DATA PROTECTION POLICY
Privacy Policy
How we collect, use, protect and retain personal data
| Document control | Details |
|---|---|
| Document | Privacy Policy |
| Version | Version 2.0 |
| Status | Approved by the Board of Trustees |
| Effective date | 29 October 2026 |
| Next scheduled review | October 2027 |
| Policy owner | The Board of Trustees |
| Approved by | The Board of Trustees: Osman Osman (Chair), Fahad Hassan and Faduma Mohamed |
| Applies to | All individuals whose personal data the Charity processes |
| Supersedes | Privacy Policy (effective 18 December 2021; last reviewed 10 February 2025) |
Let’s Make Noise · Registered Charity in England and Wales No. 1212537
Office 705, Avicenna House, 258–262 Romford Road, London E7 9HZ
info@letsmakenoise.org · 020 8058 9885 · www.letsmakenoise.org
Contents
- 1. Introduction
- 2. About Us: The Data Controller
- 3. Scope of this Policy
- 4. Legal Framework and Data Protection Principles
- 5. Personal Data We Collect
- 6. Special Category and Criminal Offence Data
- 7. How We Collect Personal Data
- 8. Lawful Bases for Processing
- 9. Photography, Images and Video
- 10. Children’s Data and Parental Responsibility
- 11. Sharing and Disclosure of Personal Data
- 12. International Transfers
- 13. Data Security
- 14. Data Retention
- 15. Your Rights
- 16. Consent and its Withdrawal
- 17. Communications, Marketing and Fundraising
- 18. Website and Cookies
- 19. Personal Data Breaches
- 20. Complaints
- 21. Changes to this Policy
- 22. Contact Us
1. Introduction
1.1 Let’s Make Noise ("the Charity", "we", "us" or "our") is a Charitable Incorporated Organisation registered in England and Wales under charity number 1212537. We provide free, inclusive and accessible programmes for children and young people with special educational needs and disabilities (SEND), including speech and language therapy, fun days out, the Life Skills Initiative, the Let’s Make Noise Cup and family support.
1.2 We are committed to protecting the privacy of every individual whose personal data we process, and to upholding the highest standards of data protection, confidentiality and safeguarding. This Privacy Policy explains, in a clear and transparent manner, what personal data we collect, why we collect it, the lawful bases upon which we rely, with whom we share it, how long we retain it, and the rights available to you.
1.3 Given the nature of our work, we process personal data relating to children and young people, including information concerning their health and disabilities. We recognise that such data merits particular protection and we apply enhanced safeguards accordingly.
2. About Us: The Data Controller
2.1 Let’s Make Noise is the data controller in respect of the personal data described in this Policy. This means that we determine the purposes for which, and the means by which, your personal data is processed.
| Detail | Information |
|---|---|
| Data controller | Let’s Make Noise |
| Registered charity number | 1212537 (England and Wales) |
| Registered address | Office 705, Avicenna House, 258–262 Romford Road, London E7 9HZ |
| ICO registration | Registration with the Information Commissioner’s Office in progress |
| Data protection contact | info@letsmakenoise.org · 020 8058 9885 |
| Safeguarding contact | Nawal Sulieman, Designated Safeguarding Officer · safeguarding@letsmakenoise.org |
2.2 Where our speech and language therapy is delivered by an external partner, that partner may act as a separate, independent data controller in respect of clinical records. In such cases, the partner’s own privacy notice will also apply, and we will inform you accordingly.
3. Scope of this Policy
3.1 This Policy applies to the personal data of all individuals with whom the Charity interacts, including children and young people who participate in our programmes; their parents, carers and legal guardians; trustees, staff, volunteers and job applicants; donors, sponsors and supporters; partner organisations and employers; teams, players and spectators at the Let’s Make Noise Cup; and visitors to our website and social media channels.
4. Legal Framework and Data Protection Principles
4.1 We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR) and all other applicable legislation, as amended from time to time.
4.2 We adhere to the data protection principles set out in Article 5 of the UK GDPR. Personal data shall be:
- processed lawfully, fairly and in a transparent manner;
- collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes;
- adequate, relevant and limited to what is necessary (data minimisation);
- accurate and, where necessary, kept up to date;
- kept for no longer than is necessary for the purposes for which it is processed (storage limitation); and
- processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing, accidental loss, destruction or damage.
