Privacy Policy

About this policy

SwimTayka takes the privacy and security of personal information seriously.

This Privacy Policy explains what personal information we collect, why we collect it, how we use it, who we may share it with, how long we keep it and the rights you have over your information.

It applies to people who interact with SwimTayka, including:

• children and young people participating in our programmes;
• parents and guardians;
• volunteers and volunteer applicants;
• donors and supporters;
• fundraisers and event participants;
• trustees, contractors and other people working with us;
• partner organisations and their representatives;
• grant applicants and organisations seeking support from SwimTayka;
• people who subscribe to our newsletters or other communications; and
• visitors to our website and social media channels.

We aim to handle personal information fairly, lawfully, securely and in a way that respects the people whose information we hold.

Who we are

SwimTayka is a Charitable Incorporated Organisation registered in England and Wales.

For the purposes of UK data protection law, SwimTayka will normally be the data controller for the personal information described in this policy. This means we are responsible for deciding how and why that information is used.

Our charitable purpose

SwimTayka works to prevent drowning by providing and supporting swimming lessons, water safety education and drowning prevention programmes for children.

We work with communities, schools, charities, non-governmental organisations and other local partners in the UK and overseas.

Our work also includes training and supporting local swimming instructors, working with international volunteers, raising awareness of drowning prevention and raising funds to support our charitable activities.

The personal information we collect

The information we collect depends on how you interact with SwimTayka. We will only collect information that is reasonably necessary for the purpose for which it is being used.

Supporters, donors and fundraisers

We may collect your name, postal address, email address, telephone number, donation and fundraising history, Gift Aid information, communication preferences, fundraising event information, correspondence with us, information about your relationship with SwimTayka and payment information required to process a transaction.

Payment card information may be processed directly by our payment providers rather than being stored by SwimTayka.

Volunteers and volunteer applicants

We may collect your name and contact details, date of birth where required, address and country of residence, emergency contacts, application information, employment and volunteering history, references, qualifications, safeguarding training records, criminal record or background-check information where appropriate, passport and travel information where required, travel and medical insurance information, programme preferences, fundraising information, relevant health or accessibility information, photographs and videos where appropriate permission has been obtained, feedback, programme reports and correspondence.

We only ask for health information where it is relevant to a person's safety, participation in an activity or the support we need to provide.

Children and programme participants

Depending on the programme and the role of SwimTayka and its local partner, we may collect a child's name, age or date of birth, parent or guardian information, attendance, swimming ability and progression, water safety skills, relevant health or accessibility information, emergency information, safeguarding or incident information, programme assessments and feedback, and photographs, videos or stories where the appropriate permission has been obtained.

We aim to collect as little information about children as is reasonably necessary.

Partner organisations, suppliers and professional contacts

We may collect names, organisation details, job titles or roles, business contact details, correspondence, meeting records, contractual information and information needed to manage our relationship.

Grant applicants

Where organisations apply to SwimTayka for funding or programme support, we may collect information about the organisation and personal information relating to its representatives, including names, roles, contact details, information provided within applications, supporting documentation, and records relating to our assessment and decision-making.

Website users

When you use our website, we may collect technical information including IP address, device and browser information, pages visited, website interactions, referral information and information collected through cookies and similar technologies. Further information is provided in our Cookie Policy.

How we collect your information

We may receive information directly from you when you make a donation, contact us, register for an event, subscribe to communications, apply to volunteer, take part in one of our programmes, fundraise for us, apply for a grant or programme support, complete a form, survey or questionnaire, communicate with us through email, telephone, messaging services or social media, or provide information to us in another way.

We may also receive information from parents or guardians, local programme partners, schools or community organisations, referees, background-check providers, professional advisers, payment providers, fundraising platforms, event organisers, public registers such as Companies House or the Charity Commission, and other organisations where there is a lawful reason for them to provide the information to us.

Where information is provided to us by a third-party fundraising platform, that platform will also have its own privacy terms.

Our lawful reasons for using personal information

UK data protection law requires us to have a lawful basis for using personal information. The basis we use will depend on the circumstances.

Consent

We may rely on your consent where you have made a clear and informed choice for us to use your information for a particular purpose. This may include some marketing communications, photographs or videos, testimonials or personal stories, and optional information. Where we rely on consent, you can withdraw it at any time.

