Friends – Play for Disabled Children
Family Privacy Notice
Effective from: 2 October 2026.
Friends – Play for Disabled Children supports disabled children and their families in St Helens and surrounding areas.
This notice explains what personal information we collect, why we use it and how we look after it.
If you have any questions about your information, please email:
info@friendsplay.org.uk
Who is responsible for your information?
Friends – Play for Disabled Children is the data controller.
Our trustees are responsible for how the charity uses personal information and Paula Jones is our named Data Protection Lead.
What information do we collect?
The information we collect depends on how you use Friends.
It may include:

• your name, address, email address and telephone number;
• another parent/carer’s details;
• emergency contact details;
• your children’s names and dates of birth;
• information about siblings or other family members;
• membership/account information;
• transport requirements;
• bookings, orders and attendance;
• event and ticket information;
• photographs;
• email preferences;
• information you send us in emails, forms or messages;
• accessibility requirements;
• wheelchair and transfer information;
• Nimbus/Access Card details; and
• information about disabilities, diagnoses or health needs.
  Health and disability information is classed as special-category personal data and receives additional protection under data-protection law.
  Why do we need this information?
  We use information to:
• administer Friends membership;
• check that families meet our membership criteria;
• understand the families and communities we support;
• arrange accessible events and activities;
• manage bookings, tickets and transport;
• communicate important information about an event;
• understand access and support requirements;
• maintain emergency contact information;
• provide Nimbus/access information needed for accessible bookings;
• process payments and refunds;
• contact members who have chosen to receive event notifications;
• manage the website and member accounts;
• monitor how our activities are used;
• provide anonymised or aggregated information to funders;
• administer funded activities;
• keep appropriate financial and audit records;
• respond to enquiries and complaints; and
• keep our services safe and appropriately managed.
  We regularly review what information we ask for and aim not to collect more than we need.
  Our lawful bases
  Different lawful bases apply to different things we do.
  For ordinary membership and charity administration, we may rely on our legitimate interests in running Friends and providing appropriate services to member families.
  For paid bookings and similar arrangements, we may process information because it is necessary to provide the booking or service you have requested.
  Where we send optional event/marketing emails, we use consent where required.
  Where we process health or disability information routinely, we need both an ordinary lawful basis and a separate legal condition for special-category information.
  For routine information that you choose to provide about disability, diagnosis and accessibility, Friends will normally use explicit consent for the special-category element.
  You can withdraw consent, although this does not affect processing already carried out lawfully. In some cases we may be unable to provide a particular accessible service if we no longer have information that is genuinely necessary to provide it.
  In exceptional circumstances, such as safeguarding, another legal condition may apply.
  Nimbus and eligibility evidence
  Friends has changed the way it handles disability/eligibility evidence.
  We no longer routinely retain copies of full DLA/PIP letters, Nimbus card images or similar eligibility evidence on the website.
  Where we need Nimbus/Access Card information for accessible bookings, we keep only the details genuinely required, such as:
• cardholder name;
• card/reference number;
• expiry date; and
• awarded access symbols.
  If you need to email us evidence for verification, we will aim to record only the information we need and delete the unnecessary original attachment when it is no longer required.
  Expired details will be reviewed and removed or replaced where appropriate.
  Orders and payments
  Bookings and orders are made through our website.
  Our website uses WooCommerce to administer orders.
  Payments are handled through payment providers such as PayPal and any other payment options we make available at checkout.
  Friends does not need to receive your full bank-account or payment-card information.
  We may retain information such as your order number, contact details, products/tickets booked, quantities, transaction reference and refund information where needed for administration, accounting, audit or funding requirements.
  
• Who can see your information?
  
