Privacy Policy

CHILDREN AND FAMILIES ACROSS BORDERS (“CFAB”)

October 2022

Purpose:

CFAB is sensitive to privacy issues, and it is important to us to protect the information you provide. Accordingly, CFAB provides this privacy and information practices policy (“Privacy Notice”) to inform you about the kinds of information we may collect, how we intend to use and share that information, and how you can correct or amend such information.

CFAB and any third party that has data sharing arrangements with CFAB (“Third Party”) (each to be referred to as a “Party” in this Privacy Notice) shall adhere to the terms of the Privacy Notice.

Scope:

This Privacy Notice relates to the following data sharing arrangements:

· Where a Party exercises overall control over the purposes and means of the processing of Personal Information [1], such Party will be deemed to be a data controller for the purpose of the data sharing arrangement (“Controller”);

· Where a Party acts on behalf of, and only on the instructions of, another Party who is a Controller, that Party will be deemed to be a data processor of Personal Information for the purpose of the data sharing arrangement (“Processor”); and

· Where two or more Controllers jointly determine the purposes and means of the processing of the same Personal Information, they will be deemed to be joint controllers for the purpose of the data sharing arrangement (“Joint Controllers”).

If CFAB is a Controller of data under a data sharing arrangement with a Third Party, CFAB shall ensure that its processing of Personal Information(including any processing carried out by a processor on CFAB’s behalf) shall be compliant with the applicable requirements of Regulation (EU) 2016/679 (“GDPR”), the GDPR as it forms part of the laws of the UK (“UKGDPR”) and the legislation implementing GDPR in EU member states (“Member State Legislation”) (together the “Data Protection Legislation”).

If CFAB is a Processor of Personal Information under a data sharing arrangement with a Third Party, CFAB shall ensure that is compliant with applicable Data Protection Legislation.

If CFAB is a Joint Controller under a data sharing arrangement with aThird Party, each Party under such data sharing arrangement intends to:

· Ensure that is compliant with applicable Data Protection Legislation;

· Only collect and use the personal data for the purposes that have been agreed or are clearly implied by the circumstances;

· Not transfer or disclose the personal data to third parties without the consent of the other unless it has already been agreed or is clearly implied by the circumstances;

· Not transfer the personal data to other countries without first notifying the other unless the transfer has already been agreed or is clearly implied by the circumstances;

· Use, where appropriate, the International Data Transfer Agreement (the “IDTA”) to protect personal data being transferred outside the European Economic Area;

· Promptly notify each other of any data breaches, complaints or access requests in respect of the personal data and assist in resolving them; and

· Co-operate in meeting the standards contained in this code including, where appropriate, being audited on compliance procedures.

This Privacy Notice describes the ways CFAB manages Personal Information [1] it receives in the course of its operations that include but are not limited to the provision of child protection services and other social services (the “Services”). All Third Parties who process Personal Information on behalf of CFAB are required to protect such data by adherence to this Privacy Notice.

CFAB complies with the requirements of applicable Data Protection Legislation. CFAB adheres to the GDPR Principles of lawfulness, Fairness and transparency; purpose limitation; data minimisation; accuracy of information; storage Limitation; integrity and confidentiality (security); and accountability as set forth in this Privacy Notice.

What personal information we collect and how we use it:

The types of Personal Information we may collect depend on the nature of the relationship you have with CFAB and the requirements of applicable law. We do not engage in automated decision making when processing your personal data. Below are the legal bases for processing your Personal Information, some of the ways we collect information, and how we use it.

Data collected for the purpose of providing our services:

CFAB may collect the following Personal Information in order to provide the Services:

● Personal Information of the children, the relatives, and other adults (for example a family friend) to whom we provide the Services (such as name, date of birth, relevant medical information and contact details);

● Characteristics of the children and the relatives to whom we provide child protection services (such as gender, sex life, ethnicity, language, nationality and country of birth); and

● Personal Information of the employees of the local councils and other persons with whom we communicate for the purposes of providing the Services (such as name and contact details).