Contract

We may use personal information where it is necessary to enter into or fulfil an agreement with you, including administering volunteer placements, events, purchases, services or other arrangements you have asked us to provide.

Legal obligation

We may process information where we need to comply with a legal or regulatory responsibility, including financial records, Gift Aid, accounting, safeguarding, tax, insurance, regulatory requirements and responding to lawful requests from public authorities.

Legitimate interests

We may process information where it is reasonably necessary for SwimTayka's legitimate interests or those of another person, provided those interests are not outweighed by your rights and interests. These interests may include running and improving the charity, administering programmes, communicating with supporters, raising funds, managing relationships, keeping appropriate records, preventing fraud, protecting our systems, ensuring programme safety, understanding the effectiveness of our fundraising and communications, and protecting SwimTayka and the people we work with.

Vital interests

In an emergency, we may use relevant information where it is necessary to protect someone's life or physical safety. This may be particularly relevant during overseas volunteering activities or swimming programmes.

Special category information

Some information receives additional protection under data protection law. This includes information about health, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, genetic or biometric information used for identification, sex life and sexual orientation.

SwimTayka will only collect or use special category information where it is genuinely required. In our work this is most likely to involve health or accessibility information required to help keep a child, volunteer or programme participant safe.

Where we use special category information, we will identify both a lawful basis for processing the information and an additional legal condition allowing us to use that type of information.

Criminal offence and background-check information

Because SwimTayka works with children, safeguarding is central to our work.

We may require volunteers, staff, trustees or others working closely with children to undertake DBS checks or equivalent criminal background checks in their home country.

Information relating to criminal convictions, allegations and offences is subject to additional legal protections. We only process this information where there is an appropriate lawful basis and condition under UK data protection law.

Access is restricted to people who genuinely need the information for safeguarding or recruitment purposes. Where appropriate, SwimTayka maintains additional safeguards and documentation for this type of information.

Children's personal information

Children are at the heart of SwimTayka's work and their privacy is particularly important to us.

We aim to:

• collect only the information we genuinely need;
• explain the use of information clearly and, where appropriate, in language a child can understand;
• respect children's views and wishes;
• use appropriate parent or guardian involvement where required;
• restrict access to children's information;
• avoid unnecessary identification of children in public communications;
• keep safeguarding information particularly secure; and
• consider the best interests of the child when making decisions about their information.

Where consent is the appropriate lawful basis, we will consider whether the child is able to understand and provide that consent themselves or whether consent should be obtained from a parent or guardian. The position may depend on the child's age, maturity, circumstances and the country in which a programme takes place.

We may provide shorter, child-friendly privacy information alongside this policy where appropriate.

Photographs, videos and children's stories

Photography and video can help SwimTayka explain our work and demonstrate the impact of our programmes, but this must be balanced against the privacy, dignity and safety of the people involved.

We will seek appropriate permission before using identifiable photographs, video, audio or personal stories where consent is our lawful basis.

For children, we will follow our safeguarding and media procedures and obtain appropriate permissions, which may include parent or guardian permission. We will also take account of the child's wishes.

We will not knowingly publish material that is degrading, exploitative or likely to place a child at risk.

Permission for promotional photography or video is separate from a person's ability to receive SwimTayka's charitable services wherever reasonably possible.

Where we rely on consent, consent can be withdrawn for future use by contacting us. We may not always be able to remove material that has already been lawfully published in printed materials or legitimately reproduced by third parties.

Donations and Gift Aid

When you make a donation, we use the information you provide to process and record the donation, provide a receipt or acknowledgement, maintain financial records, administer Gift Aid where applicable, meet accounting and regulatory requirements, prevent fraud, and understand and manage our relationship with you.

Where you make a Gift Aid declaration, we are required to retain relevant records so that we can support claims made to HM Revenue & Customs.

Fundraising and marketing communications

We may contact supporters about our charitable work, programme updates, fundraising appeals, events, volunteering, ways to support SwimTayka, news and newsletters, and other activities that further SwimTayka's charitable purposes.

We will only send direct marketing where the law allows us to do so.

Email, text messages and direct messages

Depending on the circumstances, we may rely on your consent or the charitable purposes soft opt-in.

