Privacy Policy

Stick ’n’ Step Privacy Notice

Last updated: October 2026

1. Who we are

Stick ’n’ Step (“we”, “our” or “us”) is a registered charity (charity number 1136997) and a company limited by guarantee (company number 07257957).

We are committed to protecting your privacy and handling your personal information fairly, lawfully and securely. This Privacy Notice explains what personal information we collect, why we use it, who we may share it with and the rights you have in relation to your information.

We process personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), as amended, and other applicable data protection legislation.

Contact details

If you have any questions about this notice, wish to exercise your data protection rights or want to raise a concern, please contact our Data Protection Lead:
Email: sarah@sticknstep.org
Post: Sarah Smithson, Stick ’n’ Step, 3 Croxteth Avenue, Wallasey, CH44 5UL.

2. Whose personal information do we process?

We may process personal information about:

• Children and families who receive, have received or are applying to receive our services.
• Parents, carers and other family contacts.
• Current, former and prospective employees, volunteers, trustees and job applicants.
• Donors, fundraisers, event participants and other supporters.
• People who make enquiries, express an interest in our work or sign up to receive communications from us.
• Consultants, contractors, suppliers and professional contacts.

3. What personal information do we collect?

The information we collect depends on your relationship with Stick ’n’ Step.

Children and families

This may include names, dates of birth, addresses, contact and emergency contact details, attendance records, dietary requirements, photographs and videos, and information about a child’s development and progress.

We may also process health information, medical history, reports from other professionals, individual development plans, accident and incident records, and safeguarding information where necessary.

Employees and job applicants

This may include contact details, CVs, application forms, interview notes, qualifications, employment history, training records, performance information, absence records and relevant disciplinary or grievance information.

Donors, fundraisers, event participants and supporters

This may include names, contact details, donation and fundraising records, event registrations, records of your interactions with us, communication preferences and information about how you engage with our fundraising activities.

Consultants, contractors and suppliers

This may include contact details, professional information, contractual information, invoices, payment details and correspondence relating to the services provided.

We may also collect technical information about how people use our website, where applicable, to help us understand and improve its performance.

4. Why do we use your personal information?

We use personal information where necessary to:

• Deliver our therapy and support services to children and families.
• Support children's development and monitor their progress.
• Meet our safeguarding, health and safety and other legal responsibilities.
• Recruit, employ and manage staff and volunteers.
• Manage donations, fundraising activities, events and supporter relationships.
• Provide information about our work and the difference our supporters make.
• Promote fundraising campaigns, charity events, volunteering opportunities and other ways to support our charitable purposes.
• Respond to enquiries, feedback, complaints and requests.
• Administer contracts, payments, accounting and financial records.
• Evaluate and improve our services, fundraising activities and operations.
• Protect our premises, people and property, including through CCTV where applicable.
• Establish, exercise or defend legal claims where necessary.

We will only use your personal information for purposes that are lawful and appropriate to our relationship with you.

5. Our lawful basis for processing personal information

Under data protection law, we must have a lawful basis for using personal information. Depending on the circumstances, we may rely on:

• Contract: where processing is necessary to deliver an agreed service, fulfil a contract or take steps before entering into a contract.
• Legal obligation: where we must process information to comply with the law.
• Legitimate interests: where processing is necessary for our legitimate interests, or those of a third party, and these interests are not overridden by your rights and freedoms.
• Consent: where you have given consent for a specific purpose, such as certain uses of photographs or videos.
• Vital interests: where processing is necessary to protect someone's life or other vital interests

Where we process special category information, such as health information, we will also identify an applicable additional condition under data protection law.

Where we rely on consent, you may withdraw it at any time. This will not affect the lawfulness of processing carried out before consent was withdrawn.

6. Marketing communications and the charitable purposes soft opt-in

We want to keep our supporters informed about the work of Stick ’n’ Step, the difference their support makes and the many ways they can help us continue supporting children and families.
Our communications may include information about:

• Our charitable work, projects and campaigns.
• Fundraising appeals and opportunities to donate.
• Charity events, challenges and fundraising activities.
• Volunteering opportunities.
• Ways to support our charity and help us achieve our charitable purposes.
• Updates about the impact of donations and fundraising.

How we contact supporters

We may send marketing communications by email, text message or other forms of electronic messaging where permitted by law.

We may rely on your consent where you have given it. We may also use the charitable purposes soft opt-in introduced by changes to the Privacy and Electronic Communications Regulations, which came into force on 5 February 2026.

This provision allows charities to send certain electronic marketing communications without obtaining prior consent, provided all the legal requirements are met.

We may use the charitable purposes soft opt-in where:

• You have provided your contact details directly to Stick ’n’ Step.You provided those details when expressing an interest in, or offering or providing support for, our charitable purposes.
• We collected your contact details on or after 5 February 2026.
• We gave you a clear opportunity to refuse marketing communications when we collected your details.
• The communications are intended solely to further our charitable purposes.
• Every marketing communication gives you a straightforward opportunity to unsubscribe or opt out.

