Privacy Notice

---

INTRODUCTION

This is First for Fostering Ltd’s ‘Privacy Notice’.

This Privacy Notice will inform you how First for Fostering Ltd (”we”, “our”, “us”, “the Company”) handles Personal Data.

This Privacy Notice applies to all personal data we process regardless of the media on which that data is stored or whether it relates to past or present; employees, workers, clients or supplier contacts, shareholders, website and/or social media users or any other data subject. 

This Privacy Notice will also tell you about your privacy rights and how the law protects you. 

First for Fostering respects your privacy and is committed to protecting your personal data. 

1. Important information and who we are
2. The data we collect about you
3. How your personal data is collected
4. How we use your personal data
5. Disclosures of your personal data
6. Data security
7. Data retention
8. Your rights in connection with personal information
9. Visiting our Website and/or social media sites and the use of cookies
10. Interpretations

1 IMPORTANT INFORMATION AND WHO WE ARE

1.1 Purpose of this Privacy Notice

This Privacy Notice aims to give you information on how we collect and process your personal data through your use of our website, any of our social media sites or any other means, including any data you may provide if you choose to contact us through our website and/or any of our social media sites.

It is important that you read this Privacy Notice together with any other Privacy Notice we may provide on specific occasions when we are collecting or processing personal data about you, so that you are fully aware of how and why we are using your data. 

This Privacy Notice supplements other notices and is not intended to override them.

1.2 Controller

We are the controller and responsible for your personal data.

We have appointed a Data Protection Officer (DPO) who is responsible for overseeing questions in relation to this Privacy Notice.  If you have any questions about this Privacy Notice, including any requests to exercise your legal rights, please contact the Data Protection Officer using the details set out within this document.

1.3 Contact details

Our details for contact are:

Company name: First for Fostering Ltd

Email address: DPO@firstforfostering.co.uk

Postal address: 181 Coniscliffe Road, Darlington, Co Durham, DL3 8DE

1.4 Changes to the Privacy Notice and your duty to inform us of changes

We may from time to time, change this notice by updating the notice on the company website.  You should check our website from time to time to ensure that you are aware of the current notice and are happy with any changes that have been made. 

Each Privacy Notice shall have an effective date.  This notice is effective from 26 September 2022

It is important that the personal data we hold about you is current and accurate. It is therefore important that you keep us informed if your personal data changes during your relationship with us.

1.5 Third party links

Our website and social media sites may include links to third party websites, social media sites, plug-ins, applications etc.  Clicking on those links or enabling those connections may allow third parties to collect or share data about you.

We may not control these third party websites, social media sites, plug-ins and applications and are therefore not responsible for their privacy notices.  We cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites.  

You should exercise caution when visiting third party websites, social media sites, plug-ins, applications etc and ensure that you read the privacy notice of each that you visit.

2 THE DATA WE COLLECT ABOUT YOU

2.1 Types of information

Types of Personal data, or personal information, means any information about an individual from which that person can be identified.  It does not include data where the identity has been removed (anonymous data).

We may use, store, collect and transfer different kinds of personal data about you which we have grouped together. Examples of which are:

a) Your Contact Details & Identity

• includes your name
• postcode
• email address
• telephone and/or mobile numbers.

b) Your Profile Data

• includes your employment title
• preferences
• interests
• message
• enquiry and feedback.

c) Technical Data

• includes internet protocol (IP) address
• browser type and version
• time zone and location
• browser plug-in types and version
• operating system, platform and other information about the device and technology you use to access our website and/or social media sites.

d) Usage Data

• includes information about when and how you use our website
•  Includes information about when and how you use or social media and other services.

e) Marketing & Communication Data

• includes your preferences for receiving marketing information from us 
• included your preferences for receiving communication preferences from us.

We do not knowingly collect Special Categories of Personal Data about you (such as details about your ethnicity or race, religious beliefs or your health).

2.2 If you fail to provide personal data to us

If when registering an interest in our company, you do not provide us with accurate and relevant contact details for you, this will affect our ability to contact you.

We would therefore not be able to take your enquiry further.

3 HOW YOUR PERSONAL DATA IS COLLECTED

3.1 Methods

We use different methods to collect data from and about you, including:

- Direct interactions – A few examples are; you may provide us with your identity and contact details by filling in a form through our website, on our social media sites or through email in which you express your interest to contact us. 

This may include personal data which you provide when you carry out the following:

a) Make an enquiry

b) Register your interest in our company (e.g. if you wish to form a relationship with us or work for or with us)

c) Request marketing to be sent to you; or

d) Provide feedback to us.

- Automated technologies or interactions – As you interact with our website and/or social media sites, we may automatically collect Technical Data about equipment, browsing actions and patterns about you. We may collect this personal data by using server logs, cookies, and/or other similar technologies.

