1 Introduction

1.1 We Are Family (‘We Are Family’, ‘we’ and ‘our’), a charitable incorporated organisation registered with the Charity Commission of England and Wales with charity number 1163318 whose registered address is at 27 Old Gloucester Street, London, WC1N 3AX, United Kingdom, is committed to protecting the privacy and rights of individuals (including We Are Family members and their families, volunteers, employees, trustees and others) and to fully comply with data protection legislation (principally the UK General Data Protection Regulation (‘UK GDPR’) and the Data Protection Act 2018 (‘DPA’)). The data controller of personal information covered by this Notice is We Are Family CIO.

1.2 This Privacy Notice (‘Notice’) applies to anyone who uses our website (www.wearefamilyadoption.org.uk (‘our Website’)), submits material to us through our Website or otherwise (whether unsolicited or solicited by us), registers with us on our Website or otherwise to receive information, and all We Are Family members, staff, volunteers and trustees. In this Notice, for simplicity, the word ‘you’ is used to mean each of these groups (unless the context makes it clear otherwise). This Notice explains who we are, how we collect, share and use personal information about you, and how you can exercise your privacy rights. If you have any questions or concerns about our use of your personal information, then please contact us using the contact details provided at the end of this Notice.

2  What does We Are Family do?

2.1 We Are Family is a parent-led adoption support community operating in the United Kingdom. We provide support through regular peer support sessions, webinars, talks and meet-ups (both in-person and online), information sharing and other initiatives.

2.2 We Are Family recognises the fundamental importance of protecting personal data about prospective adopters and adoptive families, and that any failure to do so could have far-reaching negative consequences for its members and their families. Equally, sharing adoption-related information and the experiences of adoptive parenting with each other (as well as with people outside our community), and offering mutual support, is at the core of We Are Family’s reason for existence.

3  What personal information does WAF collect and why?

3.1 We Are Family holds and processes certain information about its staff, volunteers, members, people who use our Website, those who register with us to receive information and other individuals it has dealings with for various purposes, including providing information and support to its members; enabling the sharing of information and experiences between members; providing information to interested people; for administrative purposes; and, in an anonymised and aggregated form, to help manage and improve its activities, in dealing with external stakeholders and for fundraising purposes.

3.2 The personal information that we may collect about you broadly falls into the following categories:

a) Information that you provide when you apply for a job or become a member of staff. This will include your name, address and contact details, including email address and telephone number, date of birth and gender; the terms and conditions relating to the work you are doing for We Are Family; details of your qualifications, skills, experience and employment history, including start and end dates with previous employers and with us; information about your salary, including entitlement to benefits such as pensions or death in service insurance cover; details of your bank account and national insurance number; information about your marital status, next of kin, dependents and emergency contacts; information about your nationality and entitlement to work in the UK; information about your criminal record; details of periods of leave taken by you, including holiday, sickness absence, family leave and extended leave, and the reasons for the leave; details of any disciplinary or grievance procedures in which you have been involved, including any warnings issued to you and related correspondence; assessments of your performance, including appraisals, performance reviews and ratings, training you have participated in, performance improvement plans and related correspondence; information about medical or health conditions, including whether or not you have a disability for which the organisation needs to make reasonable adjustments; and/or equal opportunities monitoring information, including information about your ethnic origin, sexual orientation, health and religion or belief.

b) Information that you provide voluntarily (for example, when you apply to become a member of We Are Family or at a later time during your membership, or when you register with us on our Website to receive information about our services or to receive blog updates). This may include information such as your name, email address, local authority area (residence), assessing agency, adopter status and family details as well as information about your year of birth, gender, ethnicity, disability and sexual orientation.

c) Information that we collect automatically from your device. This may include information like your IP address, device type, unique device identification numbers, browser-type, broad geographic location (for example, country or city-level location) and other technical information. We may also collect information about how your device has interacted with our website, including the pages accessed and links clicked. Collecting this information enables us to better understand the visitors who visit our Website, where they come from, and what content on our Website is of interest to them. Some of this information may be collected using cookies and similar tracking technology. For further information about the types of cookies we use, why, and how you can control cookies, please see our Cookie Notice at https://www.wearefamilyadoption.org.uk/cookie-policy/.

d) Information that we obtain from third party sources. We only receive personal information about you from third party sources in limited circumstances, and only where we have checked that these third parties either have your consent or are otherwise legally permitted or required to disclose your personal information to us. This includes, for example, confirmation from a prospective member’s social worker about adopter status where the prospective member has asked the social worker to provide us with this information.

3.3 We Are Family needs to process staff data to enter into a working relationship with you and to meet our contractual obligations under any agreement with you. For example, if you are an employee we need to process your data to provide you with an employment contract, to pay you in accordance with that contract and to administer any benefits.

