Introduction

In this policy, ‘we’, ‘us’ and ‘our’ refers to Nurture The Children. For more information, see About Us. Our website address is: https://nurturethechildren.org.uk We are committed to safeguarding the privacy of our website visitors and clients. This policy applies where we are acting as a data controller for the personal data of our website visitors and clients; in other words, where we determine the purposes and methods of processing your personal data. Types of personal data we use We may process data:

• about your use of our website and services (usage data)
• about your use of our services (service data)
• about your client account including your name and email address (account data)
• provided by you asking us to send you specific email information or newsletters (notification data)
• provided by you for communicating with you (correspondence data)
• provided by you to obtain goods and/or services from us (enquiry data) and (transaction data)
• provided by you for publication on our website (publication data)
• provided by another data supplier about you, for communicating with you about our services (marketing data)

How Is Your Personal Data Created & used This is how your personal information is created, and how we use it:

• Usage data – the source of our usage data is Google Analytics. We use it to administer our website and business
• Service data – is created by using our services. We use it to supply you services purchased through our website
• Account data – is created by using and maintaining your account. We use it to provide our services, communicate with you, ensure our business security and maintain our database back-ups
• Correspondence data – is created through our record-keeping and communications with you. We use it to send you non-marketing commercial communications and keep our records
• Enquiry data – is created by our website contact forms and information you have submitted to us. We use it to offer, market and sell relevant goods and/or services to you.
• Transaction data – is created by processing and keeping proper records of our transactions with you. We use it to supply goods and services to you, send statements, invoices and payment reminders to you
• Publication data – is created from submissions made to our website and services. We use it to operate and publish material through our website and services
• Notification data – is created by our website contact forms and information you have submitted to us. We use it to send you email notifications or newsletters that you have specifically requested.

What Does Usage Data Include This data may include:

• your IP address
• geographical location
• browser type and version
• operating system
• referral source
• length of visit
• page views
• website navigation paths
• as well as information about the timing, frequency and pattern of your service use.

What Does Account Data Include This data may include:

• your name
• contact details
• email address.

What Does Transaction Data Include This data may include:

• your name
• bank account details
• purchase information.

Legal Basis For Having Your Data

We use your personal data for processing based on the following legal bases:

Your consent This means you have given your permission for us to use your data by, for example, accepting our Cookie Policy when entering our website, or accepting our contract terms and conditions. We keep and use the following data on that basis:

• Usage data
• Enquiry data
• Publication data
• Notification data
• Correspondence data
• Marketing data

We also legitimately keep and use the following data because you have previously given your permission to a data provider:

The current privacy policy is written for a general adult audience and relies heavily on consent as a lawful basis for many types of data processing (e.g., usage data, enquiry data, publication data, notification data, correspondence data, and marketing data from third parties). It also assumes users can directly consent to cookies and other processing.

Under UK GDPR (which applies here, as the organisation is UK-based), combined with the Age Appropriate Design Code (Children’s Code) enforced by the ICO:

• Children are defined as under 18.
• For information society services (like websites) offered directly to a child, children under 13 cannot provide valid consent themselves for processing their personal data when consent is the lawful basis (Article 8 UK GDPR). Instead, verifiable parental responsibility holder consent must be obtained, with reasonable efforts to verify it.
• Privacy information must be provided in clear, plain language appropriate to the child’s age — ideally with child-friendly versions (e.g., simplified language, visuals like diagrams/cartoons for younger ages, layered notices).
• The policy should not assume children can independently consent to data collection/use (e.g., cookies, newsletters, account creation).
• If the site targets or is likely to be accessed by under-13s, apply high-privacy defaults, minimise data collection, avoid nudging for more data, and ensure transparency geared toward children/parents.
• The site appears education/charity-oriented (“Nurture The Children”), which may qualify as “likely to be accessed by children,” triggering Children’s Code requirements.

To accommodate users under 13 (e.g., if the site/content is aimed at or accessible to children), the policy needs significant changes. Here’s a modified version with key additions/adaptations in bold italics for easy spotting (you can remove the bold/italics in your final use). This adds:

• A dedicated section for children and parents.
• Clarification on consent for under-13s (parental required).
• Emphasis on age-appropriate transparency.
• Alignment with data minimisation/high-privacy defaults (Children’s Code).
• Retention of core structure but with child safeguards.