Data collected through our website:

CFAB may collect the following information:

● Your name;

● Contact information including email address;

● Demographic information such as postcode, preferences and interests; and

● Other information relevant to user surveys and/or offers.

How we use your personal information

We process Personal Information for a variety of purposes. The GDPR provides that we are allowed to use personal information only if we have a lawful basis for doing so, including sharing it outside of CFAB. For example, CFAB might process your Personal Information where necessary for our or a Third Party’s legitimate interests but only where your interests do not override these interests. The GDPR provides that we must have one or more of these reasons:

1. The data subject has given consent to the processing of his or her personal data for one or more specific purposes;

2. Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

3. Processing is necessary for compliance with a legal obligation to which the controller is subject;

4. Processing is necessary in order to protect the vital interests of the data subject or of another natural person;

5. Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

6. Processing is necessary for the purposes of the legitimate interests pursued by the Controller or by a Third Party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

What we use your personal information for?

We require Personal Information to understand your needs and provide you with a better service. In particular, we may need to gather information from you to:

● Provide child safeguarding services to vulnerable and at risk children and vulnerable adults;

● Provide casework services for child protection cases, including facilitating inter-country collaboration on international child protection casework;

● Provide affiliates, local councils and other providers of child protection and social services both inside and outside of the European Economic Area (together, “Approved Parties”) with information that enable them to carry out child safeguarding services and casework services for child safeguarding cases;

● Enable child protection alerts to be made to the relevant authorities regarding children at risk;

● Respond to questions and requests;

● Send you email or postal updates about our work according to your preferences;

● Develop and carry out marketing and fundraising activities;

● Process a donation or a monthly donation from you;

● Provide consulting and advisory services;

● Ensure compliance with relevant laws, regulations and standards; and

● Enable us to carry out our contractual obligations.

● When it is our legal duty, including in the public interest, or

● When itis in our legitimate interest, or

● When you consent to it.

● [Ensuring that children are placed in a permanent home]

● [Helping to safeguard children and vulnerable adults by providing social services]

● [Providing professional advice and support through our Advice Line]

● [Complying with regulations that apply to us]

● [Keeping our records up to date and working out which information/ services may interest you and telling you about them (in line with your preferences)]

Research:

● Sharing data with third party researchers (academic, governmental, non-governmental) to be used in research projects relating to [international social work and child protection]. Any personal data would be anonymised as early as possible in the analysis process and any published materials would be anonymised. The research purposes are likely to include:

● Mapping of cross border cases; and

● Identifying gaps or weaknesses in processing cross-border cases in an effort to improve outcomes.

● Analysis of demographical information;

● Reporting to our funders and supporters;

● Other research in line with our charitable objects;

● CFAB’s own research projects, including in line with the purposes outlined above

● When it is in our legitimate interest, or

● When you consent to it.

● Achieving better outcomes for children and families;

● Complying with funding or contract conditions.

Right to Opt-Out:

You have the right to opt-out of certain uses and disclosures of your Personal Information, as set out in this Privacy Notice. Where you have consented to CFAB’s processing of your Personal Information or Sensitive Personal Information, subject to applicable legal obligations, you may with draw that consent at any time and opt-out. Additionally, before we use Personal Information for any new purpose not originally authorized by you, we will provide information regarding the new purpose and give you the opportunity to opt-in to such secondary uses. If you choose not to opt-in to our secondary use of your Personal Information, we will not process it for that use.

Onward Transfer – Information We Share:

CFAB does not sell or otherwise disclose Personal Information about you, except as described in this Privacy Notice or as you explicitly consent. CFAB may share Personal Information with Approved Parties in order to be able to provide our services. CFAB requires the Approved Parties to agree to maintain confidentiality and security of Personal Information they maintain on our behalf, including to provide at least the same level of protection as required by applicable Data Protection Legislation, as applicable, not to use it for any purpose other than the purpose for which CFAB retained them and to notify CFAB if they make a determination that they can no longer comply with that obligation.

