Privacy Policy for Babyzone (Charity number: England and Wales: 1198316; Scotland: SC054355)

Babyzone is a children’s charity. We run hubs where families with babies and young children come for play, support and advice.

Each family can have a digital membership card with a QR code, so you only have to tell us your details once and we can welcome you in quickly.

We keep your information in the UK, we never sell your personal information, and only the staff who need to see it can see it.

You do not have to have a membership card, and you do not have to have a smartphone — we can always look you up by name or postcode.

We must record the name of every adult and child who comes into the building, each child’s date of birth, and each person’s gender, so we can keep everyone safe, run our hubs properly, and understand and report on the impact of our work. If you do not want us to hold some of this information, please speak to a member of staff in a hub or contact us using the email addresses below.

1. Who we are

We are Babyzone, a charity registered in England and Wales (charity number 1198316) and in Scotland (charity number SC054355).

Our address is Babyzone, Scale Space, 58 Wood Lane, London, W12 7RZ.

We are responsible for the information we hold about you. In data protection law this makes us the “controller” — it means we decide what information is collected and why, and we are the ones who look after it.

This policy covers everything we do with your information. This includes our website, our services, our Baby Buddy app, our membership programme, our fundraising, our hubs and other services.

2. Why we’re allowed to use your information

The law says we must have a reason every time we use information about you. Data protection law calls these reasons a “lawful basis”. There are six we rely on. Further down this policy, every single thing we do with your information has a number in brackets next to it. That number tells you which of these six reasons applies.

1. You have given consent. You agreed to us using your information, and we told you what for. You can change your mind at any time, and we will stop.
2. We need to do something you have asked us to do. For example, if you join our digital membership we need to hold your information. Or if you buy something from us, we have to use your payment details to take the payment.
3. We have a legitimate interest. This means using your information helps us run the charity or helps families generally — and we have checked that it does not get in the way of your privacy. If you want to know what we decided and why, ask us.
4. We have a legal obligation. For example, keeping records we are required to keep, or reporting a concern about a child’s safety.
5. Processing is necessary in order to protect the vital interests of the data subject or of another natural person. This means we may use your information if we need to protect someone’s life, health or safety — for example, in an emergency.
6. Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. This means we may use your information where our work is being carried out for a public-interest purpose, or where we are working with or under the authority of a public body.

Some of the information we process, such as health information, is special category data. Where we process special category data, we do so only where an additional condition under data protection law applies, such as where you have given your explicit consent or where another condition permitted by law applies.

3. What information we collect

We collect information in three ways: you give it to us, we collect it automatically when you use our services, or we receive it from someone else.

What you give us

• When you get in touch or sign up for something. Your name, your email address, your postal address, and anything you choose to tell us.
• When you donate or buy something. Your address and payment details.
• When you support us or we contact you about supporting us. Your name, contact details, organisation, role, donation history, interests, and notes about your relationship with Babyzone.
• When you answer surveys or give feedback. Your answers, comments and anything else you choose to tell us about your experience of Babyzone, our hubs, Baby Buddy or our other services.
• When we ask about longer-term outcomes. Your contact details and any answers you choose to give if we contact you later to understand the longer-term impact of our work.
• When you use the Baby Buddy app. Your child’s profile, your contact details, notes about your child’s development, identity details, photographs you upload, location, health information, your preferences, things you search for, answers you give in surveys, and details of anything you buy.
• When you register your family for a Babyzone hub and join our Digital Family Membership. Your name, postcode, email or phone number, relationship to children, gender and date of birth of each child. We will generate a unique code for you. This is shown as a QR code and a written code. It does not contain any hidden information. An ordinary phone camera cannot find anything about you from that QR code.
• When you use our website or digital systems. Your IP address, device type, and information from cookies.
• When you check in at a hub. Each time you visit, staff scan your card or look you up by name or postcode. Staff then confirm which adults and children have come with you that day. The system records the hub, date and time automatically, so we have an accurate attendance record without asking you to give all your details again.

What we collect automatically

• When you use our website or digital systems. Your IP address, device type and information from cookies.

When you check in at a hub. Each time you visit, staff scan your card or look you up by name or postcode. Staff then confirm which adults and children have come with you that day. The system records the hub, date and time automatically, so we have an accurate attendance record without asking you to give all your details again.

4. How we use your information

Every use has a number in brackets. The numbers refer back to the six reasons in section 2.

Running our hubs and your family membership

• To create your family record and send you your membership card by WhatsApp (2)
• To welcome you at the door, find your record and greet you by name (2, 3)
• To record which adults and children attended, when and at which hub (2, 3)
• To let you check in when you do not have your card, your phone or a smartphone, by looking you up on your name or postcode (2, 3)
• To keep your record accurate when your family changes — a new baby, a new adult, a change of details (2, 3)
• To know who is in our buildings and to keep children safe, including raising a concern where we have to (5)
• To invite you to antenatal sessions, if you have told us you are expecting a baby (2, 3)
• To plan our sessions and staffing, and to work out where to open next (3)
• To produce impact reports and meet funder reporting requirements, including reporting whom we reach and how many men attend, using anonymised or aggregated information only (3)

Our website, our app and staying in touch

• To run our website and keep it working (3)
• To run the Baby Buddy app and give you what it offers (1, 2)
• To send you emails, newsletters and updates you asked for (1)
• To add you to our WhatsApp community, if you said yes (2)
• To run webinars and sessions and record who came (1, 3)
• To take donations and run our fundraising (1, 2, 3)
• To market to professionals who work with families (3)

Understanding and reporting our impact

We use information to understand whether Babyzone is helping families, to improve our work, and to explain our impact to the people and organisations that support us.