Post

We may send fundraising or supporter communications by post where we have your consent or where we have assessed that our legitimate interests allow us to do so. You can ask us to stop at any time.

Telephone

Where we undertake fundraising or marketing by telephone, we will comply with applicable rules and preference services and respect any previous request not to be contacted.

Your right to stop marketing

You can ask us to stop sending direct marketing at any time. Every marketing email will provide a simple way to unsubscribe. You can also contact privacy@swimtayka.org.

We may retain limited information on a suppression list after you opt out. This is necessary to make sure we honour your request and do not add you back to marketing lists by mistake.

Stopping marketing communications does not prevent us from contacting you where necessary for non-marketing reasons, for example about a donation, volunteer placement, safeguarding matter or transaction.

Fundraising platforms and third parties

You may choose to support SwimTayka through an independent fundraising platform, event organiser or other third party. These organisations operate under their own privacy policies.

Where they provide information to SwimTayka, we will only use it for purposes that are lawful and consistent with the circumstances in which it was collected.

Receiving your information from a fundraising platform does not automatically give SwimTayka permission to send you electronic marketing.

Fundraising research and supporter analysis

We may analyse information about our supporters and fundraising activity to understand how people support SwimTayka, which fundraising activities are effective, how we can improve supporter communications and how we can use the charity's resources effectively.

This may include analysing previous donations, fundraising participation and interactions with SwimTayka.

For some prospective or existing major supporters, we may use limited information that is lawfully available from public sources, such as Companies House, professional websites or published news sources.

We will only do this where it is necessary and proportionate and where we have identified an appropriate lawful basis.

We do not intentionally use special category information, such as someone's political opinions, religion or health, to create fundraising profiles.

We do not sell personal information and we do not buy lists of individuals for electronic fundraising marketing.

Social media

If you interact with SwimTayka through social media, the relevant social media provider will also process information about you under its own privacy terms.

Depending on your settings and how you interact with us, we may receive information such as your name, username, comments, messages or other information you choose to share.

If we use social media advertising, audience matching or similar services involving personal information, we will only do so where we have established an appropriate lawful basis and complied with the relevant marketing and privacy rules.

Where tracking technologies are used for targeted advertising, we will obtain consent where required.

Cookies and website technologies

Our website may use cookies and similar technologies to make the website work, remember preferences, understand how the website is being used, improve website performance, protect the website and users, and measure or support communications and campaigns.

Some technologies can operate without consent where a legal exception applies. Where consent is legally required, such as for certain advertising or tracking technologies, we will ask for it before those technologies are used.

You can find further information about the technologies used on the SwimTayka website and how to manage your preferences in our Cookie Policy.

Who we share information with

We do not sell personal information.

Where necessary, we may share information with:

• SwimTayka trustees, staff and authorised volunteers;
• programme partners;
• schools and community organisations;
• safeguarding professionals and authorities;
• insurers;
• accountants, auditors and professional advisers;
• IT, website and cloud service providers;
• email and communications providers;
• payment providers;
• fundraising platforms;
• event organisers;
• travel providers where necessary for a volunteer placement;
• background-check providers;
• regulators;
• HM Revenue & Customs;
• law enforcement agencies; and
• other public authorities where required or permitted by law.

We only share information where there is a legitimate reason to do so.

Where another organisation processes personal information on our behalf, we require appropriate contractual and security arrangements. Programme partners may sometimes act as independent data controllers for information they collect and use for their own purposes. Where this applies, they are responsible for providing appropriate privacy information about their use of that information.

Safeguarding and information sharing

There may be circumstances where protecting a child or another person requires us to share personal information without consent.

We may share relevant information with safeguarding leads, local partner organisations, children's services, police or other law enforcement bodies, medical professionals, schools, regulators, or other organisations responsible for protecting a person from harm.

International programmes and international transfers

SwimTayka works internationally. This means that personal information may sometimes need to be shared with organisations or service providers outside the United Kingdom.

Where UK data protection rules on international transfers apply, we will use an appropriate legal mechanism.

Depending on the country and circumstances, this may include UK adequacy regulations, an approved contractual safeguard such as the UK's International Data Transfer Agreement or an approved UK Addendum, another legally recognised safeguard, or a permitted exception where appropriate.

We will consider the privacy and security risks before making restricted international transfers and apply additional safeguards where necessary. We will not transfer more information than is reasonably required for the relevant purpose.

