Privacy Policy

MyOTAS Charity Privacy Notice

This privacy notice tells you what to expect us to do with your personal information and includes:

Contact details
What information we collect, use, and why
Lawful bases and data protection rights
Where we get personal information from
How long we keep information
Who we share information with
How to complain

Contact details

MyOTAS is a registered charity no: 1184723 and is a charitable incorporated organisation with its principal office in England at 57A Highcliffe Road, Wickford, SS11 8JP and it is regulated by the Charity Commission.

Data Protection Officer: Mrs Samantha Read

Email address: info@myotas.org

Telephone number: 07840 799718.

What information we collect, use, and why

We may collect or use the following information to provide services and goods, including delivery and third-party referrals:

Names and contact details
Gender
Addresses
Date of birth
Photographs or video recordings
Service use history
Health information (including medical conditions, allergies, medical requirements and medical history)
Dietary information (including allergies and health conditions)
Information about care needs (including disabilities, home conditions, dietary requirements and general care provisions)
Information about work, home and living conditions
Information about support requirements
Information about lifestyle, interests or personal history
Records of meetings and decisions
Payment details (including card or bank information for transfers and direct debits)
Website user information (including user journeys and cookie tracking)
Information relating to compliments or complaints

We may collect or use the following information to receive donations or funding and organise fundraising activities:

Names and contact details
Addresses
Payment or banking details
Donation history
Tax payer information (for Gift Aid purposes)

We may collect or use the following personal information for service updates or marketing purposes:

Names and contact details
Website and app user journey information
Records of consent, where appropriate

We may collect or use the following personal information for dealing with queries, complaints or claims:

Names and contact details
Address
Purchase or service history
Correspondence

We may also collect or use the following information for dealing with queries, complaints or claims:

Health information

Lawful bases and data protection rights

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.

Which lawful basis we rely on may affect your data protection rights which are in brief set out below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:

Your right of access – You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for. You can read more about this right here.
Your right to rectification– You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete. You can read more about this right here.
Your right to erasure– You have the right to ask us to delete your personal information. You can read more about this right here.
Your right to restriction of processing– You have the right to ask us to limit how we can use your personal information. You can read more about this right here.
Your right to object to processing– You have the right to object to the processing of your personal data. You can read more about this right here.
Your right to data portability– You have the right to ask that we transfer the personal information you gave us to another organisation, or to you. You can read more about this right here.
Your right to withdraw consent– When we use consent as our lawful basis you have the right to withdraw your consent at any time. You can read more about this right here.

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.

Our lawful bases for the collection and use of your data

Our lawful bases for collecting or using personal information to provide services and goods, including delivery and third-party referrals are:

Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All your data protection rights may apply, except the right to portability. Our legitimate interests are:
- We need to process the data to run the activity. We must have details of who will be attending the activity, the age of the child and anything we should be aware of to make sure the child gets the best experience from the activity. This is to ensure that our service providers, staff and volunteers can meet the CYP medical and emotional needs.

Our lawful bases for collecting or using personal information to receive donations or funding and organise fundraising activities are:

Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
- We need to collect personal information to run a particular fundraising event so we will know who will be attending. We need to collect personal information to receive and process donations made to the charity and for gift aid purposes.

Our lawful bases for collecting or using personal information for service updates or marketing purposes are:

Consent – we have permission from you after we give you all the relevant information. All your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

Our lawful bases for collecting or using personal information for dealing with queries, complaints or claims are:

Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
- When dealing with queries for the charity it is important to gather personal information so that we can provide the appropriate support for that individual

Where we get personal information from

Directly from you via activity booking forms, social media queries, parent support referral forms and general support queries
Family members or carers
Other health and care providers
Social Services
Charities or voluntary sector organisations
Schools, colleges, universities or other education organisations
Ticketsource

How long we keep information

Type of Data	How Long We Keep It	Reason for Retention
Identity Information including name, title, date of birth and gender	6 years after you last accessed our services	To comply with legal obligations and allow for potential claims or audits under limitation laws.
Contact information, including address, email address, telephone number	6 years after you last accessed our services	For continuity of service, safeguarding, and to meet legal and regulatory requirements.
Family Support Notes	6 years after last contact	To ensure safeguarding and continuity of care, and to comply with best practice in case of future support or legal queries.
Gift Aid payments	Retained for 6 years after payment	Required by HMRC for audit and tax purposes under Gift Aid regulations.
Payment information – activities and events	We do not store this data ourselves. Please refer to Ticket Source’s Privacy Policy for details of their retention practices. Customer Data Privacy Policy	Data is managed by a third-party provider; retention governed by their privacy policy.
Financial payment information for charity purchases – e.g. venue hire or external contractors	Retained for 6 years after event	Required for financial auditing and compliance with charity accounting standards.
Charity Accounting Records	6 years from the end of the financial year in which they were made	Required by the Charity Commission and HMRC for financial transparency and audit purposes.
Reported safeguarding incidents	Until CYP reaches 25	In line with safeguarding best practice and statutory guidance to retain records until the child or young person reaches adulthood plus 7 years.
Accident Books	3 years after the date of the last entry. If the accident involves a CYP it will be kept until they reach 25	Required under health and safety regulations; extended retention for CYP aligns with safeguarding and legal limitation periods.

Who we share information with

Data processors

Ticketsource

This data processor does the following activities for us: They process our booking and payment information for activities that we run.

JustGiving

This data processor does the following activities for us: They process any donations to our charity and provide Gift Aid Tax Relief.

IT Helpdesk

This data processor does the following activities for us: They manage our IT systems

Others we share personal information with

Suppliers and service providers

Activity Course Facilitator/Teacher

We share your information with our activity facilitators/teachers, so they can run the activity that CYP have booked on to.

If any of your personal data is shared with a third party, as described above, we will take steps to ensure that your personal data is handled safely, securely, and in accordance with your rights, our obligations, and the third party’s obligations under the law.

How to complain

If you have any concerns about our use of your personal data, you can make a complaint to us using the contact details at the top of this privacy notice.

If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.

The ICO’s address:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113

Website: https://www.ico.org.uk/make-a-complaint

Last updated

9^th September 2025

This policy will be reviewed annually or when there is a change in circumstances, in work practices or the introduction of new legislation.

This Policy has been approved and authorised by:

Name:	Maria Denton
Position:	Chair of Trustees
Date:	9^th September 2025
Signature:
Review Date:	April 2026