At Iris Support CIC, we’re committed to protecting and respecting your privacy. This notice explains how we collect, use, and protect your personal information when you interact with us online (via our website) or offline (e.g., paper forms, phone calls, or in-person meetings).
Our website uses the Hu-manity.co cookie consent banner to manage cookie consent in compliance with UK GDPR and PECR (Privacy and Electronic Communications Regulations). By using our services or providing us with your information, you agree to the practices described in this policy. If you have any questions, please contact our Data Protection Lead at info@irisfamilysupport.org
Who We Are
Iris Support CIC is a Community Interest Company (ICO: ZC152763) registered in England and Wales, Company Number: 15721204. We conduct research both independently and in collaboration with other providers and researchers.
Our registered address is:
4 The Park, Cheltenham, Gloucestershire, GL50 2SG
Our Data Protection Lead is responsible for overseeing compliance with UK GDPR and the Data Protection Act 2018.
Information We May Collect From You
We collect and process the following types of information:
- Information You Give Us Directly
This includes information you provide when you:
- Fill in forms on our website (e.g., contact forms, survey responses).
- Correspond with us by phone, email, or post.
- Attend in-person meetings, workshops, or events and provide information (e.g., paper forms or verbal details).
The information you give us may include:
- Personal Data: Name, address, email, phone number, and other contact details.
- Special Category Data: Health information (e.g., details about your child’s condition), racial or ethnic origin (if relevant to our support), or other sensitive data you choose to share.
- Financial Data: Payment details (e.g. bank information for donations or service fees).
- Safeguarding Data: Records of concerns or disclosures (e.g., for child protection purposes).
- Information We Collect About You Automatically
When you visit our website, we may automatically collect:
- Technical Information: IP address, browser type and version, time zone setting, browser plug-in types and versions, operating system, and platform.
- Usage Information: Information about your visits, including the pages you view, the length of your visit, and how you navigate our site.
- Cookies: Small data files stored on your device to improve your experience. See our Cookies section for more details.
How We Use Your Information
We use the information we collect for the following purposes. For each purpose, we’ve identified the legal basis under UK GDPR that allows us to process your data:
Purpose | Legal Basis (Article 6) | Special Category Basis (Article 9, if applicable) | More Information |
Responding to Enquiries | Legitimate Interest (6(1)(f)) | N/A | We process your contact details to reply to your questions or requests. You can object to this processing. |
Improving Our Services | Legitimate Interest (6(1)(f)) | Substantial Public Interest (9(2)(g)) | We analyse feedback and survey responses to identify gaps in support for families. |
Non- Legal Advocacy and Research | Legitimate Interest (6(1)(f)) | Substantial Public Interest (9(2)(g)) | We use anonymised data to advocate for better policies and services for families. |
Safeguarding | Legal Obligation (6(1)(c)) | Vital Interests (9(2)(c)) or Public Interest (9(2)(g)) | We process data to comply with legal duties (e.g., Children Act 1989). |
Processing Payments | Contract (6(1)(b)) | N/A | We process financial data to handle donations or service fees. |
Sending Newsletters | Consent (6(1)(a)) | Explicit Consent (9(2)(a)) (if health data included) | We only send marketing communications if you’ve opted in. You can withdraw consent at any time. |
Cookies
Our website uses cookies to ensure it functions securely and efficiently. Cookies are small text files stored on your device when you visit our site. We use the Hu-manity.co cookie consent banner to manage cookie consent in compliance with UK GDPR and PECR (Privacy and Electronic Communications Regulations).
Cookies in Use on Our Website
Currently, our website sets the following cookie:
Cookie Name | Purpose | Provider | Legal Basis | Type | Duration |
_stripe_mid | Used by Stripe (our payment processor) to prevent fraud and ensure secure transactions. | Stripe | Legitimate Interest (UK GDPR Article 6(1)(f)) | Functional/Essential | 1 year |
Note: This cookie is essential for secure payment processing and is set only when you interact with the payment-related features of our site (e.g., donations). It does not track your activity across other websites.
Managing Your Cookie Preferences
- When you first visit our site, the Hu-manity.co banner will appear, allowing you to:
- Accept the use of this cookie to varying degrees
- Block the cookie (though this may impact payment functionality).
- You can change your preferences at any time by:
- Clicking the “Cookie Settings” or “Manage Preferences” link in the Hu-manity.co banner (usually located at the bottom of the page).
- Or, clearing your browser cookies and revisiting our site to trigger the banner again.
Browser Controls
In addition to the Hu-manity.co banner, you can block or delete cookies through your browser settings:
- Chrome: Manage cookies in Chrome
- Firefox: Manage cookies in Firefox
- Safari: Manage cookies in Safari
- Edge: Manage cookies in Edge
Important: Blocking the _stripe_mid cookie may prevent you from completing payments on our site.
Third-Party Cookies
Our website does not currently use third-party cookies for analytics, marketing, or tracking. If we embed content from third-party services (e.g., YouTube, social media) in the future, we will update this notice and ensure cookies are only set with your explicit consent via the Hu-manity.co banner.