4.3 We are responsible for, and able to demonstrate, compliance with these principles (accountability).
5. Personal Data We Collect
| Category of individual | Personal data we may collect |
|---|---|
| Children and young people | Name, date of birth, age, gender, address, school or college, SEND and medical information, communication and behaviour support needs, allergies and dietary requirements, attendance records, progress notes, photographs and video (with consent). |
| Parents, carers and guardians | Name, relationship to the child, address, telephone number, email address, emergency contact details, consent records and correspondence. |
| Trustees, staff, volunteers and applicants | Contact details, employment and volunteering history, references, right-to-work documentation, DBS check outcomes, training records, emergency contacts and, where relevant, bank and payroll details. |
| Donors, sponsors and supporters | Name, contact details, donation history, Gift Aid declarations, payment information (processed securely by third-party providers) and communication preferences. |
| Let’s Make Noise Cup teams and attendees | Team and player registration details, contact information, ticketing information and accessibility requirements. |
| Partners and employers | Names, job titles and business contact details of representatives, and work experience placement information. |
| Website and enquiry users | Information submitted through enquiry or contact forms, IP address and technical data collected through cookies (see Section 18). |
6. Special Category and Criminal Offence Data
6.1 In order to provide safe and appropriate support, we process special category personal data within the meaning of Article 9 of the UK GDPR, in particular data concerning health and disability, and, where voluntarily provided, ethnicity or religion for equality monitoring purposes.
6.2 We process such data only where an Article 9 condition applies, principally: the explicit consent of the parent, carer or individual; the provision of health or social care; the safeguarding of children and individuals at risk (Data Protection Act 2018, Schedule 1, paragraph 18); and equality of opportunity or treatment monitoring.
6.3 We process criminal offence data, in the form of Disclosure and Barring Service (DBS) check outcomes, solely for the purpose of safer recruitment, in accordance with Article 10 of the UK GDPR and Schedule 1 of the Data Protection Act 2018. We maintain an Appropriate Policy Document where required by law.
7. How We Collect Personal Data
7.1 We collect personal data directly from you, for example when you complete a registration, consent, volunteer or donation form, contact us by email, telephone or through our website, or attend our activities. We may also receive personal data from referring professionals, schools, local authorities, delivery partners, referees and the Disclosure and Barring Service, and we may obtain limited information from publicly available sources.
8. Lawful Bases for Processing
8.1 We will only process personal data where we have a lawful basis to do so under Article 6 of the UK GDPR. The principal purposes and corresponding lawful bases are set out below.
| Purpose of processing | Lawful basis (Article 6) | Additional condition (where special category data) |
|---|---|---|
| Registering and enrolling participants in programmes | Legitimate interests; consent | Explicit consent; health or social care |
| Delivering speech and language therapy and life skills programmes | Legitimate interests; consent | Explicit consent; health or social care |
| Safeguarding and promoting welfare | Legal obligation; vital interests; legitimate interests | Safeguarding of children and individuals at risk |
| Managing health, medical and emergency information | Vital interests; legitimate interests | Explicit consent; vital interests |
| Taking and publishing photographs and video | Consent | Not applicable |
| Recruiting and managing staff and volunteers, including DBS checks | Contract; legal obligation; legitimate interests | Employment and social security law; Schedule 1 DPA 2018 |
| Processing donations and Gift Aid | Contract; legal obligation | Not applicable |
| Sending newsletters and fundraising communications | Consent (electronic); legitimate interests (post) | Not applicable |
| Reporting anonymised outcomes to funders | Legitimate interests | Not applicable (anonymised) |
| Responding to enquiries and complaints | Legitimate interests | Not applicable |
8.2 Where we rely upon legitimate interests, we have carefully balanced our interests against your rights and freedoms, and we will not rely upon this basis where your interests override our own.
9. Photography, Images and Video
9.1 Photographs and video recordings play an important role in documenting our work, celebrating the achievements of our participants and raising awareness of SEND. We recognise, however, that images of children constitute personal data requiring particular care.
9.2 Consent
We will only capture, store or publish images of a child or young person where a parent or legal guardian has completed and signed our Parental Consent and Declaration Form. Where the young person is aged 13 or over, or otherwise has sufficient understanding, we will also seek their own views and respect any objection. The consent form specifies: the purposes for which images may be used; the media in which they may appear; that consent is entirely voluntary; that consent may be withdrawn at any time; and how images will be stored and protected.
