open-navigation
close-navigation
DONATE
PARENT REFERRAL

Privacy notice

Why do we provide this Privacy Notice

 We understand that when you provide your personal data to us, we must look after it and keep your personal data safe and secure. We respect the data protection laws in the UK and this Privacy Notice tells you what personal data we collect and use in providing our charity services to you, how it is being collected, what allows us to do this (called the lawful bases), how long we are keeping it and it tells you about your rights. This privacy notice applies to our website, and the services and support that we provide. 

 

The data protection laws are the UK and EU General Data Protection Regulation (collectively referred to here as ‘GDPR’), the UK Data Protection Act 2018 (‘DPA18’) and the Data (Use and Access) Act 2025 (‘DUAA’). 

Who are we and how can you contact us?

 We are Spoons, a charity registered in England (Charity Number 1167043) that provides support for families in Greater Manchester who have or are facing the challenges of neonatal care. 

 

We have voluntarily appointed a Data Protection Officer/Lead and they can be contacted at: Data Protection Officer, Spoons Charity, 151 The Rock, Bury, BL9 0ND or by email to care@spoons.org.uk 

Information we collect and why

General

 We will ask for personal information when you contact us or use our services. This is to help us provide you with timely support and information, communicate with you, and helps us maintain internal record keeping and administrative purposes, records of contact and attendance at activities which supports our charity. 

The personal information will include: 

  • Name 
  • Email 
  • Social media profiles (where relevant) 
  • Date of birth 
  • Phone/mobile number 
  • Home/Mailing address 
  • Family details including the name and date of birth of your child/children 
  • Work address (where relevant) 
  • Website address (where relevant) 
  • Payment / donation information (where relevant) 

When we are supporting you through our activities that include supporting you when in the Neonatal Unit, signposting you to other services, providing resources and packs, providing emotional and practical support, we will also collect what is called ‘Special Category Data’, that is more sensitive data such as: 

  • Details of any particular care needs 
  • Details of health or medical conditions 
  • Race or ethnicity where appropriate. 

We will attribute any content (eg. posts and comments) you submit for publication on our website to you using your name where you consent to this. 

Soft Opt-in

If we run any competitions or offer any additional benefits to you, or to send you promotional information about our products and services that we consider may be of interest to you, we will use your contact details. To do this we will rely on the Product and Services Soft Opt-in and the Charity Soft Opt-in which were introduced in February 2026. You will be provided with opportunity to decline this or unsubscribe at each point of contact. 

Employment / Volunteer / Trustees

If you are applying for a job with us, or to be a volunteer or trustee, we will collect personal information on your application form. This will include: 

  • Name 
  • Address / contact details 
  • Qualifications 
  • Description of experience 
  • Previous employment details where relevant 
  • Referee contact details (you must have obtained their permission to include their details) 
  • Health data 
  • Race and ethnicity 

This will be processed to determine suitability and to undertake necessary obligations such as determining Right to Work or any criminal checks, any relevant checks that may prevent you becoming a volunteer or trustee. 

What allows us to collect this – the Legal bases

We will process your personal information lawfully, fairly and in a transparent manner. We collect and process (use and store) information about you only where we have legal bases for doing so. 

 

These legal bases depend on the support, activities and services we provide to you, meaning we collect and use your information only where: 

  • You give us consent to do so for a specific purpose or reason (for example, you might consent to us sending you our newsletter or when you fill in our online contact form or apply for a role with the charity); or 
  • It is necessary for the performance of a contract with you which may be a verbal contract / agreement (for example, when we provide a service you request from us or we employ you); 
  • It satisfies a legitimate interest such as supporting our research, to market and promote our services, and to protect our legal rights and interests when necessary; 
  • We have a legitimate interest to undertake analytics and business development, including to operate and improve our website and associated social media platforms; 
  • We need to process your data to comply with a legal obligation such as returns to funding or commissioning sources, or to comply with employment, finance or charity laws. 
  • When we collect the special category (sensitive) data we do so with your explicit consent. 
  • For employees where we collect special category data, we will rely on the obligations for the field of employment and social security (Article 9(2)(b) of GDPR) 

Where you consent to our use of your personal information or that of your family for a specific purpose, you have the right to change your mind at any time and this is known as withdrawing consent (but this will not affect any processing that has already taken place). 

Information from third parties

If we receive personal information about you from a third party, we will process it as we have described here and we will tell you who we receive it from. Typically this is from a hospital / Trust or GP. 

If you are a third party providing personal information about somebody else, you must confirm to us in writing or email that you have the individual’s consent to share the personal information to us. 