In some cases, We Are Family needs to process data to ensure that we are complying with our legal obligations. For example, it is required to check a worker’s right to work in the UK, to deduct tax, to comply with health and safety laws and to enable employees to take periods of leave to which they are entitled. For certain positions, it’s necessary to carry out criminal records checks to ensure that individuals are permitted to carry out the role in question.

In other cases, We Are Family has a legitimate interest in processing personal data before, during and after the end of the working relationship. Processing staff data allows the organisation:

a) To run recruitment and talent management processes;

b) To maintain accurate and up-to-date staff records and contact details (including details of who to contact in the event of an emergency), and records of contractual and statutory rights;

c) To operate and keep a record of disciplinary and grievance processes, to ensure acceptable conduct within the workplace;

d) To operate and keep a record of employee performance and related processes and workforce management processes;

e) To operate and keep a record of absence and absence management procedures, to allow effective workforce management and ensure that employees are receiving the pay and other benefits to which they are entitled;

f) To obtain occupational health advice, to ensure that it complies with duties in relation to individuals with disabilities, meet its obligations under health and safety law, and ensure that workers are receiving the sick pay or other benefits to which they are entitled;

g) To operate and keep a record of other types of leave (including maternity, paternity, adoption, parental and shared parental leave) to allow effective workforce management, to ensure that We Are Family complies with duties in relation to leave entitlement, and to ensure that workers are receiving pay or other benefits to which they are entitled;

h) To ensure effective general HR and business administration;

i) To provide references on request for current or former employees;

j) To respond to and defend against legal claims;

k) To comply with our statutory and regulatory obligations;

l) To maintain and promote equality, diversity and inclusion in the workplace.

3.4 We use personal information about We Are Family membership applicants and members for the following purposes:

a) To validate your membership;

b) To administer and manage our membership;

c) To design and deliver an appropriate service for our members. As you become more involved with us, we may ask you for more information about yourself and your circumstances so that we can provide you with a more tailored service. We will explain why we need the information at the point of collection.

d) To provide information of benefit to We Are Family members including about We Are Family and other organisations’ activities, about We Are Family blog postings, and about things affecting adoptive families;

e) To identify members when they contact We Are Family;

f) To allow We Are Family to run We Are Family events (including notifying members about events) and to provide access to various means of support;

g) To compile non-identifying statistical information on the membership of We Are Family (for instance, about the gender, race, disability and sexual orientation representation within our membership) which helps us to better understand who uses our services, guides us in our work and helps with future We Are Family fund-raising; and

h) To identify members who have similar circumstances (for example, single or LGBTQ adopters in the same We Are Family group or area) where the relevant members have consented to such identification (we only actually connect such members where each has then specifically agreed to this).

i) To comply with our legal obligations, policies and procedures, for example claiming Gift Aid.

3.5 We use personal information about people who have registered with us to receive information for the following purposes:

a) To provide information of the type requested;

b) To administer and manage our information provision service;

c) To identify such people when they contact We Are Family; and

d) To compile non-identifying statistical information about such people (which helps us to better understand who uses our services, guides us in our work and helps with future We Are Family fund-raising).

3.6 We use personal information when you make a donation:

a) To process your donation;

b) To comply with our legal obligations around claiming Gift Aid.

3.7 We use personal information about our current and former employees, trustees and volunteers appropriate to the roles they fulfil. This allows We Are Family to fulfil its regulatory responsibilities and to administer the operation of the We Are Family Board of Trustees.

3.8 Please note that We Are Family operates a Facebook page, available at https://www.facebook.com/wearefamilyadoption, which is primarily controlled and operated by Facebook Inc. and its affiliates (‘Facebook’) and that any information collected about you via the Facebook group will be used in accordance with Facebook’s privacy notice and cookie notice (available on Facebook’s website). Facebook may use this page to place cookies on your device. Please see our Cookie Notice at www.wearefamilyadoption.org.uk/cookie-policy/ or further information about cookies generally and how you can opt out from them. We encourage you to read Facebook’s privacy notice and cookie notice if you access our Facebook group.

4  Legal basis for processing personal information

4.1 Our legal basis for collecting and using the personal information described above will depend on the information concerned and the specific context in which we collect it.

4.2 Where We Are Family is relying on legitimate interest as a reason for processing employee data, we have considered whether, by collecting the data, the charity is overriding the rights and freedoms of our employees and workers and have concluded that we are not.

4.3 We will normally collect personal information from you only where we have your consent to do so, or where the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms, or (in some cases) where we need the personal information to perform a contract with you. We may also have a legal obligation to collect personal information from you or may otherwise need the personal information to protect your vital interests or those of another person.

