2. Who We Are

Spring Together CIC is a Community Interest Company registered in England and Wales (Company No. 17213161), based in Chadderton, Oldham. We are the "data controller" responsible for your personal data collected through this Website.

3. Information We Collect

We may collect and process the following categories of personal data, depending on how you interact with us:

Information You Give Us Directly

• Contact details, such as name, email address, phone number, and postal address, when you fill in a contact form, sign up for a session, or make an enquiry
• Information provided on programme registration or consent forms, such as details of a child or dependant, emergency contact information, and relevant medical or access needs
• Content you submit, such as messages, testimonials, or feedback
• Payment or donation details, where you make a payment or donation to us (processed securely by our payment provider; we do not store full card details)

Information We Collect Automatically

• Technical data, such as your IP address, browser type and version, device type, and operating system
• Usage data, such as pages visited, time spent on the Website, and how you arrived at our Website
• Cookies and similar technologies, as described in Section 6 below

Information From Third Parties

• Where relevant, information shared with us by partner organisations, funders, or referral agencies in connection with a programme you are taking part in, always with appropriate lawful basis

4. How We Use Your Information

We only use your personal data where we have a lawful basis to do so under UK GDPR. The table below sets out our main purposes for processing and the relevant lawful basis.

Where we rely on your consent, for example for marketing emails, you may withdraw that consent at any time by contacting us or using the unsubscribe link in any email.

5. Sharing Your Information

We do not sell your personal data. We may share your information with the following categories of recipients, only where necessary and always subject to appropriate safeguards:

• Trusted service providers who support our operations, such as website hosting, email, and payment processing providers, under data processing agreements
• Funders or partner organisations, where required to report on programme outcomes, usually in an anonymised or aggregated form unless you have consented to identifiable reporting
• Statutory agencies, such as children's social care, the police, or the Local Authority Designated Officer, where required for safeguarding purposes
• Professional advisers, such as our accountants or legal advisers, where necessary for the running of the organisation
• Regulatory or law enforcement bodies, where we are required to do so by law

We require any third party we share data with to respect the security of your personal data and to treat it in accordance with the law.

6. Cookies and Tracking Technologies

Our Website uses cookies and similar technologies to distinguish you from other users, improve your browsing experience, and understand how our Website is used.

When you first visit our Website, you will be shown a cookie banner allowing you to accept or reject non essential cookies. You can also manage or delete cookies at any time through your browser settings. Blocking some cookies may affect the functionality of the Website.

7. International Transfers

Some of our third-party service providers may be based, or store data, outside the United Kingdom. Where this is the case, we ensure appropriate safeguards are in place, such as the UK's International Data Transfer Agreement, adequacy regulations, or equivalent contractual protections, to ensure your data is protected to a standard consistent with UK GDPR.

8. Data Retention

We only keep your personal data for as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements.

• General enquiry and contact form data is typically retained for up to 12 months
• Programme registration and safeguarding records are retained in line with statutory safeguarding retention requirements, which may be significantly longer (in some cases until the individual's 25th birthday for records relating to children)
• Marketing consent records are retained until you withdraw consent or unsubscribe
• Financial and donation records are retained for a minimum of 6 years to meet HMRC and accounting requirements

Where data is no longer needed, it is securely deleted or anonymised.

9. Data Security

We take the security of your personal data seriously and have put in place appropriate technical and organisational measures to protect it against unauthorised access, alteration, disclosure, or destruction, including:

• Secure, password-protected systems with role-based access limited to those who need it
• Encryption of data in transit on our Website (HTTPS)
• Regular review of our data protection practices and staff and volunteer training on data handling and confidentiality

While we take reasonable steps to protect your data, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

10. Your Rights Under UK GDPR

You have the following rights in relation to your personal data. To exercise any of these rights, please contact us using the details in Section 2.

1. Right to be informed — to know how your data is being used, as set out in this policy
2. Right of access — to request a copy of personal data we hold about you
3. Right to rectification — to ask us to correct any inaccurate or incomplete data
4. Right to erasure — to ask us to delete your data, where there is no compelling reason for us to continue processing it
5. Right to restrict processing — to ask us to limit how we use your data in certain circumstances
6. Right to data portability — to request your data in a portable, machine-readable format, where applicable
7. Right to object — to object to our processing of your data, including for direct marketing purposes
8. Rights related to automated decision-making — we do not currently use automated decision-making or profiling that has a legal or similarly significant effect on you

We will respond to any request within one calendar month. If you are unhappy with how we have handled your data, you also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at www.ico.org.uk or by calling 0303 123 1113.

11. Children's Privacy

Many of our programmes are designed for children and young people, and we take particular care with any personal data relating to them. Where a child is under 13, we rely on parental or guardian consent to collect and process their personal data, gathered through our Parental/Guardian Consent Form process. We do not knowingly collect personal data directly from children through the Website without appropriate parental consent. If you believe we have inadvertently collected data from a child without appropriate consent, please contact us so we can address this.

12. Marketing Communications

We will only send you marketing communications, such as newsletters or updates about our programmes, where you have opted in to receive them, or where permitted under the "soft opt-in" rules for existing relationships. You can opt out at any time by clicking "unsubscribe" in any email or by contacting us directly. Opting out of marketing does not affect essential communications relating to a service or programme you are taking part in.

13. Links to Other Websites

Our Website may contain links to third-party websites, such as social media platforms or partner organisations. We are not responsible for the privacy practices or content of those websites, and we encourage you to review their privacy policies before providing any personal data.

14. Changes to This Policy

We may update this policy from time to time to reflect changes in our practices or legal requirements. Any changes will be posted on this page with an updated effective date. We encourage you to review this policy periodically.

15. Contact Us and Complaints

If you have any questions about this policy or how we handle your personal data, or wish to exercise any of your rights, please contact us:

If you remain unsatisfied with our response, you have the right to raise a concern with the Information Commissioner's Office (ICO), the UK's independent regulator for data protection, at www.ico.org.uk.