9.3 Purposes
Images may be used, in accordance with the consent given, for: showcasing our activities and community impact on our website and official social media channels; fundraising, grant applications and reports to funders; educational and informational materials highlighting the progress and success of our services; and press releases and award submissions. We will never sell images or use them for commercial purposes unrelated to the Charity’s objects.
9.4 Protective Measures
- Anonymity: we do not publish full names, school names, addresses or other identifying details alongside images.
- Dignity: we select images that uphold the dignity, privacy and safety of every child, and we never publish images of children in a state of undress or distress.
- Charity devices: images are taken only on Charity-owned devices and are not retained on personal devices.
- Secure storage: images are stored on secure, access-controlled systems, available only to authorised personnel.
- Safeguarding alerts: we will not photograph any child where we are advised that doing so could place them at risk, for example where a child is looked after or subject to a court order.
9.5 Public Events
At public events, including the Let’s Make Noise Cup, official photography and filming may take place, and members of the public and the press may also be present. We will display clear notices informing attendees that photography may occur, provide a means by which participants may indicate that they do not wish to be photographed, and inform any appointed photographer or media representative of our requirements. Parents and attendees are asked to photograph only their own children and not to share images of other children online.
10. Children’s Data and Parental Responsibility
10.1 Children have the same rights as adults in respect of their personal data. Where a child is too young, or lacks sufficient understanding, to exercise those rights, a person with parental responsibility may exercise them on the child’s behalf, provided this is in the child’s best interests. For online services, we will obtain parental consent for children under the age of 13.
10.2 Where a young person is aged 18 or over, they are entitled to exercise their own data protection rights. Where they lack capacity to make a particular decision, we will act in accordance with the Mental Capacity Act 2005, involving any person holding lawful authority, such as a Lasting Power of Attorney or a court-appointed deputy.
11. Sharing and Disclosure of Personal Data
11.1 We do not sell, rent or trade personal data. We share personal data only where it is necessary, proportionate and lawful to do so, with the following categories of recipient:
- Service providers (processors) acting on our instructions, such as IT, cloud storage, email, website hosting, payment and ticketing providers, under written contracts that require them to protect your data;
- Delivery partners, such as our speech and language therapy partner, solely to the extent necessary to deliver services you have requested;
- Employers hosting work experience placements, limited to information necessary for the placement to proceed safely, with consent;
- Statutory agencies, including local authority children’s and adult social care, the police and the Local Authority Designated Officer, where necessary to safeguard a child or adult at risk, or where required by law;
- Regulators and professional advisers, including the Charity Commission, HM Revenue and Customs (for Gift Aid), the Information Commissioner’s Office, our auditors, insurers and legal advisers; and
- Funders, to whom we provide only anonymised or aggregated information, unless you have expressly consented otherwise.
12. International Transfers
12.1 We generally store personal data within the United Kingdom. Where any of our service providers process data outside the United Kingdom, we will ensure that the transfer is subject to appropriate safeguards, such as a UK adequacy regulation or the International Data Transfer Agreement, as required by Chapter V of the UK GDPR.
13. Data Security
13.1 We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. These include:
- encrypted, password-protected and access-controlled storage, with multi-factor authentication where available;
- role-based access, restricting sensitive and safeguarding information to authorised personnel only;
- secure, locked storage for any paper records, and confidential shredding when no longer required;
- data protection and confidentiality training for all personnel, and confidentiality obligations within their agreements; and
- regular reviews, audits and compliance checks of our data protection practices.
