DEx’s Privacy Policy

Hello, we are Downright Excellent (DEx). We’d like to tell you about our Data Privacy Policy.

Safety is at the heart of everything we do. We spend a lot of time ensuring that our environment, practices and people are equipped to provide appropriate safeguards to everyone that is involved with DEx. Keeping personal information safe is equally important.

This Privacy Policy, together with our terms and conditions, will explain how and why we use your personal information, to ensure you remain informed and in control of your information.

About DEx

The purpose of our activities is “enabling children with Down syndrome to maximise their potential”. Our registered charity number is 1120863 in England and Wales and we are a registered company in England and Wales, number 6249083.

Within the context of this privacy policy, whenever you see these words:

‘we’, ‘us’, ‘our’ or ‘DEx’, we are talking about Downright Excellent;
‘personal data’, ‘personal information’, we are referring to data for adults and children;
‘your’ or ‘you’, we are referring to you as an adult or a child that has an adult responsible for parental or guardianship responsibilities. ‘DEx team’ means the individuals that volunteer or work as freelance contractors;
‘Supporter’ means an individual that intends to, could, or supports DEx, for example, donors, funders, or representatives of funding bodies.

Personal information held by DEx

Why do we collect your personal information?

Our vision is a world where every child with Down syndrome is enabled to maximise their potential. We need you to help us make this a reality, and collecting your personal information enables us to:

deliver the services that you expect from us, for example: therapies, child-parent interaction, play, training, research, work opportunities, sharing information and opportunities that are consistent with our vision and purpose, and other services;
understand how we can best communicate with people that are interested in DEx;
support fundraising activity that is vital to our ability to continue to deliver our services to children with Down syndrome.

Why is your child’s personal information of particular importance?

If you are interested in or already use our services, we need accurate and up to date information about your child so we can:

assess your child’s development needs, and decide what therapies and services he or she needs;
work with you to plan your child’s therapies; and
work with other people involved in your child’s care and support, such as your child’s school, potential school, other therapists, and others.

Other members of the DEx team, aside from our therapists, may need to use your child’s records to:

monitor the type and quality of therapy or services we provide for your child;
manage our services to ensure these are delivered equitably;
ensure that our compliance with safeguarding and other regulatory obligations are satisfied;
budget for and manage our money appropriately; and
investigate any concerns or complaints.

In summary, when you use our services, you are agreeing to the storing and processing of your personal information. The ways in which we store and process your data are explained in this policy – it is a guide for us to follow too, and we take it very seriously.

What personal information does DEx hold and may hold in the future?

Personal information are any data or information that can be used to identify you. If, for example, you request or use DEx services, donate money, or volunteer your time with us, we may collect and process the personal information that you’ve provided.

We may also receive information from you when you contact or follow us viathe internet, email, social media or surveys.

This personal information includes names, email address, postal address, telephone or mobile number and date of birth, financial details, UK tax payer information (for Gift Aid), and records of responses to our communications, as well as how you came to find us or about our services or events. We also hold sensitive personal information such as your personal connection to learning disability or your employment status, in order to provide you with our services.

We collect and store personal information about children and young people where we are contracted to provide a therapy and support service to them. We are required to process this personal information in order to fulfil the requirements of the therapy and support contract and to meet our regulatory obligations.

If you use our websites or apps, we may also collect details of your visits to those, for example your location data, other sites you’ve visited and the resources that you access. We use this to provide you with the information and services that you’re interested in and are most relevant to you. We could also use these details to support decisions we make on what services to provide, and to support fundraising campaigns.

How DEx uses personal information

How is your personal information used?

We may process your personal information for our charitable aims. We collect your personal information because we need it to help us better understand the needs of you and your child, keep in touch with you, and offer you communications that are relevant to you.

This includes:

providing information or services where processing enables us to enhance, modify, personalise or otherwise improve our services/communications for your benefit;
keeping you and your child safe, for example allergy information, emergency contact details;
respecting you or your child’s beliefs, for example, understanding personal information relating to faith or gender and/or sexual orientation is important if you expressly ask us to be considerate to aspects relating to those matters;
processing financial transactions such as donations, entering a paid event or setting up a Direct Debit. This includes processing Gift Aid with HMRC if relevant;
keeping a record of any communications between us and you, for example emails and phone calls; and keeping a record of other interactions too, such as requests for leaflets or attending an event.