Children’s personal information

We do not intend to directly collect children’s personal information nor do we design or provide our website with the expectation that it will be accessed by a child without a parent or guardian’s knowledge.

 

If you are a child under the age of 13 years, you must have your parent or guardian’s permission before you provide us with any personal information or speak directly with us. If you are aged between 13 and 18 years we recommend that you tell your parents that you have contacted us. 

 

We will typically collect the parent or guardians’ personal information and not that of the child, unless the parent or guardian consents to us gathering the information of the child. 

How long we keep your data and how we keep it safe

We do not keep personal information for longer than is necessary. We have a retention schedule that provides detail. 

Examples of retention are 

  • We are required to keep financial records including donations for 6 years after the end of the current financial year to comply with HMRC regulations (a legal obligation). 
  • We will keep your initial contact form for 1 year. 
  • We will keep referral forms and your client records for 8 years after last contact which is in line with NHS guidance for any records containing health data. 
  • Employment records are generally kept for 6 years after someone ceases to be employed by us. This applies to any volunteer records that we hold. 

While we retain this information, we will take all reasonable steps to protect it using commercially acceptable means to prevent loss and theft, as well as unauthorised access, disclosure, copying, use or modification. That said, we advise that no method of electronic transmission or storage is 100% secure and cannot guarantee absolute data security. 

Sharing your personal information

We will share your personal information with: 

  • Our employees, volunteers and trustees. 
  • Third party service providers for the purpose of enabling them to provide their services, professional advisors and IT or payment systems operators who support us. 
  • Courts, tribunals, regulatory authorities and law enforcement officers, as required by law. 
  • Health professionals, Health Trusts/Hospitals, GP etc with your knowledge and consent. Where we believe that it is necessary to protect the vital interests of you or someone else, we may do this without your consent as this supports safeguarding and can ensure that you receive additional support. 
  • Sponsors or promoters of any competition we run with your consent if you choose to participate. 

We will not share it with others, nor will we sell or buy your personal information. 

 

If Spoons or our assets are acquired, or there is a merger, or in the unlikely event that we go out of business or enter bankruptcy, we would include data among the assets transferred to any parties who acquire us. Any parties who are linked to acquisition or merger, or handling bankruptcy or administration of our charity will continue to use your personal information according to this notice. 

International transfers of personal information

We do not knowingly transfer your personal data overseas (that is outside the UK or EU or EEA). We try to ensure that the personal information we collect is stored and processed in UK, or where we or our partners, affiliates and third-party providers maintain facilities. 

 

If a transfer outside the UK is necessary, we will only do this where there are appropriate safeguards in place such as a contract using International Data Transfers Agreements approved by the Information Commissioner in the UK, or other legally accepted means, or the country has an adequate level of protection for personal data. 

Your rights

You have a number of rights relating to the processing of your personal data. 

  • A right to be informed — This privacy notice fulfils that right. 
  • A right of access to your personal data held by us, also called a Subject Access Request. 
  • A right to rectify any personal data held by us that you believe is incorrect. 
  • A right to erase any personal data that we no longer have a legitimate purpose to process (right to be forgotten). 
  • A right to restrict the processing of your personal data subject to certain conditions and obligations. 
  • A right of access to a machine-readable version of your data (data portability). There are conditions that apply to this right, but we will endeavour to give you a portable version of any of your data where possible. 
  • A right to object to us processing any of your data that we do not have a legal or contractual obligation to process. 
  • Rights linked to automated decisions or profiling involving your data. 

You can contact us at care@spoons.org.uk or write to us if you wish to exercise these rights. 

 

Where you have provided personal data with consent, you can withdraw this consent at any time. This may mean that we are unable to provide all services to you or your family. If you wish to do this, please send an email to care@spoons.org.uk with the subject “withdraw consent”. 

 

More information on your rights is available on the Information Commissioner’s website at www.ico.org.uk. 

Complaints

We are sure that you will not need to complain, but just in case, if you wish to raise a complaint on how we have handled or processed (used) your personal data, or you have a complaint about the accuracy or retention of your data for example, you should contact us. We will acknowledge within 30 days as outlined in the amended legislation although we aim to do this sooner. We will investigate the matter without undue delay and will provide you with an outcome. If the investigation takes longer than anticipated, we will keep you informed of progress. 

 

If you are not satisfied with our response or believe we are processing your personal data in a way that is not in accordance with the law you have a right to complain to the UK Information Commissioner’s Office. Telephone 0303 123 1113 (local rate) or complete their online form here.

Changes to this notice

At our discretion, we may change our privacy notice to reflect current acceptable practices or changes to legislation. We will take reasonable steps to let users know about changes via our website. You should revisit this privacy notice regularly. 

 

Last Reviewed June 2026