14. Data Retention
14.1 We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including any legal, accounting, safeguarding or reporting requirements. Upon expiry of the relevant period, data is securely deleted or anonymised.
| Type of record | Retention period |
|---|---|
| Participant registration and consent forms | Duration of participation and up to 2 years after last attendance |
| Photographs and video | Up to 3 years from the date of capture, unless consent is renewed or withdrawn sooner |
| Safeguarding and child protection records | Until the individual’s 25th birthday, or longer where required by statutory guidance |
| Allegations against personnel | At least 10 years, or until normal retirement age, whichever is longer |
| Therapy and progress notes | Until the individual’s 25th birthday (or 26th if aged 17 at the conclusion of treatment) |
| Accident and incident records involving children | Until the individual’s 21st birthday |
| DBS check information | Outcome and reference number only; certificate copies no longer than 6 months |
| Staff and volunteer records | 6 years after the end of the engagement |
| Donation and Gift Aid records | 6 years after the end of the financial year to which they relate |
| General enquiries and correspondence | Up to 2 years |
15. Your Rights
15.1 Subject to certain conditions and exemptions, you have the following rights under the UK GDPR:
| Right | What it means |
|---|---|
| Right to be informed | To be told how your personal data is used, as set out in this Policy. |
| Right of access | To request a copy of the personal data we hold about you or your child (a subject access request). |
| Right to rectification | To have inaccurate or incomplete personal data corrected. |
| Right to erasure | To request deletion of personal data, where there is no compelling reason for its continued processing. |
| Right to restrict processing | To request that we limit how we use your personal data in certain circumstances. |
| Right to data portability | To receive personal data you provided to us in a structured, commonly used format. |
| Right to object | To object to processing based on legitimate interests, and to object at any time to direct marketing. |
| Rights relating to automated decision-making | Not to be subject to decisions based solely on automated processing. We do not undertake such processing. |
15.2 To exercise any of these rights, please contact us using the details in Section 22. We will respond without undue delay and in any event within one calendar month, which may be extended by up to two further months for complex requests. We will not ordinarily charge a fee. We may need to verify your identity, and your authority where you act on behalf of a child, before responding.
16. Consent and its Withdrawal
16.1 Where we rely on consent, you may withdraw it at any time, without detriment. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
16.2 To withdraw consent for the use of images, please submit a written request to safeguarding@letsmakenoise.org. We will remove the relevant images from our website and social media channels within 30 days of receipt and will cease any further use. Please note that we are unable to recall printed materials already distributed, or images previously published by third parties such as the press, although we will take reasonable steps to request their removal.
17. Communications, Marketing and Fundraising
17.1 We will send newsletters, event information and fundraising communications by email or text message only where you have given your consent, in accordance with the Privacy and Electronic Communications Regulations 2003. Every communication will include a simple means of unsubscribing. We will never share your details with other organisations for their own marketing purposes. We adhere to the Code of Fundraising Practice.
18. Website and Cookies
18.1 Our website, www.letsmakenoise.org, uses cookies and similar technologies. Strictly necessary cookies are used to enable the website to function. Analytics and other non-essential cookies are used only with your consent, which you may give or withdraw at any time through our cookie settings. Our website may contain links to third-party websites, whose privacy practices are outside our control.
19. Personal Data Breaches
19.1 We maintain procedures for identifying, investigating and responding to personal data breaches. Where a breach is likely to result in a risk to the rights and freedoms of individuals, we will notify the Information Commissioner’s Office within 72 hours of becoming aware of it, and where the risk is high, we will inform the affected individuals without undue delay.
20. Complaints
20.1 If you have any concern about how we handle your personal data, please contact us in the first instance and we will endeavour to resolve the matter promptly. You also have the right to lodge a complaint with the Information Commissioner’s Office, the UK supervisory authority for data protection:
Information Commissioner’s Office (ICO) Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Helpline: 0303 123 1113 · Website: www.ico.org.uk
21. Changes to this Policy
21.1 This Policy is reviewed at least annually, and sooner where required by changes in legislation, guidance or our activities. The current version is published at www.letsmakenoise.org. Where we make material changes, we will take reasonable steps to notify those affected.
22. Contact Us
| Contact | Details |
|---|---|
| Postal address | Let’s Make Noise, Office 705, Avicenna House, 258–262 Romford Road, London E7 9HZ |
| Email (data protection enquiries) | info@letsmakenoise.org |
| Telephone | 020 8058 9885 |
| Safeguarding concerns and consent withdrawal | Nawal Sulieman, Designated Safeguarding Officer · safeguarding@letsmakenoise.org |
| Website | www.letsmakenoise.org |
This Policy was approved by the Board of Trustees (Osman Osman, Chair; Fahad Hassan; Faduma Mohamed) on 29 October 2026, as recorded in the minutes of the meeting of the Board. It will next be reviewed in October 2027.