3.2 Purposes for which we will use your personal data

We have set out below examples of the way we plan to use your personal data:

• To register your enquiry and interest
• To arrange a response to you
• To manage our relationship with you
• To deliver relevant website and social media content to you
• To administer and protect our business, our website & social media sites (including troubleshooting, testing, system maintenance, data analysis, support, reporting and hosting of data)
• To carry out market research for the company
• To improve our, products/services, marketing, customer relationships, experiences, website and social media sites.

4 HOW WE USE YOUR PERSONAL DATA

4.1 Our basis for using your information

We will only use your personal data when the law allows us to.  Most commonly, we will use your personal data in the following as follows:

• Where we need to comply with a legal or regulatory obligation.
• Where we need to take steps to enter a potential contract with you.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.

We may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your information.

Where it is necessary for our legitimate interests to use your personal data, we have listed below what our legitimate interests are:

• Internal record keeping
• To define types of customers for our products and services
• For running our business, provision of administration and IT services, network security, to prevent fraud
• To undertake marketing
• To study how our customers/suppliers use our products/services
• To expand our business
• To develop products/services
• To keep our website and social media sites relevant and current.

We rely on consent as a legal basis for processing your personal data if we are sending marketing communications to you. You have the right to withdraw your consent to our marketing at any time. If you wish to exercise this right, please contact us.

4.2 Marketing 

We provide everyone choices regarding certain personal data uses, particularly around our marketing and advertising.

We may occasionally send promotional emails, social media posts and other marketing offers about our new products, special offers or other information which we think you may find interesting to your email address and/or social media accounts which you have provided us.

You will receive marketing communications from us if you have requested such information from us and you have not opted out of receiving that marketing communication. You can ask us to stop sending you marketing communications at any time. If you wish to exercise this right, please contact us.

4.3 Cookies

You can change your web browser settings to refuse all or some browser cookies. You can also ensure that your browser alerts you when websites set or access cookies.  If you chose to disable or refuse cookies on your browser, please note that some parts of our website and or social media sites may not function as intended or become inaccessible.

4.4 Change of purpose 

First for Fostering will only use your personal data for the purposes for which we have collected it and for the purpose which you supplied the personal data, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose or to meet our legal compliance obligations.

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules and/or where this is required or permitted by law.

5 DISCLOSURES OF YOUR PERSONAL DATA

We may need to share your personal data with certain parties for the purposes set out within this notice.  Those third parties are as follows:

• Other companies or consultants within our company for reasons such as IT and system administration services as well as reporting activities
• Service providers who support our website, social media sites or supply IT and system administration services
• Partnering companies, consultants or other entities that assist us to provide or improve our services (e.g. analysing and modelling statistics/data)
• Regulators, police, government bodies or to otherwise comply with the law.

We require all third-party service providers, consultants and other entities to respect the security of your personal data and to treat it in accordance with the law.  

We do not allow our third-party service providers, consultants or other entities to use your personal data for their own purposes.  We only permit third parties to process your personal data for specified purposes and in accordance with our instructions.

6 DATA SECURITY

We have appropriate security measures to prevent your personal data from being accidentally lost, shared, used or accessed in an unauthorised way, altered or disclosed.  

We also limit access to your personal data to those employees, agents, contractors, consultants and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so. 

If you know or suspect that a Personal Data Breach has occurred, do not attempt to investigate the matter yourself. Contact us immediately. You should preserve all evidence relating to the potential Personal Data Breach.

7 DATA RETENTION

Unless we notify you otherwise in writing, we will hold your personal information based on the following:

• Retention period in-line with all regulatory & legal requirements or guidance
• For as long as we have a reasonable business need to, e.g managing our relationship with you
• For as long as someone could bring a claim against the company.

8 YOUR RIGHTS IN CONNECTION WITH PERSONAL INFORMATION

Below is a detailed list of your rights under data protection laws. They do not apply in all cases, should you exercise any of your rights, we will explain to you in writing whether or not they do.

The right to:

• request the transfer of your  personal information to another party (“data portability”)
• be informed about the processing of your personal information
• have your personal information corrected if it is inaccurate and to have incomplete personal information completed
• restrict processing of your personal information
• have your personal information erased (the “right to be forgotten”)
• object to processing of your personal information
• request access to your personal information and to obtain information about how we process it.

If you wish to exercise any of these rights, please contact us.

You further have the right to make a complaint at any time to the Information Commissioner’s Office, ICO, the UK supervisory authority for data protection issues (www.ico.org.uk). 

We would, however, appreciate the chance to deal with any of your concerns before you approach the Information Commissioner’s Office, so please contact us in the first instance.

9 VISITING OUR WEBSITE and/or SOCIAL MEDIA SITES AND THE USE OF COOKIES

You can visit and browse our website and/or social media sites without disclosing any personal information about yourself, should you wish. Our website and social media sites may use cookies. Cookies are small files of letters and numbers that are stored on your computer, should you agree. They help us to distinguish you from other visitors to our website and help us to provide you with a good experience when you browse our website and/or social media accounts.

