Privacy Policy

Tamil Special Children UK, a charitable incorporated organisation (CIO) and registered charity (CIO) 1191001, is committed to protecting your privacy. This policy explains how we collect, use, store and protect your personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.

1. Who we are

Tamil Special Children UK is the data controller for the personal data described in this policy. You can contact us about anything in this policy at:

• Email: contact@tamilspecialchildren.org.uk
• Registered address: 50 Gloucester Road, London, E17 6AE, United Kingdom

Our data protection leads are Florina Kalaimaran and Viroshan Piranavanathan.

2. What this policy covers

This policy covers personal data collected through:

• Our main website (tamilspecialchildren.org.uk), including the contact form
• Our event bookings website (tickets.tamilspecialchildren.org.uk), including event booking forms, activity interest forms, and ticket payments
• Volunteer applications (by email)
• Messages we send to families and volunteers by email and WhatsApp
• Photography and filming at our events

3. What data we collect

Contact form (main website): your name, phone number, reason for contacting us and your message, and your IP address, which we use only to prevent spam.

Sponsor enquiry form (main website): your name, your phone number or email address (or both), your business or organisation if you give it, what you are interested in and your message, and your IP address, which we use only to prevent spam. Your enquiry is emailed to our charity inbox and our sponsorship team, and saved in a Google Sheet they use to follow up. We use these details only to reply about sponsorship.

Event bookings (tickets site): the booking parent or guardian's name, phone number and email address; the number and type of tickets and meals; whether you are a TSC family and the names of your TSC children (see section 5); any additional needs you choose to share (see section 5); whether you chose to cover the card fee; a record of the consent you gave and when; a booking reference; and, on the day of an event, a record of whether you checked in.

Activity interest forms (such as the summer activities form): your name, phone number, how many children you would bring, and your preferred activities, days and the weeks you are away.

Workshop bookings (such as the ceramic painting session): the parent or carer's name and phone number, and each child's name and age.

WhatsApp: we use WhatsApp to message families and volunteers, for example about events, bookings and activities. If you give us your phone number (the contact form asks for it so we can reply on WhatsApp), we may message you there. We then see your WhatsApp name and number, your profile picture if you have one, and the messages you send us.

Ticket, merchandise and donation payments: payments for paid events, merchandise orders and donations are processed by Stripe. Your card details are entered directly on Stripe's secure payment page and never reach our systems. Stripe holds your name, email address and mobile number against the payment so we can match it to your booking. Stripe also sees the names of the ticket types you buy, such as a TSC child ticket, because they appear on the payment. Other sensitive details, such as additional needs, children's names and your answer to whether you are a TSC family, are encrypted before they reach Stripe and only we can read them. We receive confirmation of your payment, the amount, and the booking or order it relates to.

Donations: when you book a place or place an order, we may offer you the option of adding a voluntary donation. It is never pre-selected, and declining does not affect your booking. If you choose to give, we record the amount against your booking so that we can account for it correctly, and the payment itself is handled by Stripe. You can also donate through JustGiving or by bank transfer, as set out on our donate page.

Merchandise orders: your name, contact details, the items ordered, how you would like to collect them, and any notes or accessibility requests you choose to share.

Volunteering: if you apply to volunteer by email, the information you send us (typically your name, contact details and availability).

Photos and videos: we take photographs and video at our events for our newsletters, website galleries and social media. See section 6.

We collect this information directly from you. We do not buy data or collect it from other sources.

4. Children's data

We are a charity supporting families of children with special educational needs and disabilities, so much of the data we hold is information about children, provided to us by their parents or guardians when booking events or registering interest in activities.

• We only collect information about children from a parent or guardian, never directly from children. Our forms are intended for use by adults.
• We collect only what we need to run the event safely: names, ages for some activities, and any dietary or medical needs the parent chooses to share.
• Parents and guardians can ask us at any time to see, correct or delete the information we hold about their child (see section 12).

If you believe a child has submitted personal data through our websites, please contact us immediately so we can delete it.