Cookie Retention
- The _stripe_mid cookie is retained for 1 year from the date it is set.
Cookie Audit Note
This list was last updated on 15 May 2026 based on an audit of our website using Cookie-Edit. We regularly review our cookie use and will update this notice if any changes occur.
For more information about Stripe’s use of cookies, see their Privacy Policy.
Who We Share Your Information With
We do not sell your personal information. However, we may share your data with the following trusted third parties to provide our services or comply with legal obligations:
| Recipient | Purpose | Legal Basis | Safeguards |
|---|---|---|---|
| Local Authorities | Sharing anonymised or aggregated data to inform local policy and advocacy on inclusion and accessibility. | Public Interest / Legal Obligation | Data Sharing Agreements; pseudonymisation where possible. |
| Research Partners | Collaborative research projects and policy studies with universities, charities, or think tanks. | Substantial Public Interest (Article 9(2)(g)) | Anonymised data; ethics approval and data minimisation. |
| Service Providers | IT support (e.g., website hosting), data storage, and communication tools. | Legitimate Interest / Contract | GDPR-compliant contracts; data processed within the UK/EU. |
| Regulators | ICO or other bodies if legally required. | Legal Obligation | Only when mandated by law. |
| Advocacy Networks / Policy Bodies | Sharing anonymised insights to influence policy and improve systems for disabled people and carers. | Public Interest | Aggregated or anonymised data only; no personal identifiers. |
We require all third parties to respect the security of your data and to treat it in accordance with the law. We only allow them to process your personal data for specified purposes and in accordance with our instructions.
Where We Store Your Personal Data
- Data Security: We implement appropriate technical and organisational measures to protect your data, including:
- Encryption of digital data (e.g., SSL for our website, password-protected files).
- Secure Storage for physical records (e.g., locked cabinets).
- Access Controls to ensure only authorised staff can access your information.
- Data Location: Your data is primarily stored and processed in the UK. If we use US-based providers (e.g., Stripe), we rely on Standard Contractual Clauses (SCCs) or the UK-US Data Bridge to ensure your data is protected.
How Long We Keep Your Information
We retain your personal information for no longer than necessary for the purposes for which it was collected. Here’s how long we typically keep different types of data:
| Data Type | Retention Period | Reason |
|---|---|---|
| Enquiry/Contact Data | 2 years | Retained under legitimate interest to follow up on enquiries, monitor engagement, and manage feedback. |
| Survey / Research Data | 2 years (or until project ends) | Retained for research and policy purposes under GDPR (public interest / legitimate interest). |
| Financial Records | 7 years | Legal obligation under HMRC requirements for tax and accounting records. |
| Employment Records | 6 years after employment ends | Limitation Act 1980 (contractual claims may be brought up to 6 years after employment ends). |
| Volunteer / Contributor Records | 3 years after last involvement | Legitimate interest to maintain project continuity and accountability. |
| Advocacy / Policy Correspondence | 3 years | Retained under legitimate interest for continuity of lobbying and policy engagement. |
| Research Ethics Documentation | 5 years after project completion | Required under research governance and ethics standards. |
Once the retention period expires, we will securely delete or anonymise your data.
Your Rights
Under UK GDPR, you have the following rights in relation to your personal data:
- Right to Access: You can request a copy of the personal data we hold about you (known as a Subject Access Request).
- Right to Rectification: You can ask us to correct any inaccurate or incomplete information we hold about you.
- Right to Erasure: You can ask us to delete your personal data in certain circumstances (e.g. if it’s no longer necessary for the purpose it was collected).
- Right to Restrict Processing: You can ask us to pause how we use your data in certain situations.
- Right to Object: You can object to our processing of your data where we rely on legitimate interest or public interest as the legal basis. We will comply with your request unless we have compelling legitimate grounds to continue processing.
- Right to Data Portability: You can request that we transfer your data to another organisation or directly to you in a machine-readable format.
- Right to Withdraw Consent: If we rely on your consent to process your data, you can withdraw it at any time. This will not affect the lawfulness of processing based on consent before its withdrawal.
To exercise any of these rights, please contact our Data Protection Lead at info@irisfamilysupport.org. We will respond to your request within one calendar month. In some cases, we may need to extend this period by up to two further months for complex requests, and we will notify you if this is the case.
Children’s Data
We may process data about children only when it is relevant to our research or advocacy work (for example, in studies relating to EHCP support or safeguarding policy). Such data is processed only with parental or guardian consent, or under a legal obligation (such as the Children Act 1989). Our website is not directed at children under 13, and we do not knowingly collect personal data from children without verifiable parental consent.
Changes to This Privacy Policy
We may update this policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any significant changes by posting a prominent notice on our website or by sending you an email (if you have provided your contact details).
Contact Us
If you have any questions about this policy or how we handle your data, please contact us:
Data Protection Lead
Iris Support CIC
4 The Park, Cheltenham, Gloucestershire, GL50 2SG
Complaints
If you are unhappy with how we process your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):
Information Commissioner’s Office
- Website: ico.org.uk
- Phone: 0303 123 1113
- Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF