How Little Ripples collects, uses, stores and protects personal data across all of our activities.
Little Ripples is an emerging Charitable Incorporated Organisation (CIO) based in England. We promote the emotional wellbeing, mental health and personal development of children and young people affected by a cancer diagnosis in a parent, guardian, family member or close friend.
For the purposes of this policy, the data controller is Keri Bird, Founder and Volunteer CEO of Little Ripples.
Contact us at any time with data-related queries: hello@littleripplesuk.org.uk
This policy explains how Little Ripples collects, uses, stores and protects personal data across all of our activities, including:
A separate Trustee Recruitment Privacy Notice covers data collected through our trustee recruitment process.
The table below sets out what data we collect, why we collect it, and the legal basis under UK GDPR that allows us to do so.
| Who | What we collect | Why we collect it | Legal basis |
|---|---|---|---|
| Newsletter / mailing list subscribers | Name, email address | To send updates about Little Ripples, our work and events | Consent (you opt in) |
| Event sign-ups | Name, email address, and any additional details relevant to the event | To manage your registration and communicate event information | Consent / Contract |
| Families / parents and carers expressing interest | Name, contact details, and any personal information shared voluntarily (including about a cancer diagnosis and its impact on your family) | To respond to your expression of interest and understand how we may be able to support you | Consent (explicit consent for any health-related information) |
| General enquiries | Name, email address, and any information included in your message | To respond to your enquiry | Legitimate interests |
| Website visitors | Anonymised analytics data (e.g. pages visited, browser type, approximate location) | To understand how our website is used and improve it | Legitimate interests |
| Professionals (healthcare, education and other sectors) | Name, professional role, organisation and contact details | To manage professional enquiries and potential partnership discussions | Legitimate interests |
| Potential volunteers and panel members | Name, contact details, skills and relevant experience | To assess expressions of interest in volunteering or joining one of our panels | Legitimate interests / Consent |
We will never collect more information than we need. We will always tell you clearly what we are collecting and why.
Some of the information people share with us — particularly families and parents affected by cancer — may include special category data under UK GDPR. This includes information about health conditions.
We only collect special category data where you have given us your explicit consent. You may withdraw that consent at any time by contacting us at hello@littleripplesuk.org.uk. Withdrawing consent will not affect how we have used your data before the withdrawal.
We handle all health-related information with the highest level of care. It is accessible only to those with a clear need and is never shared outside Little Ripples without your explicit consent.
We use Mailchimp, a third-party email marketing platform, to manage our mailing list and send newsletter and event communications. When you sign up to our mailing list, your data (name and email address) is stored on Mailchimp's platform.
Mailchimp is based in the United States and is certified under the UK-US Data Bridge (the UK Extension to the EU-US Data Privacy Framework). This means your data is protected to a standard equivalent to UK data protection law when transferred internationally.
You can read Mailchimp's privacy policy at: mailchimp.com/legal/privacy
We will only add you to our mailing list if you have actively opted in. You can unsubscribe from our emails at any time using the unsubscribe link in any email we send, or by contacting us directly at hello@littleripplesuk.org.uk.
Unsubscribing means you will no longer receive marketing communications from us. We may still need to contact you in relation to a specific enquiry or service you have requested.
We take data security seriously. The measures we use to protect your personal data include:
We do not use any automated decision-making or profiling.
| Type | Retention period |
|---|---|
| Newsletter subscribers | Until you unsubscribe. If there has been no engagement for 2 years, we will prompt you to confirm you still wish to hear from us before deleting your data. |
| Event sign-ups | Up to 12 months after the event, then securely deleted. |
| Family / beneficiary expressions of interest | Retained for the period necessary to deliver support and manage our relationship with the family, reviewed annually. |
| General enquiries | Up to 12 months from the date of the enquiry, then securely deleted. |
| Professional and volunteer enquiries | Up to 12 months from the conclusion of discussions, then securely deleted. |
| Website analytics data | Anonymised analytics data is retained for up to 24 months. |
Sometimes people interact with us in more than one way. If your relationship with us changes, we may move your information into the relevant category and retain it in line with the retention period for that activity. For example, if you first contact us with an enquiry and later become a beneficiary or volunteer, we will retain your information according to the retention period that applies to that relationship.
At the end of each retention period, data will be securely and permanently deleted.
We will never sell your data. We will not share your personal data with third parties for marketing purposes.
We may share data in the following limited circumstances:
Any third parties with whom we share data are required to handle it securely and in accordance with UK data protection law.
Under UK GDPR, you have the following rights in relation to your personal data:
| Right | What it means |
|---|---|
| Right of access | You can request a copy of the personal data we hold about you. |
| Right to rectification | You can ask us to correct any inaccurate data we hold. |
| Right to erasure | You can ask us to delete your data in certain circumstances. |
| Right to restrict processing | You can ask us to limit how we use your data. |
| Right to data portability | You can ask us to provide your data in a portable format. |
| Right to object | You can object to us processing your data based on legitimate interests. |
| Right to withdraw consent | Where we rely on consent, you can withdraw it at any time. |
To exercise any of these rights, please contact us at: hello@littleripplesuk.org.uk
We will respond to all requests within one month. There is no charge for exercising your rights.
Our website may use cookies to help it function and to understand how it is used. Cookies are small text files stored on your device.
We use only essential cookies (necessary for the website to work) and, where applicable, analytics cookies to understand visitor behaviour in anonymised form. We will ask for your consent before setting any non-essential cookies.
You can control or delete cookies at any time through your browser settings. Disabling cookies may affect some website functionality.
Full details are set out in our Cookie Policy.
Little Ripples exists to support children and young people. We take our responsibility for children's data extremely seriously.
We do not collect personal data directly from children. Where a parent or carer shares information about their child with us, this is treated as special category data and handled with the highest level of care and security, in line with our Safeguarding Policy.
Health-related information about children is only collected with explicit parental or carer consent. It is accessible only to those with a clear and legitimate need within Little Ripples.
If a child or young person contacts us directly, we will only collect the minimum information necessary to respond and will not use it for any other purpose without appropriate consent.
If you have a concern about how we have handled your personal data, please contact us first at hello@littleripplesuk.org.uk. We will do our best to resolve your concern promptly.
If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
We will review this policy at least annually, or whenever there is a material change to our activities, the law, or our data processing practices. The version number and date at the top of this document will be updated when changes are made.
Where changes are significant, we will notify subscribers by email.