We may disclose information about you: (i) if we are required to do so by law, court order or legal process; or (ii) in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

Your Personal Information may be transferred to our partners and relevant authorities around the world. Any such transfer of Personal Information shall take place only in accordance with and as permitted by applicable Data Protection Legislation. CFAB takes steps to ensure that appropriate technical and organizational security measures and safeguards are applied when transferring Personal Information outside of the European Economic Area (EEA) and that privacy rights outlined in this Privacy Notice are preserved. For example, CFAB uses the IDTA to appropriately safeguard Personal Information shared with its non-EEA partners.

Individual Rights of Access and Choice:

Under certain circumstances, you have rights under data protection laws in relation to your personal data, these include the right to:

● Receive copies of Personal Information we maintain about you and to check that we are lawfully processing it;

● Request correction of your Personal Information;

● Request erasure of your Personal Information, for example, where there is no good reason for us continuing to process it;

● Request a transfer of your Personal Information to you or to another organization;

● Object to the processing of your Personal Information where we are relying on a legitimate interest and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms;

● Withdraw consent at any time for future processing if the processing of Personal Information is based on your consent; and

● Lodge a complaint with a data protection authority. The details for the UK data protection authority are included at paragraph 2.7.

These rights may be limited in some circumstances; for example, where we are required to process your Personal Information by law. If CFAB does determines that your rights are limited in any way, we will endeavour to provide you with an explanation of why that determination has been made and a contact point for any further inquiries. To protect your privacy, CFAB will take commercially reasonable steps to verify your identity before granting access to or making any changes to your Personal Information.

Retention:

CFAB retains Personal Information that we receive in order to fulfill the purpose(s) for which the information was collected and comply with all applicable laws and in accordance with our routine information storage policies. CFAB will retain the Personal Information that we have received for a maximum of 10 years following the conclusion of the case(s) to which the Personal Information relates, or until the youngest child in the case reaches the age of 24, whichever is longer, unless there is ongoing litigation or a similar reason that requires us to retain the Personal Information. Case files that are cancelled or service becomes unavailable after the referral is made will be kept for two years.

Security:

The security of all Personal Information provided to CFAB is important to us, and CFAB takes reasonable steps designed to protect your Personal Information. CFAB maintains administrative, technical and physical safeguards designed to protect Personal Information that is received against accidental, unlawful or unauthorized destruction, loss, alteration, access, disclosure or use.

Redress/Compliance and Accountability:

If you have any questions or comments regarding this Privacy Notice, CFAB privacy practices, or if you would like us to update information or preferences you provided to us, please contact us via email at info@cfab.org.uk.

CFAB will address your concerns and attempt to resolve any privacy issues in a timely manner and may contact individuals at CFAB’s Approved Parties to assist in completing your requested task.

Please be aware that you also have a right to contact the Information Commissioner’s Office (Tel: 0303 123 1113) with any concerns you may have.

Cookies - How we use cookies:

A cookie is a small file which asks permission to be placed on your computer's hard drive. Once you agree, the file is added and the cookie helps analyse web traffic or lets you know when you visit a particular site. Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences.

We use traffic log cookies to identify which pages are being used. This helps us analyse data about web page traffic and improve our website in order to tailor it to user needs. We only use this information for statistical analysis purposes and then the data is removed from the system.

We do not use third parties’ cookies:

Overall, cookies help us provide you with a better website, by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us.

You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of the website.

Links to other websites:

Our website may contain links to other websites of interest. However, once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question.

Changes to this Privacy Notice:

CFAB may update this Privacy Notice from time to time as it deems necessary or appropriate in its sole discretion. If there are any material changes to this Privacy Notice, CFAB will notify you by in a practical manner.

Effective date: October 2022

1. “Personal Information” is any information relating to an identified or identifiable natural person (“Data Subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

‍