this decision, this is likely to be the primary carer.
• From an external agency referring you to access one of our services. They must obtain consent from you first, before they pass us your data.  We will request personal contact details, and details about why the referral is being made which is likely to include the health needs of your child.
• From other agencies working with you/your child. If we are supporting you to apply for benefits or to make an appeal against a benefits decision, we may need more information.  With your consent, we may gather supporting information on your behalf such as clinic letters, assessments, reports and therapy programmes.

When you contact Amaze we will ask you for basic personal information to support you and your family, we also collect information that we report in an anonymised format to evidence our work to our funders.  Where you do not want to share demographic data with us, such as gender or ethnicity, we will off an option, ‘I prefer not to say’. If we need to share information such as with a benefits application, we will ask for this additional/explicit consent from you. We will assume your consent extends to your other children with SEND, if you provide details of them after your initial consent.

If you receive advice from our SENDIASS or benefits service, we may ask if your record can be reviewed by an external assessor to ensure our advice is of sufficient quality.

We have a designated fundraising database called Beacon CRM.  We always ask for specific consent to communicate with you about fundraising.  We do not hold bank account or card details, we use third party software to do this, such as Stripe or JustGiving. We do keep a record of what you have donated and any direct debit reference. We use a tool called Zeffy to collect donations. This is a third-party tool for you to make donations or other payments to Amaze. We do not hold any payment details from you on this system. Zeffy uses a ‘tip’ system to fund its services, which is free to Amaze to use. You do not have to ‘tip’ to make a payment. Zeffy may use the details of people who have visited their website to target online advertising to users. This may mean you receive online advertising from Zeffy. If you wish to opt out of this advertising, please email [email protected].

The lawful bases for processing your data are ‘consent’, ‘legitimate interests’ and ‘contract’.  We will process your data on our fundraising database if:

• you have consented to receive communications about Amaze fundraising
• you are fundraising for Amaze
• you have donated to Amaze through a third-party site such as ‘Just Giving’ and agreed to share your details with us
• you have contacted us directly about making a donation or leaving a legacy.
• you have taken part in the Amaze Lottery.

No. Unless we have your permission to do so, we won’t share your personal information with any organisations or individuals outside of Amaze unless there are exceptional circumstances.  These rare circumstances are:

• Amaze believes a failure to share your personal information would lead to a risk of significant harm to you or others.
• Amaze suspects or has knowledge of abuse
• Amaze believes a crime such as drug-money laundering or a fraudulent benefits claim has been made
• if you tell Amaze about a possible terrorism threat
• if disclosure is required by law, for example by the Police.

There will be some occasions we will need your consent to pass on personal information so that we can submit or process applications on your behalf e.g. for DBS checks, registering trustees with Charity Commission, supporting applications for disability benefits etc.

We will never sell, rent, or trade your personal data.

We follow national best practice and retention periods vary according to the nature of the record. Once the retention period has been reached your data will be anonymised.

Amaze operates the following websites amazesussex.org.uk, amazingfuturessussex.org.uk, www.paccbrighton.org.uk, www.espcf.org.uk  and at the bottom of each website there is a link to the privacy statement for that website. These will tell you what information Amaze gathers from visitors to our websites, and what we do with it.

If you have any concerns about our use of your personal information, you can make a complaint to us via our feedback form, or using the contact details above.

You can also complain to the ICO if you are unhappy with how we have used your data.

The ICO’s address:

Information Commissioner’s Office; Wycliffe House; Water Lane; Wilmslow; Cheshire; SK9 5AF

Helpline number: 0303 123 1113

ICO website