5. Additional needs, dietary and allergy information

Our booking forms include an optional box for any additional needs or requirements, such as access needs, and some events ask for dietary or allergy information. Anything you share there can reveal information about health or disability, which is treated as special category data under the UK GDPR. We collect it only so that we can look after you and cater safely at the event, and only with your explicit consent, which we ask for on the booking form. It is seen only by the organising team, is never used for any other purpose, and is deleted within one month after the event (see section 9).

If you book a TSC child ticket or tell us you are a TSC family, we record that with your booking. Because it can indicate that a child has special educational needs or a disability, we treat it as special category data too: it is used only to run the event and support your family, and is deleted with the rest of your booking details.

Wristbands on the day: at some events we give each booking a coloured wristband at the door. A TSC family booking that includes a TSC child ticket gets its own colour, so that our volunteers can recognise TSC families and offer support during the event. Because other people at the event may see it, the colour of a wristband can show that a guest is part of a TSC family. Nothing else about you or your child is shown on the wristband. If you have any concerns about this, please contact us before the event.

Contact form: if you choose “Join as a TSC family with SEND child/children” as your reason for contacting us, or tell us about a child's needs in your message, you are sharing information about health or disability. We use it only to reply to you and to welcome your family into TSC. Our legal basis for this is your explicit consent (Article 9(2)(a) of the UK GDPR), which we ask for with a tick box when you choose that reason. You can withdraw it at any time by emailing us. We do not share it outside TSC without your consent.

When you send the contact form, our web server uses your IP address only for spam protection, to limit how many messages can be sent from the same address. It keeps a scrambled (hashed) form of your IP address for one hour for this, then deletes it. Your IP address is not included in the message we receive.

Parents and guardians remain fully responsible for the supervision of their children at all times during our events, unless explicitly stated otherwise.

6. Photography and filming

We take photos and video at our events to share our work in newsletters, on our website and on social media. Every booking form includes a notice explaining this, along with contact details to use if you would prefer that you or your child does not appear; please tell us before the event day where possible. If an image of you or your child appears in our materials and you would like it removed, contact us and we will take it down from the channels we control as quickly as we can.

7. How we use your data and our legal bases

• Respond to your enquiry or message (legitimate interests: running the charity; for health or disability information in an enquiry about joining, your explicit consent, see section 5)
• Message families and volunteers about our events, bookings and activities, including on WhatsApp (legitimate interests: keeping our community informed and running our activities)
• Take and manage your event booking, send booking confirmations, ticket QR codes and event reminders (contract: taking the steps you have asked us to take)
• Manage event capacity, check-in and safety on the day (legitimate interests: running safe, well organised events)
• Look after additional needs, dietary needs and allergies, and record TSC family status (explicit consent)
• Process ticket, merchandise and donation payments and keep financial records (contract, and legal obligation under accounting rules)
• Record and account for donations and report on them correctly (legal obligation under charity and accounting rules)
• Plan future activities based on interest forms (legitimate interests)
• Book your family onto a workshop, such as ceramic painting (contract: taking the steps you have asked us to take)
• Send you news about our activities (consent: you can withdraw at any time)
• Publish event photos and video (legitimate interests: showing our work and its impact, with clear notice at booking and the option to opt out at any time)

We do not use your data for automated decision-making or profiling, and we never sell, trade or rent your personal data to anyone.

8. Where your data is stored and who helps us process it

Different parts of our website are run with the help of trusted service providers (processors) who store or handle data on our behalf under written data protection agreements:

• Kualo (UK): hosts our main website and runs our email system. Contact form messages and booking emails are sent through our own charity email.
• Vercel (USA): hosts our bookings website.
• Google Sheets (USA): stores booking and interest form records, in a Google Workspace account managed for us by Vshan Software Solutions Ltd, our IT services provider, under a data processing agreement.
• Notion (USA): stores volunteer records.
• Stripe (USA): processes card payments for paid events, merchandise orders and donations.

Contact form submissions on the main website are processed on our UK hosting and delivered to our team through our own email system; they are not stored in a website database.

We use WhatsApp, provided by WhatsApp Ireland and its parent company Meta Platforms (USA), to message families and volunteers. Messages are end-to-end encrypted, and WhatsApp handles your phone number and account details under its own terms and privacy policy.