Note: This is not legal advice — consult a data protection specialist/ICO guidance for full compliance, especially if implementing age assurance, parental verification, or DPIA. If the site is not intended for under-13s, add age gates/restrictions instead.

Our Privacy & Cookie Policy (Updated for Children Under 13)

Find out how we treat your personal information and use cookies to personalise your experience on our website. More importantly, you can learn about your privacy rights, how to update your details, and unsubscribe from marketing.

Special information for children under 13 and their parents/carers If you are under 13 years old, this policy is also for your parents or carers. We take extra care to protect children’s privacy because the law says children under 13 cannot agree to us using their information on their own. We will only collect or use a child’s personal information if a parent or carer gives permission first (this is called “parental consent”). We will ask for proof that the person giving permission is a parent or carer. We design our website to be safe and private for children by default — we collect as little information as possible, and we do not share children’s data unless we really need to (and it is in the child’s best interests). If you are a child, please ask a parent or carer to read this with you.

Protecting Your Privacy Introduction In this policy, ‘we’, ‘us’ and ‘our’ refers to Nurture The Children. For more information, see About Us. Our website address is: https://nurturethechildren.org.uk We are committed to safeguarding the privacy of our website visitors and clients, especially children. This policy applies where we are acting as a data controller for the personal data of our website visitors and clients; in other words, where we determine the purposes and methods of processing your personal data. We follow the UK’s Age Appropriate Design Code (Children’s Code) to make sure our service is safe and suitable if children under 18 use it. We put children’s best interests first.

Types of personal data we use We may process data:

• about your use of our website and services (usage data)
• about your use of our services (service data)
• about your client account including your name and email address (account data)
• provided by you asking us to send you specific email information or newsletters (notification data)
• provided by you for communicating with you (correspondence data)
• provided by you to obtain goods and/or services from us (enquiry data) and (transaction data)
• provided by you for publication on our website (publication data)
• provided by another data supplier about you, for communicating with you about our services (marketing data)

For children under 13: We only collect the minimum information needed for the part of the service you are using (e.g., no unnecessary tracking). We do not collect sensitive information about children without strong reasons and parental consent.

How Is Your Personal Data Created & used This is how your personal information is created, and how we use it:

• Usage data – the source of our usage data is Google Analytics. We use it to administer our website and business.
• Service data – is created by using our services. We use it to supply you services purchased through our website.
• Account data – is created by using and maintaining your account. We use it to provide our services, communicate with you, ensure our business security and maintain our database back-ups.
• Correspondence data – is created through our record-keeping and communications with you. We use it to send you non-marketing commercial communications and keep our records.
• Enquiry data – is created by our website contact forms and information you have submitted to us. We use it to offer, market and sell relevant goods and/or services to you.
• Transaction data – is created by processing and keeping proper records of our transactions with you. We use it to supply goods and services to you, send statements, invoices and payment reminders to you.
• Publication data – is created from submissions made to our website and services. We use it to operate and publish material through our website and services.
• Notification data – is created by our website contact forms and information you have submitted to us. We use it to send you email notifications or newsletters that you have specifically requested.

For children: We only use your data for things you (or your parent) have asked for or that are needed to provide the service safely. We do not use children’s data for marketing unless a parent agrees.

(Continue with the original sections on What Does Usage Data Include, Account Data, Transaction Data — no major changes needed, but add:)

We do not collect more information than necessary from children, and geolocation or other tracking is turned off by default unless you (or a parent) actively turn it on for a good reason.

Legal Basis For Having Your Data We use your personal data for processing based on the following legal bases:

Your consent This means you have given your permission for us to use your data by, for example, accepting our Cookie Policy when entering our website, or accepting our contract terms and conditions. We keep and use the following data on that basis:

• Usage data
• Enquiry data
• Publication data
• Notification data
• Correspondence data

We also legitimately keep and use the following data because you have previously given your permission to a data provider:

• Marketing data

Important for children under 13: Children under 13 cannot give consent themselves. For any processing based on consent (like cookies, newsletters, or publishing your content), we need consent from a parent or carer. We will verify this where required by law. If we cannot get or verify parental consent, we will not process the child’s data on consent grounds. For older children (13+), they can consent themselves, but we still encourage parents to be involved.

