Privacy policy

Amazing Futures is the young people’s project run by Amaze.

Amaze is a charity that supports children and young people with special educational needs and disabilities (SEND) in Brighton & Hove and East Sussex.

Amaze was registered as a charity in 1997. Its charity number is 1078094.

Find out more about Amaze.

Amaze takes your privacy seriously. This Privacy Policy sets out how we will use and store your data, in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Regulators Code of Fundraising Practice (2016).  Amaze is registered with the Information Commissioners Office (ICO).

Amaze operates the following websites:

• Amaze Sussex – AmazeSussex.org.uk
• Amazing Futures Sussex – AmazingFuturesSussex.org.uk
• Pacc Brighton – PaccBrighton.org.uk
• ESPCF – ESPCF.org.uk

At the bottom of each website there is a link to the privacy statement for that website. These will tell you what information Amaze gathers from visitors to our websites, and what we do with it.

We collect and process the following information:

• Name and contact details
• Diversity information about you such as gender, ethnicity, religion, disabilities, sexual orientation and age or age range
• Details about your health issues
• Details about your school, college and GP
• If we are helping you to apply for benefits, we may need to ask for information such as your hospital number, national insurance number and bank details for you to receive payments.

Directly from you

Most of the personal information we collect and process is given to us directly by you so we can give you a service.

We do this based on UK laws on your consent and legitimate interests.   We will always ask for your consent to store and process your personal information once you are 16 or over. You can give this consent verbally or in writing. You can remove your consent at any time. You can do this by telling a member of the Amazing Futures team or email Amaze at Info@AmazeSussex.org.uk.

Indirectly, from others

We may also get personal information from the following sources:

• If we are working with your parent carer, we may get personal information directly from them, as long as they have Parental Responsibility for you. If you are over 16, we will ask your parent/carer to check with you that you consent to us processing your data.  If you are over 16 and unable to make this decision because of your learning disabilities, we follow the Mental Capacity Act 2005 and get consent from the appropriate decision maker. This is usually your parent or main carer.
• From an organisation or professional who is referring you to our services. They must get consent from you first, before they pass us your data.  We will ask for your contact details, and details about why they are referring you.
• From other agencies working with you. If we are helping you apply for benefits, or appeal against a benefits decision, we may need more information.  With your consent, we may gather supporting information on your behalf such as clinic letters, assessments, reports and therapy programmes.

We will use your personal information to provide services or information to you. We may also put together your personal details with other people’s, to create anonymised data for general reporting. This reporting could be about our work and the impact it has, or to identify and provide trends about the needs of young people with SEND and their families.

No.

Unless we have your permission to do so, we won’t share your personal information with any organisations or people outside of Amaze.

The only exception would be where a failure to share your personal information would lead to a risk of significant harm to you or others.

Sometimes we will need your consent to pass on personal information to submit or process applications on your behalf e.g. for PIP claims or for a job application, etc. In law, these are called ‘legitimate interests’. Legitimate interests are instances where a person would reasonably expect us to use their information.

We will never sell, rent, or trade your personal data.

We will ask you for basic personal information such as name and contact details so we can support you. We will also collect diversity information (for example your age, gender, sexuality etc.) for anonymised reports to our funders.

This means that information from lots of people is grouped together and not connected to any identifying details like your name. For example, we could share how many LGBTQ young people we support, but we would not share any details that could be used to identify whether a specific young person is LGBTQ, like their name or address.

If we need to share information, for example with a benefits application, we will ask you to consent to this separately.

If you use our Amazing Futures service (or ND Family Support Service or Parent groups & befriending) we will ask for some extra consent. This is because these services receive funding from the NHS.

The NHS asks us to share anonymised information about people using our services so that they can check how well we are working.

If you consent, your data will be shared very securely, electronically.

You can choose whether to allow NHS data sharing, and we check with you before we do this.  For more details of what is shared, please see this page on our parent carer website: NHS data sharing

While they are supporting you, staff may email you. If you would rather not be contacted in this way, please let us know.

If you live in Brighton & Hove and have a Compass Card, you may opt in to receive the Compass e-newsletter. You can unsubscribe from this newsletter at any time.

We use a separate fundraising database called Beacon CRM.  We always ask for specific consent to communicate with you about fundraising.  We do not hold bank account or card details, we use third party software to do this.   We do keep a record of what you have donated and any direct debit reference.  The lawful bases for processing your data are ‘consent’, ‘legitimate interests’ and ‘contract’.  We will process your data on our fundraising database if:

• you have consented to receive communications about Amaze fundraising
• you are fundraising for Amaze
• you have donated to Amaze through a third party site such as ‘Just Giving’ and agreed to share your details with us
• you have contacted us directly about making a donation or leaving a legacy, or
• you have taken part in the Amaze Lottery

The Amaze Lottery is hosted by a third party, Sterling Management Centre Ltd, trading as Unity.  When you sign up to the lottery, you agree to their privacy policy which can be viewed here: Unity privacy policy.

From their site you can choose how Amaze communicate with you about fundraising.  All personal data, except bank details, are passed securely from Unity to Amaze to be stored safely on our fundraising database.

All your personal details are input carefully and stored securely on a database called Charitylog.  We may also sometimes store your data in Excel spreadsheets on the Amaze server.  Email addresses may also be stored on ‘Brevo’, which we use to send bulk email messages.

We scan and save other documents (reports, letters etc.) into the secure Amaze electronic filing system. We are trying to move to a paperless office, but if we are given hard copies that include personal data, we store them in locked filing cabinets before we return or shred them.

Sometimes you may be asked to visit a different organisation’s website, for example to complete a survey, enrol on a workshop, or submit a form.  Where possible we minimise the amount of personal data we ask for, and we check the website’s security meets UK GDPR before asking you to use it.

We follow national best practice and how long we keep things for varies according to the type of the record:

Casework records

Records held by Amaze about you will be made inactive and anonymised by removing all personal data after seven years of our last contact with you.  We keep records for this period to help us keep supporting you as you grow and develop.

Non-casework records and exceptions

For support that isn’t casework, for example, having a Compass Card, records will be anonymised three years after the Compass Card has expired or the last contact with us.

Once you are 25 years old and we no longer support you, your records will be anonymised after three years.

You can ask to see the personal information that Amaze holds about you. This is called a subject access request. You can choose to get that information in paper or electronic form.

• You have the right to ask us to correct any mistakes in the personal information that we hold about you.
• You can reuse your personal information however you wish, e.g. to give it to another organisation.
• You can ask us to delete any of your data, or restrict how we use it.

We follow strict GDPR guidelines and our internal policies whenever we handle your data. You also have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You can find more information about GDPR on the ICO website. You don’t need to pay for exercising your rights around data. If you make a request, we have one month to respond to you. Contact us at Info@AmazeSussex.org.uk.