How long we keep personal information

We do not keep personal information indefinitely simply because we may find it useful in the future. Retention periods depend on the type of information, why it was collected and any legal, regulatory, insurance, safeguarding or contractual requirements.

Donation and financial records

Normally retained for at least six years after the relevant accounting period, or longer where required for an outstanding enquiry, legal matter or other statutory requirement.

Gift Aid records

Retained in accordance with HM Revenue & Customs requirements. Enduring declarations may be retained while donations continue and for the required period following the final relevant donation.

Marketing preferences and suppression information

Retained for as long as reasonably necessary to respect your communication choices and demonstrate compliance.

Volunteer applications and placements

Retained for as long as needed to administer the application or placement and meet relevant safeguarding, insurance, legal and operational requirements. Key records may need to be retained after a volunteer's relationship with SwimTayka has ended.

Safeguarding information

Retention is determined by the nature of the concern, safeguarding requirements and applicable legal guidance. Some safeguarding records may need to be retained for considerably longer than ordinary administrative records.

Children's programme information

Retained only for as long as reasonably necessary for programme administration, safeguarding, monitoring, reporting and other legitimate purposes. Where possible, information used for long-term impact reporting will be anonymised or aggregated.

Photographs and media

Retained for as long as they remain relevant to the purpose for which they were collected, subject to the lawful basis on which they are used and any withdrawal of consent where consent applies.

Grant applications and partnership records

Retained for an appropriate period according to the outcome of the application, the duration of any funded relationship, financial requirements and accountability obligations.

We review retained information and delete, anonymise or securely dispose of information when it is no longer required.

How we keep information secure

We use appropriate technical and organisational measures to protect personal information. These may include access controls, password protection and multi-factor authentication where appropriate, encryption, secure online forms and systems, controlled access to safeguarding information, staff and volunteer guidance, secure backups, appropriate contracts with service providers, security reviews and procedures for responding to suspected personal data breaches.

Access to personal information is limited to people who need it for their role.

No system can provide absolute security, but we take reasonable steps to protect the information entrusted to us.

Personal data breaches

If we become aware of a personal data breach, we will investigate it and take reasonable steps to limit any harm.

Where the law requires us to do so, we will report the breach to the Information Commissioner's Office and inform affected individuals.

Your data protection rights

Depending on the circumstances and the lawful basis being used, you may have the right to:

• be informed about how we use your information;
• ask for access to your personal information;
• ask us to correct inaccurate or incomplete information;
• ask us to delete personal information;
• ask us to restrict the way information is used;
• object to particular uses of your information;
• receive certain information in a portable format;
• withdraw consent where we rely on consent; and
• raise a concern about the way we use your information.

Some rights are subject to legal exceptions and do not apply in every situation.

Your right to object to direct marketing

You have the right to object to the use of your personal information for direct marketing. If you ask us to stop direct marketing, we will do so.

Accessing your information

You can ask for a copy of personal information SwimTayka holds about you. This is commonly known as a Subject Access Request.

You will not normally be charged for making a request. We will respond without undue delay and normally within one month, subject to the circumstances and applicable law.

We may ask for reasonable information to confirm your identity before providing personal information.

Changing your information or communication preferences

We want the information we hold to be accurate. Please contact us if your details have changed, you believe information we hold about you is incorrect, you would like to change how we communicate with you, you want to withdraw consent, or you want to exercise a data protection right.

Complaints and privacy concerns

If you have a question or concern about the way SwimTayka uses personal information, please contact us first so that we can look into it.

You also have the right to raise a complaint with the Information Commissioner's Office (ICO), the UK's independent data protection regulator. Details of how to contact the ICO are available on the ICO website.

Links to other websites

Our website may contain links to websites operated by other organisations. SwimTayka is not responsible for the privacy practices of those organisations.

We recommend reading the privacy information provided by any third-party website or service before providing personal information to it.

Changes to this policy

We may update this Privacy Policy where our activities change, the law or regulatory guidance changes, we introduce new systems or services, or we identify ways to make our privacy information clearer.

The latest version will be published on the SwimTayka website and the date of the latest update will appear at the top of the policy.

Where a change is particularly significant, we may take additional reasonable steps to bring it to the attention of the people affected.