Contract and Legitimate Interest In some instances we have legitimate interest to use and process your data, or need to do so in order to enter into and/or deliver the contract between you and us. We keep and use the following data on that basis:

• Account data
• Service data

(Other circumstances section remains similar.)

Personal Data of Others Please do not supply any other person’s personal data to us, unless we request you to do so, and they consent. This is especially important for children’s information — parents/carers should only provide their child’s data with proper authority.

Sharing Your Personal Data With Others (Keep original, but add:) We do not usually share children’s personal data. We only share if there is a strong reason (e.g., legal requirement or to protect the child), and always considering the child’s best interests.

Sharing Your Data Internationally (Keep original — but note that transfers to US providers use safeguards.)

Retaining & Deleting Your Personal Data We will not keep personal data for longer than necessary. How long do we retain data We will keep your personal data as follows:

• all personal data will be retained for a minimum of 3 years after data acquisition
• and for a maximum of 7 years following conclusion of any contract between you and us.

We may keep your personal data when we are required to comply with a legal obligation. For children’s data: We delete or anonymise it as soon as it is no longer needed for the service, and sooner than for adults where possible.

Contract and Legitimate Interest In some instances we have legitimate interest to use and process your data, or need to do so in order to enter into and/or deliver the contract between you and us. We keep and use the following data on that basis:

• Account data
• Service data

Other circumstances We may keep and use any of your personal data identified in this policy for the following legitimate purposes:

• to establish, exercise, or defend legal claims, whether in court proceedings or in an out-of-court procedure, so we can protect and assert our legal rights, your legal rights and the legal rights of others
• to obtain or maintain insurance cover, manage risks, or obtain professional advice, so we can protect our business against risks.

Personal Data of Others Please do not supply any other person’s personal data to us, unless we request you to do so, and they consent. Sharing Your Personal Data With Others We may share your personal data with any part of our company, providing the purpose for sharing your data is reasonable, necessary, and within the legal limits of this policy. Our Suppliers Providing the purpose for sharing your data is reasonable, and necessary, we may share your personal data with our current suppliers, software providers, or subcontractors (shown below), so we can enter into and/or deliver the contract between you and us:

• Google
• WordPress
• Names.co.uk
• JustGiving.com

Other circumstances We may share any of your personal data identified in this policy for the following legitimate purposes:

• to establish, exercise, or defend legal claims, whether in court proceedings or in an out-of-court procedure, so we can protect and assert our legal rights, your legal rights and the legal rights of others
• to obtain or maintain insurance cover, manage risks, or obtain professional advice, so we can protect our business against risks.

Sharing Your Data Internationally We may transfer your personal data outside the EEA (European Economic Area) to enter into and/or deliver our contract to you, as follows: Hosting facilities The some of our suppliers and providers operate services hosted in the United States including:

• marketing software associated with the delivery of our website
• software providers
• data storage providers.

The European Commission has made an ‘adequacy decision’ with respect to the data protection laws of these countries. Transfers to these countries will be protected by appropriate safeguards, namely, the use of standard data protection clauses adopted or approved by the European Commission. Worldwide publication Personal data submitted for publication through our website or services may be available, via the internet, around the world. You acknowledge we cannot prevent the use (or misuse) of this type of personal data by others. Retaining & Deleting Your Personal Data We will not keep personal data for longer than necessary. How long do we retain data We will keep your personal data as follows:

• all personal data will be retained for a minimum of 3 years after data acquisition
• and for a maximum of 7 years following conclusion of any contract between you and us.

We may keep your personal data when we are required to comply with a legal obligation which we are subject to. clients.

This policy applies where we are acting as a data controller for the personal data of our website visitors and clients; in other words, where we determine the purposes and methods of processing your personal data.