For example, this may apply when you provide your contact details directly to us when making an enquiry, registering for one of our events, volunteering or supporting our fundraising activities, provided the relevant legal requirements are satisfied.

The charitable purposes soft opt-in does not automatically apply to everyone in our database. We will not use it where the necessary conditions are not met, including where contact details were collected by another organisation or fundraising platform rather than directly by Stick ’n’ Step.

For contacts whose details were collected before 5 February 2026, we will continue to respect the permissions and preferences already recorded. We will not use the new provision for those existing details unless the legal requirements are subsequently met, for example when someone provides their details directly to us again in qualifying circumstances.

Where the charitable purposes soft opt-in does not apply, we will only send electronic marketing where we have obtained the required consent or another applicable legal permission.

How to stop marketing communications

You can opt out of marketing communications at any time by:

• Clicking the unsubscribe link in our emails.
• Following the opt-out instructions in our text messages, where available.
• Contacting us using the details provided in this Privacy Notice.

We will respect your choice and stop sending the relevant marketing communications.

Choosing not to receive marketing communications will not affect essential communications relating to services you receive, event bookings, donation receipts, contractual arrangements or replies to your enquiries.

We will maintain appropriate records of marketing preferences, consent, opt-outs and the legal basis used for communications.

7. Who do we share personal information with?

We may share personal information where necessary and lawful with:

• Service providers and data processors, such as organisations providing IT systems, email communications, database management and other services on our behalf.
• Local authorities and safeguarding agencies, where necessary to protect children and meet safeguarding responsibilities.
• Schools and other professionals, where appropriate to support a child's development, progress or transition.
• Professional advisers, including legal, accounting and other advisers where required.
• Regulatory bodies and public authorities, where required by law or necessary to meet our legal responsibilities.
• Other relevant organisations, where sharing is necessary for the delivery of our services or the administration of our activities and is lawful.

Where we use third-party fundraising platforms, such as JustGiving or Enthuse, those organisations may collect and process personal information under their own privacy notices. Information collected by those platforms is not automatically eligible for use under the charitable purposes soft opt-in.

We do not sell personal information.

Where we use organisations to process personal information on our behalf, we take appropriate steps to ensure that the information is handled securely and in accordance with applicable data protection requirements.

8. How long do we keep personal information?

We retain personal information only for as long as necessary for the purpose for which it was collected, taking account of legal, regulatory, safeguarding, financial and operational requirements.

Retention periods vary depending on the type of information and our relationship with you. We may need to retain certain records for specific periods to comply with legal obligations, manage claims or meet safeguarding responsibilities.

Where personal information is no longer required, we will securely delete it or anonymise it where appropriate.

We will also maintain records of marketing preferences and opt-outs where necessary to ensure that we respect people's choices and do not send unwanted communications.

9. How we protect your personal information

We take appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

Access to personal information is restricted to people who need it for their role. We expect staff, volunteers, contractors and service providers who handle personal information to follow appropriate confidentiality and data protection requirements.

10. Your rights

Under data protection law, you may have the right to:

• Access: request a copy of the personal information we hold about you
• Rectification: ask us to correct inaccurate or incomplete information.
• Erasure: ask us to delete your information in certain circumstances.
• Restriction: ask us to restrict how we use your information in certain circumstances.
• Data portability: request a copy of certain information in a structured, commonly used and machine-readable format.
• Object: object to certain processing, including processing based on legitimate interests.
• Withdraw consent: withdraw consent where we rely on it as our lawful basis.

You have the right to object to direct marketing at any time. This applies to direct marketing carried out using the charitable purposes soft opt-in as well as marketing based on consent.

These rights are subject to certain conditions and exceptions. For example, we may need to retain some information to comply with a legal obligation or to establish, exercise or defend a legal claim.

To exercise your rights, please contact our Data Protection Lead using the details at the beginning of this notice. We may need to verify your identity before responding.

11. Data protection complaints

If you are concerned about how we have collected, used, stored or shared your personal information, you can raise a complaint with our Data Protection Lead using the contact details in this notice.

We will acknowledge your complaint within 30 calendar days and investigate it without undue delay. We may contact you for further information where necessary and will provide a written response explaining our findings and any action taken.

If you remain dissatisfied, you may complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.

Website: https://ico.org.uk/

12. Changes to this Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in the law, our services or the way we process personal information.

The latest version will be published on our website. Where appropriate, we will notify people directly of significant changes.

We encourage you to review this notice periodically to understand how we protect and use your personal information.

Contact us

Stick ’n’ Step
Email: info@sticknstep.org
Telephone: 0151 638 0888
Post: 3 Croxteth Avenue, Wallasey, Wirral, CH44 5UL.
Additional centre: Tudor Hall, York Street, Runcorn, WA7 5BB.
For data protection enquiries, please contact our Data Protection Lead at sarah@sticknstep.org