We may ask if you wish to take part in research, such as surveys or focus groups, but this will be voluntary (your choice). The research may be:

to support how we plan our services, measure the effectiveness of what we do, or to provide impact reporting that our funders or potential funders require us to provide;
in relation to Down syndrome we may inform you of the opportunity to

participate in research by other organisations interested in issues or challenges relating to Down syndrome.

We will endeavour to support you, as our resources allow, by providing reports, notes, or evidence for:

Education and Health Care Plans;
school applications;
input into speech and language intervention in your early years setting or school;
mediation or tribunals.

We will provide communications which we think will be of interest to you:

to better understand how people interact with our website;
to determine the effectiveness of promotional campaigns and advertising;
to manage and improve how we communicate with you – how you prefer to be contacted, and what information you want to receive. We might contact you about our events, appeals, volunteering, news, information and advice, as well as other ways you can support DEx.

Whenever we process personal data or personal information for these purposes we will ensure that your personal information rights are upheld. You have the right to object to this processing if you wish, and if you wish to do so please see the section(s) below on updating your preferences or unsubscribing.

Please bear in mind that if you object this may affect our ability to carry out the tasks above for your benefit.

How DEx receives personal information

There are two ways in which we have received personal information about you:

Directly; or
Indirectly, including the use of third parties.

Directly:

Most of the personal information we hold is provided by “you” directly to us. For example:

personal information about you and your child received by us when you contacted us about or signed up for, DEx services;
when you meet with the DEx therapists or other members of the DEx team responsible for the services your child receives in order to plan your support;
personal information about parents/carers/family members received by us when you register and make payments or donations to DEx, and when you register an interest to participate in research;
personal information about your child and the therapy they receive from professionals or third parties that you have arranged for DEx to communicate, for example with representatives from your child’s school or other therapists;
personal information about your interest in our events or events by third parties that DEx shares with you, eg training events for families/Teaching Assistants/Carers, events hosted by the Taxi Drivers Fund;
personal information about those of any financial or in kind support which is collected when you make a donation, grant, Gift Aid, provide sponsorship, or provide goods and services on preferential terms;
personal information about individuals that want to volunteer or act as freelance contractors to DEx, eg CVs and Disclosure & Barring Service details you supply us;
personal information about those of you that are suppliers or partners to DEx.

Please note, this list is not exhaustive and we may obtain personal information via other means.

Indirectly:

This is when you give your personal information to us indirectly.

To be clear, DEx does not ask any third party to collect information nor payment from parents/carers/families on our behalf, unless you have asked us to for a specific purpose – for example, as part of a collaboration that you have agreed between your child’s school and our therapists.

We may be given your information indirectly by a third party or find it through a publicly available source. Here are a few examples:

your information may be shared with us by independent event organisers, for example the London Marathon or fundraising sites like JustGiving or Virgin Money Giving. These independent third parties will only do so when you have indicated that you wish to support DEx and with your consent. You should check their Privacy Policy when you provide your information to understand fully how they will process your personal information;
your personal information may be available from sources that are accessible to us, for example websites and agencies that you may have provided your CV or profile to, referrals that are made on behalf of you and/or your child;
you may have posted information on online social media and messaging services, eg Facebook, WhatsApp or Twitter, or available through search engines such as Google or Bing; and
your personal information may be available on published literature, news articles, Companies House, amongst other publicly available sources.
When you give permission to other organisations to share or your information is available publicly:
we may combine information you provide to us with information available from external sources in order to gain a better understanding of our supporters to improve our fundraising methods, products and services; and
the information we get from other organisations may depend on your privacy settings or the responses you give those other organisations, so you should regularly check them.

Ethical screening and minimising risk

We are subject to many legal and regulatory obligations and standards. We employ appropriate due diligence of volunteers, freelance contractors, donors and donations as well as implementing robust financial controls that help protect DEx from abuse, fraud and money laundering. To the best of our resources available, we may ethically screen supporters to minimise the risk of associating ourselves with an individual or organisation that conflicts with our standards or purpose.

Retaining personal information

How is your personal information retained?

At DEx we are committed to taking all steps reasonably necessary to make sure that your personal data and personal information are treated securely and in accordance with this privacy policy. We endeavour to do our best to protect your personal information and ensure that it will be held in compliance with European data protection regulations.

These personal data and personal information collected from you may be transferred to, and stored at, a destination outside the European Economic Area (“EEA”). It may also be processed by individuals operating outside the EEA who work for us or are working on our behalf. For example, where our software or data storage supplier may host their cloud services.