• To understand the short-term and longer-term impact of our hubs, Baby Buddy and our wider work (3)
• To ask for feedback, run surveys and ask voluntary questions about outcomes, so we can understand what works and improve what we do (1, 3)
• To contact families, supporters or former service users later to ask voluntary questions about outcomes, where it is appropriate and lawful to do so (1, 3)
• To produce impact reports and report to funders, supporters and partners on who we reach and what difference our work makes, using anonymised or aggregated information only (3)
• To share anonymised or aggregated figures or datasets with funders, local authorities, research bodies or universities, where this helps show or understand the impact of our work. We do not share individual-level family or attendance data with them (3)
• To allow a partner, funder or local authority to send a message to a group of families, without giving them those families’ contact details (1, 3)
• To raise money for Babyzone, including keeping records of donors, supporters, prospects and organisations we work with (3)

5. Who we share your information with

We never sell your personal information. Some information is processed by companies we work with. We share information only where we have a lawful reason, and only the parts that are needed.

We share information with:

• Companies that provide services to us. They deliver services to us, on our instruction. They are listed below, and change from time to time.
• Our funders, local authorities and research or impact partners. We share anonymised or aggregated information with them so we can show who we are reaching and what difference our work makes. Some organisations may pay for access to reports or dashboards based on those anonymised and aggregated figures. We do not share individual-level family or attendance data with them.
• Anyone the law says we must tell. For example, if we are worried about a child’s safety, or if a court orders it.

The companies we use:

Where your information is kept. We keep all Babyzone’s data in England wherever possible. When not possible, the data is in locations that have “adequacy” with the Data Protection Act, or appropriate contractual arrangements.

6. How we look after your information

We use technical and practical measures to keep your information safe. Your data is encrypted when it travels and when it is stored, which means it is scrambled so that it cannot be read by anyone who is not meant to see it.

Staff can only see what their job needs them to see. Sometimes this might mean they can see just part of the information we store (for example, just the end of a phone number rather than the full number). We do this to minimise access to data.

If we become aware of a personal data breach, we will investigate it, take appropriate steps to reduce any harm and notify the Information Commissioner’s Office and affected individuals where the law requires us to do so.

7. How long we keep your information

We keep your information for as long as we need it, and then we either delete it or make it anonymous.

8. What rights do you have

You have rights over your information. You can ask us to:

• Give you access to the information we hold about you and your family
• Correct information that is wrong or incomplete
• Delete your information in some circumstances
• Restrict how we use your information for a while, or ask us to use it only in limited ways, in some circumstances
• Object to us using your information where we rely on legitimate interests
• Change your mind about anything you agreed to, where we rely on consent
• Send your information to you or to someone else in a form that can be moved, where the law gives you this right
• Stop marketing to you
• Ask about automated decisions or profiling. We do not currently make decisions about families by fully automated means. If that ever changed, we would explain it clearly and tell you about your rights.

You will never be charged for asking, and we will never treat you differently for asking.

You cannot see or change your own family profile in our system yourself. If something is wrong, or you have a new baby, or an adult has left the family, tell a member of staff at your hub or email us, and we will update it.

If you change your mind about something you agreed to, we will stop using your information for that purpose. If you ask us to delete your family record, we will delete the information that identifies you and your family, but we may keep anonymous visit counts so we can report on attendance, plan our services and meet audit or funding requirements.

9. General

Children’s information

Everything we hold about a child comes from the adults who bring them. When you register your family, you give your child’s first name, last name and date of birth, and you tell us each time which children have come with you. Where a parent or guardian gives us information about a child, they are agreeing on that child’s behalf. Children’s dates of birth are partly hidden from most staff — at check-in, only the month and year are shown.

Babyzone’s mission is to help children. We believe they should be able to access their own information when it’s appropriate. We follow ICO guidance on when and how a child can access their own information.

Cookies and our website

Our website and digital systems uses cookies and similar technologies. Cookies are small files that let us count how many people visit and see how the site is used. We look at this as overall numbers, not to identify you. We keep cookie information for up to a year. You have to accept cookies for some parts of the site to work.

Changes to this policy

We update this policy when what we do changes. The date at the top tells you when it last changed.

Routine supplier changes. We may change the companies that help us from time to time. When we do, we check that any new company protects your information properly. We do not tell you individually about every routine supplier change, but we keep this policy up to date.

Material changes. If we make an important change to how or why we use your information, we will tell you.

10. Contact us

If you have a routine question about your family membership, Baby Buddy or your information, or you want to ask us to do any of the things in section 8:

• For routine questions about your family membership — your details, your card or your visits, email membership.support@babyzone.org.uk
• For anything about Baby Buddy, email babybuddy@babyzone.org.uk
• For data protection rights requests, including requests to see, correct or delete information, email dp@babyzone.org.uk
• Write to us at Babyzone, Scale Space, 58 Wood Lane, London, W12 7RZ
• Talk to a member of staff at any Babyzone hub

If you are not happy with how we have handled your information, please tell us first, and we will try to put it right. You also have the right to complain to the Information Commissioner’s Office, which is the UK’s independent regulator for data protection. They cover the whole of the UK, including Scotland and Wales.

Complaining to the ICO does not cost anything, and you can do it whether or not you have spoken to us first.

• Phone: 0303 123 1113
• Website: www.ico.org.uk