• Access is limited to people who need the information to perform their role.
  This may include authorised trustees and approved technical support providers.
  Our website is hosted by 34SP.
  We use Microsoft 365, including shared charity storage, to manage charity files and correspondence.
  We use EmailOctopus to send event/email communications. The mailing-list information supplied for this purpose is limited to the information required, currently name and email address.
  Technical providers may occasionally require temporary access to investigate or resolve website problems. Access should be removed when no longer required.
  Sharing information with venues and providers
  Sometimes we need to give limited information to venues, transport operators or activity providers.
  For example, a venue may need an attendance register showing a lead-booker/family name and the number or type of tickets booked.
  We aim to share only what the provider actually needs.
  We do not routinely give providers your home address, telephone number, email address, diagnosis or medical information.
  Where additional accessibility information is genuinely required to arrange your participation, we may provide the minimum necessary information.
  Funding information
  Funders sometimes ask us to demonstrate who our charity supports or how an activity has benefited families.
  Where possible, we provide this as anonymous or aggregated information — for example numbers or percentages rather than identifiable family details.
  If identifiable information is genuinely required, we will only provide it where we have an appropriate lawful basis.
  Feedback and surveys
  We sometimes use Microsoft Forms for surveys or feedback.
  These are normally anonymous where we do not need to know who responded.
  If a form gives you the option to leave your details because you would like us to contact you, we will use those details for that purpose.
  Photographs
  We use photographs to show the activities Friends provides and to promote and report on our work.
  Photographs may appear on Friends-controlled channels including:
• our website;
• our public Facebook page;
• newsletters; and
• appropriate charity publicity or funding material.
  Members of our closed Facebook group are told that event photographs posted in the group may be selected for Friends publicity.
  If you do not want Friends to reuse a photograph, please do not post it for that purpose or contact us.
  If you later want us to stop using a particular image, email info@friendsplay.org.uk. We will remove it from Friends-controlled channels where reasonably possible.
  We cannot always remove material already printed, downloaded or independently shared by other people.
  Email notifications
  You can choose whether to receive email notifications about Friends events.
  You may unsubscribe or change your choice at any time.
  Choosing not to receive event emails does not prevent you from remaining a member unless we genuinely need to contact you about the administration of your membership, an existing booking, safety or another necessary operational matter.
  Use of artificial intelligence
  Friends uses artificial-intelligence tools, including ChatGPT, for some administrative support.
  This may include:
• helping draft emails or other communications;
• organising or summarising administrative information;
• analysing booking information;
• checking totals or identifying unusual booking combinations;
• producing templates; and
• supporting planning and charity administration.
  We aim to minimise personal information before using an AI tool.
  For example, booking analysis should normally use an order/reference number rather than a member’s name or email address where identity is not needed.
  We do not intend routinely to upload full Nimbus cards, DLA/PIP documents, medical letters or other detailed disability evidence to AI tools.
  Identifiable or special-category information should only be used where there is a genuine need and the information cannot reasonably be reduced further.
  AI is used as an administrative aid. It does not make final decisions about membership, eligibility, safeguarding or access to Friends services.
  How long do we keep information?
  Different information is needed for different periods.
  Our current approach includes:
• membership information: while you are an active member and normally for up to 12 months after membership becomes inactive;
• full eligibility evidence: only for the time genuinely required to verify the relevant information;
• Nimbus/Access Card details: while current and required for accessible bookings, with review at expiry;
• order, accounting and funded-activity records: for the period required for financial, audit, legal or funding purposes;
• some funded activity records may need to be retained for several years where required by the funder;
• ordinary event records: only for as long as needed unless they form part of a funded/audit record;
• email-marketing information: until you unsubscribe or the information is otherwise removed; and
• photographs: while they remain appropriate for the purpose for which they are being used, subject to reasonable removal requests.
  We periodically review information and delete or anonymise it when we no longer have a reason to keep it.
  International data processing
  Some of the technology companies we use may process or support information using systems outside the UK.
  Where UK data-protection law requires safeguards for an international transfer, we expect the relevant provider arrangements to include an appropriate lawful transfer mechanism or other permitted safeguard.
  Your rights
  Depending on the circumstances, you may have rights to:
• ask for a copy of your personal information;
• correct inaccurate information;
• ask us to delete information;
• ask us to restrict how information is used;
• object to certain uses;
• receive certain information in a portable format;
• withdraw consent where we rely on consent; and
• raise concerns about automated decision-making.
  Not every right applies in every situation, but we will explain this if you make a request.
  Please contact:
  info@friendsplay.org.uk
  Complaints
  If you are unhappy with how we have handled your personal information, please contact us first at:
  info@friendsplay.org.uk
  You also have the right to complain to the Information Commissioner’s Office (ICO).
  Changes to this notice
  We may update this notice when our systems, services or legal obligations change.
  The current version will be made available on the Friends website.
  Effective from: 2 October 2026 Last updated: 2 October 2026 Next review: October 2027