By submitting your personal data and personal information, you agree to this transfer, storing and processing at a location outside the European Economic Area.

Unfortunately, sending information via the internet is never 100% secure and we cannot guarantee the security of personal information transmitted by email, online social networks, texts, or to our website. This means any such sending of information is at your own risk.

In cases when we use external websites provided by other organisations such as Twitter, YouTube or Facebook, then we would ask you to consult their privacy policies.

How long is personal information retained?

We will retain your personal information for as long as it is required in relation to the purposes for which it was obtained.

How long personal information is retained depends on the type of personal information it is and what it is being used for. We are developing a data retention policy that will stipulate time periods that will apply for different types of personal information.

Sharing personal information

When do we share your personal information?

We will not sell or rent your personal information to third parties for the purposes of marketing.

We will not sell, rent, or share your personal information for others to use in their fundraising activities.

We may share your personal information with other organisations (eg subcontractors, suppliers) who provide services on our behalf, including processing credit card payments, or performing background checks on individuals for work related references or the Disclosure and Barring Service.

We may share your personal information with other organisations where you have told us to share that personal information or expressed an interest in a specific service provided by the other organisations. For example, providing a university with your contact details if you have expressed an interest in participating in a research study.

We may need to disclose your personal information if required to by law enforcement agencies, regulatory bodies, legal advisors, or other agencies in order for us to comply with our regulatory obligations.

We will only ever share your personal information in other circumstances if we have your explicit and informed consent.

Your rights to your personal information

If you wish to exercise any of your rights, as listed below, please write to us at safeguarding@downrightexcellent.com or send us a written request to: Downright Excellent, 44 Mount Pleasant Road, London NW10 3EL.

Access to your personal information
When you are requesting a copy of the personal information that we hold about you, we will endeavour to provide you with the information you have requested and do so in accordance with the relevant GDPR requirements.
Right to objection to or restriction of processing of your personal information
You have the right to ‘block’ or suppress processing of your personal information. However, we will continue to store your personal information but not further process it. We do this by retaining just enough of your personal information to ensure the restriction in the future.
Right to edit and update your personal information
The accuracy of your personal information is important to us. You have the right to request that your personal information is corrected if it is inaccurate or incomplete.
Right to request to have your personal information erased (also known as the ‘right to be forgotten’)
You do not have an automatic right to have your personal information deleted. You do, however, have the right to request the deletion or removal of your personal information where there is no compelling reason for its continued processing. We will review each request on a case by case basis.

If you make a request relating to any of the rights listed above, we will consider each request in accordance with all applicable data protection laws and regulations. If the request is deemed to be excessive in nature, then an administration fee will be charged.

Updating your preferences or unsubscribing

You are in control of how we contact you, for example by post or email. And you can control this by contacting us at safeguarding@downrightexcellent.com

Mutual responsibility

Together, you and DEx are responsible for making sure everyone feels safe about their personal information. Therefore, we ask you to be conscious about how you use personal information – yours, your family’s, and the personal information about all others that use DEx services or provide their services to DEx, or support DEx.

Respect others’ privacy:

We are lucky to have parents, carers, supporters and a DEx team that create an open and trusting environment through the sharing of useful information and personal experiences. We ask you to treat other people’s personal information with the same respect you would want shown to yours.

What we may need from you:

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is an appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

When you follow links that are on our website, emails, or communications:

Whilst we try our best to share information about other third parties (organisations, events, or articles) with you that is from reputable sources we cannot be held responsible for the privacy of data or information collected by those third parties not managed by DEx, nor can we accept responsibility or liability for those policies. For this reason, you should consult the third party’s privacy policy before you submit any data or information to those websites.

Posting, sending or communicating inappropriate content:

If you post, send, or communicate any content that we believe to be inappropriate or content in breach of any laws, such as defamatory content, we may use your personal information to inform relevant third parties such as your internet provider or law enforcement agencies.

Posting, or sending content that you do not own:

We have the right to disclose your identity to any third party claiming to own any content that you posted, or sent.

Update or changes to our privacy policy:

We reserve the right to make changes to this Privacy Policy. Each time you visit downrightexcellent.org or visit us in-person you should check the Privacy Policy to check that no changes have been made to any sections that are important to you. Where appropriate, any changes will be notified to you by email.