Some of the cookies we use are analytical cookies which allow us to count the number of people that visit our website and other social media accounts, and also allows us to see where they are visiting from. We use Google Analytics to help us do this.

The company takes the requirements of GDPR seriously in ensuring the privacy and lawful processing of personal data provided to us.

10 INTERPRETATION

10.1 DEFINITIONS:

Automated Decision-Making (ADM): when a decision is made which is based solely on Automated Processing (including profiling) which produces legal effects or significantly affects an individual. The GDPR prohibits Automated Decision-Making (unless certain conditions are met) but not Automated Processing.

Automated Processing: any form of automated processing of Personal Data consisting of the use of Personal Data to evaluate certain personal aspects relating to an individual, in particular to analyse or predict aspects concerning that individual’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements. Profiling is an example of Automated Processing.

Company name: First for Fostering Ltd.

Company Personnel: for the purposes of this standard means all visitors to our website and or social media sites, prospective employees, employees, workers, contractors, agency workers, consultants, children and young people, prospective foster carers, foster carers, directors, members and others.

Consent: agreement which must be freely given, specific, informed and be an unambiguous indication of the Data Subject’s wishes by which they, by a statement or by a clear positive action, signifies agreement to the Processing of Personal Data relating to them.

Data Controller: the person or organisation that determines when, why and how to process Personal Data. It is responsible for establishing practices and policies in line with the GDPR. We are the Data Controller of all Personal Data relating to our Company Personnel and Personal Data used in our business for our own commercial purposes.

Data Subject: a living, identified or identifiable individual about whom we hold Personal Data. Data Subjects may be nationals or residents of any country and may have legal rights regarding their Personal Data.

Data Privacy Impact Assessment (DPIA): tools and assessments used to identify and reduce risks of a data processing activity. DPIA can be carried out as part of Privacy by Design and should be conducted for all major system or business change programs involving the Processing of Personal Data.

Data Protection Officer (DPO): the person required to be appointed in specific circumstances under the GDPR. Where a mandatory DPO has not been appointed, this term means a data protection manager or other voluntary appointment of a DPO or refers to the Company data privacy team with responsibility for data protection compliance, or the Board of Directors.

EEA: the countries in the EU, and Iceland, Liechtenstein and Norway.

Explicit Consent: consent which requires a very clear and specific statement (that is, not just action).

General Data Protection Regulation (GDPR):  the General Data Protection Regulation ((EU) 2016/679). Personal Data is subject to the legal safeguards specified in the GDPR.

Personal Data: any information identifying a Data Subject or information relating to a Data Subject that we can identify (directly or indirectly) from that data alone or in combination with other identifiers we possess or can reasonably access. Personal Data includes Sensitive Personal Data and Pseudonymised Personal Data but excludes anonymous data or data that has had the identity of an individual permanently removed. Personal data can be factual (for example, a name, email address, location or date of birth) or an opinion about that person’s actions or behaviour.

Personal Data Breach: any act or omission that compromises the security, confidentiality, integrity or availability of Personal Data or the physical, technical, administrative or organisational safeguards that we or our third-party service providers put in place to protect it. The loss, or unauthorised access, disclosure or acquisition, of Persnal Data is a Personal Data Breach.

Privacy by Design: implementing appropriate technical and organisational measures in an effective manner to ensure compliance with the GDPR.

Privacy Guidelines: the Company privacy/GDPR related guidelines provided to assist in interpreting and implementing this Privacy Standard and Related Policies, available and accessible, as directed by the Company, from time to time.

Privacy Notices (also referred to as Fair Processing Notices) or Privacy Policies: separate notices setting out information that may be provided to Data Subjects when the Company collects information about them. These notices may take the form of general privacy statements applicable to a specific group of individuals (for example, employee privacy notices or the website privacy policy) or they may be stand-alone, one-time privacy statements covering Processing related to a specific purpose.

Processing or Process: any activity that involves the use of Personal Data. It includes obtaining, recording or holding the data, or carrying out any operation or set of operations on the data including organising, amending, retrieving, using, disclosing, erasing or destroying it. Processing also includes transmitting or transferring Personal Data to third parties.

Pseudonymisation or Pseudonymised: replacing information that directly or indirectly identifies an individual with one or more artificial identifiers or pseudonyms so that the person, to whom the data relates, cannot be identified without the use of additional information which is meant to be kept separately and secure.

Related Policies: The Company’s policies, operating procedures or processes related to this Privacy Notice and designed to protect Personal Data, available and accessible, as directed by the Company, from time to time.

Sensitive Personal Data: information revealing racial or ethnic origin, political opinions, religious or similar beliefs, trade union membership, physical or mental health conditions, sexual life, sexual orientation, biometric or genetic data, and Personal Data relating to criminal offences and convicti