4.4 If we ask you to provide personal information to comply with a legal requirement or to perform a contract with you, we will make this clear at the relevant time and advise you whether the provision of your personal information is mandatory or not (as well as of the possible consequences if you do not provide your personal information). Similarly, if we collect and use your personal information in reliance on our legitimate interests (or those of any third party), we will make clear to you at the relevant time what those legitimate interests are.

4.5 Sensitive data (such as information about health status, sexual orientation or religious beliefs) should not generally be obtained, held, used or disclosed, unless the individual (the ‘data subject’) has given explicit consent. This means that the data subject must have been fully informed of the intended processing and has indicated their agreement. Where we process sensitive information about you, we will always obtain your consent to do so. In most instances, consent to process sensitive data for a We Are Family member is obtained when that person enters into employment with us or completes the membership application form. Where we collect sensitive information about a We Are Family member after he or she has become a We Are Family member, consent will be appropriately sought.

5  Data retention

5.1 We retain personal information we collect from you where we have an ongoing legitimate need to do so (for example, for employment purposes, to provide you with our services or to comply with applicable legal, tax or accounting requirements). When we have no ongoing legitimate need to process your personal information, we will delete, shred or anonymise it.

5.2 If you do not wish to continue your membership of We Are Family, your personal information will be deleted, shredded and/or anonymised. If we consider that a member is no longer active (for example, where contact cannot be made), information will be deleted, shredded or anonymised. We Are Family reviews the information held about its members on a regular basis.

6  Data security

6.1 We Are Family uses appropriate technical and organisational measures to protect the personal information that we collect and process about you. The measures we use are designed to provide a level of security appropriate to the risk of processing your personal information.

6.2 We Are Family recognises that photographs and other images of members and their families can present a serious risk to privacy. For this reason, We Are Family will not take or use any image of a member or of anyone in his or her family unless explicit consent has been obtained. Photography or video recording at any We Are Family event is strictly controlled.

7  Your data protection rights

7.1 You have the following data protection rights:

a) If you wish to access, correct, update or request deletion of your personal information, object to processing of your personal information, ask us to restrict processing of your personal information or request portability of your personal information, you can contact us at any time by using the contact details below.

b) If we have collected and processed your personal information with your consent, then you can withdraw your consent at any time. This includes your right to opt out of any emails we may send you at any time, although if you are a We Are Family member and opt out of receiving all emails from us we will treat that as you ending your membership of We Are Family. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent.

c) You have the right to complain to a data protection authority about our collection and use of your personal information. Your local data protection authority is the Information Commissioner’s Officer (https://ico.org.uk/).

7.2 We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws.

8  Disclosure of data

8.1 We Are Family will ensure that your personal information is not disclosed to unauthorised third parties, including other family members, friends, government bodies and, in certain circumstances, the police, unless otherwise permitted under the statements below:

a) You have given consent (for example, to be contacted by another member);

b) Where disclosure is required to allow a requested service to be provided (for example, where you have specifically requested information about a particular service);

c) Where We Are Family is legally obliged to disclose the data (for example, in relation to a Charity Commission inspection or inquiry, police investigations or under a court order);

d) Where disclosure of data is required for the performance of a contract (although this will be unusual in relation to We Are Family); and

e) Where We Are Family becomes aware of a child or vulnerable adult protection concern and decides to inform the relevant authorities (see We Are Family’s Safeguarding Policy).

8.2 As an alternative to disclosing personal data, We Are Family may offer to send a message asking you to contact the enquirer; or accept an incoming email message and attempt to forward it. We Are Family will not accept sealed envelopes or packets for forwarding to members or anyone else. Due to the many sensitivities of adoption, We Are Family will not forward unknown messages or materials to members or anyone else.

9  International transfers

9.1 We Are Family’s database servers are located within the United Kingdom. However, your personal information may be transferred to, and processed in, countries other than the United Kingdom. These countries may have data protection laws that are different to the UK.

9.2 Specifically, our website servers are located in the United Kingdom and our third party service providers operate around the world. We have taken appropriate safeguards to require that your personal information will remain protected in accordance with this Policy.

10 Changes to Privacy Notice

We may update this Notice from time to time in response to changing legal, technical or operational developments. We will obtain your consent to any material changes if and where this is required by applicable data protection laws. You can see when this Notice was last updated by checking the ’last updated‘ date shown at the end of this Notice.

11  Contacting We Are Family

If you have any questions or concerns about our use of your personal information, please contact us at: hello@wearefamilyadoption.org.uk.

Last updated: April 2021