# application data privacy draft

Status: Draft for trustee review.

## Who this information is for

Child Sparks (registered charity 1219134) supports children, young people and their families. This notice covers enquiries through this website and explains what to consider when applying for membership or support through Sparks Connect. Contact us using the Contact page if you have a question about your information.

## Your application data

The public contact form asks for your name, email address, enquiry type and message. It also records your acknowledgement of the privacy information. Please share only what we need to understand your enquiry. Do not send full medical records, identity documents or information about other families through this form. Membership applications take place in Sparks Connect, which is separate from this public website. Read the information shown there before providing family or child details.

## Membership and support

Information supplied for membership is used to manage the application and the support requested. Details about a child’s health or neurodevelopmental needs require particular care. Before collecting these details, Child Sparks must explain which information is required, why it is needed, who can access it and the lawful basis and additional condition for using sensitive information. Acknowledging that you have read a notice is not consent to every possible use of your information.

## How website enquiries are handled

Enquiry details are stored encrypted in the website database. An email notification directs authorised administrators to the record; it does not include the message itself. Safeguarding and complaint records have restricted administrator access. Website hosting and email services support this process. Information may need to be shared with an appropriate authority when addressing a safeguarding concern; the reason and information shared should be recorded.

## Keeping information secure and limiting its use

The website uses administrator permissions, encrypted enquiry storage and checks designed to reduce abusive submissions. It does not use enquiry details to make automated membership decisions. Information should be kept only for as long as it is needed for the purpose for which it was collected, including any applicable safeguarding or legal record-keeping requirements. A documented retention and deletion schedule for each record type must be confirmed before this draft is adopted.

## Cookies and your design choice

Essential cookies support form security and administrator sign-in. The image-verification challenge expires after ten minutes. If you choose a website design, your browser stores that choice locally so it can be remembered on your next visit. You can remove it through your browser’s site-data settings. The website also uses limited security records to reduce repeated abusive requests.

## Your choices and rights

You can ask Child Sparks about access to your personal information, correction of inaccurate information, deletion, restriction or objection to its use, and portability where applicable. These rights depend on the circumstances and the legal basis for processing. Where processing relies on consent, you can withdraw that consent. Contact us to make a request. You can also raise a data-protection concern with the Information Commissioner’s Office at ico.org.uk/make-a-complaint/.

## Review before adoption

Draft for trustee review. Child Sparks must confirm the lawful basis for each purpose, the additional condition for sensitive data, the retention schedule, service providers, any international transfers and the membership data flows in Sparks Connect. This draft does not certify compliance or replace the information provided at the point of collection.