Privacy Policy

Last updated: 01 March 2026

This Privacy Policy explains how we collect and use personal information when you use our website, contact us, or engage with our services. It is written to meet UK data protection requirements and the ICO’s expectations for privacy notices.

---

1. Who we are (Data Controller)

Organisation: Did Not Attend CIC

Registered office:

Email: DidnotattendFounder@outlook.com

Data protection contact / DPO (if appointed):

2. What information we collect

Depending on how you interact with DNA, we may collect:

• Website information: pages visited, device/browser info, approximate location (from IP), and cookie preferences.
• Contact information: name, email, phone number, organisation, and message content.
• Service delivery information: information relevant to engagement support, barriers to attendance, welfare indicators, and safeguarding concerns (where applicable).
• Special category data: where relevant and lawful, this may include health or social care information.

3. How we use your information

Respond to enquiries Safeguarding-led engagement support Governance & audit Website improvement

• To respond to messages and partnership enquiries (including NHS commissioning queries).
• To provide safeguarding-led engagement support and communicate with you (within agreed boundaries).
• To maintain appropriate records, reporting and oversight (governance and audit trail).
• To keep our website secure and functioning.

4. Our lawful bases (UK GDPR)

We only process personal data when we have a lawful basis. Common bases we rely on include: :contentReference[oaicite:2]{index=2}

• Consent (e.g., where you opt-in, or where consent is required for certain communications).
• Legitimate interests (e.g., responding to enquiries, improving services, ensuring site security) — balanced against your rights.
• Contract (where a service arrangement exists).
• Legal obligation (e.g., safeguarding and governance duties where applicable).
• Vital interests (rare, where life is at risk).

Special category data (e.g., health)

If we process special category data, we will also meet an additional condition under UK GDPR (for example, explicit consent or health/social care and safeguarding-related conditions where applicable). We apply strict access controls and minimisation.

5. Safeguarding and information sharing

6. Who we share information with

• Commissioners / partner services where needed for service delivery and reporting.
• Safeguarding agencies when concerns are identified and information sharing is lawful and necessary.
• Service providers who support our operations (e.g., website hosting, email, analytics) under appropriate contractual controls.

7. International transfers

Some suppliers may store data outside the UK. Where this happens, we use appropriate safeguards (such as adequacy decisions or contractual protections).

8. How long we keep information (retention)

We keep personal data only as long as necessary for the purposes above, including governance, safeguarding, and audit requirements.

Retention schedule:

9. Your rights

You have rights under UK GDPR, including: :contentReference[oaicite:3]{index=3}

• Access to your data
• Correction
• Erasure (in some cases)
• Restriction
• Objection (including to legitimate interests)
• Data portability (in some cases)
• Withdraw consent (where consent is used)

10. Complaints

If you have concerns, contact us first: DidnotattendFounder@outlook.com. You also have the right to complain to the Information Commissioner’s Office (ICO). :contentReference[oaicite:4]{index=4}

11. Changes to this policy

We may update this policy. The latest version will always be published on this page.