Donations made through JustGiving are collected by JustGiving under their own privacy policy. Donations made through our own booking and shop pages are processed by Stripe, as above. If you choose to add your ticket to Apple Wallet or Google Wallet, your name, the event and your ticket reference are sent to Apple or Google to create the pass, under their own privacy policies; we never send needs, children's names or contact details to them.

9. How long we keep your data

We keep personal data only as long as we need it, then delete it:

• Contact form and sponsor enquiries: up to 2 years
• Free event registrations (names, contact details, children's names): up to 6 months after the event, then deleted or reduced to anonymous attendance numbers
• Paid ticket bookings: your answer to whether you are a TSC family and children's names are deleted 6 months after the event; your name, contact details, what you bought (the ticket types, such as a TSC child ticket) and what you paid are kept for 6 years as part of our financial records
• Additional needs, dietary and allergy information: deleted within 1 month after the event
• Activity interest forms, such as the summer activities form: up to 12 months after you send it, then deleted
• Workshop bookings, such as ceramic painting (including children's names and ages): up to 6 months after the session, then deleted
• WhatsApp messages: kept only while we need them for the purpose they were sent; we do not keep exported copies of chats
• Contact form spam check: the scrambled form of your IP address is deleted after one hour
• Volunteer records: while you volunteer with us, plus up to 2 years
• Payment, donation and financial records: 6 years, as required by UK accounting rules (who paid, what for and how much; never needs or children's names)
• Published photos and videos: until you ask us to remove them

10. International transfers

Some of our service providers (Vercel, Notion, Google, Stripe and Meta, which owns WhatsApp) are US companies, so data they hold for us may be stored or processed outside the UK. These transfers are protected by safeguards approved under UK law: the UK Extension to the EU-US Data Privacy Framework where the provider is certified, and otherwise the UK's International Data Transfer Agreement or Addendum incorporated into each provider's data protection terms.

11. Cookies

Main website: we use only essential cookies and similar storage needed for the site to work, such as remembering your cookie choice. We do not use analytics, advertising or tracking cookies. If that ever changes we will update this policy and ask for your consent first.

Our video previews show a thumbnail image loaded from YouTube (i.ytimg.com), so your browser sends your IP address to Google when the page loads. The video itself only loads, from youtube-nocookie.com, when you press play, and YouTube may then store information on your device under YouTube's own privacy policy.

Bookings website: the only cookie set is an essential login cookie used by our volunteer check-in team on event days. Visitors booking tickets are not tracked. If you pay for a ticket, payment happens on Stripe's own page, which uses Stripe's cookies for secure payment processing.

Unfinished bookings: while you fill in an event booking form, our bookings site saves what you have typed in your browser's local storage on your device, so you do not have to type it again after a cancelled payment. This includes your contact details, ticket choices and any needs or children's names you have entered, but not your consent ticks. It is not sent to us. It is deleted as soon as your booking is confirmed. If you do not finish the booking, it is only brought back within 24 hours, and it is deleted the next time you open that booking page after 24 hours. On a shared device you can remove it at any time by clearing this site's data in your browser.

12. Your rights

Under the UK GDPR you have the right to:

• Access the personal data we hold about you or your child
• Correct inaccurate data
• Delete your data (right to erasure)
• Receive your data in a portable format
• Object to processing based on legitimate interests
• Restrict how we use your data
• Withdraw consent at any time, where consent is our basis for processing

To exercise any of these rights, email contact@tamilspecialchildren.org.uk. We will respond within one month.

13. Security

We protect your data with appropriate technical and organisational measures, including encrypted connections (HTTPS) across our websites, access limited to the small number of trustees and volunteers who need it, and password protection with two-factor authentication on the accounts where records are stored.

14. Data breaches

If a personal data breach poses a risk to your rights and freedoms, we will report it to the Information Commissioner's Office (ICO) within 72 hours of becoming aware of it, and where the risk to you is high we will also tell you directly without undue delay.

15. Complaints

If you are unhappy with how we have used your personal data, you can make a complaint to us by emailing contact@tamilspecialchildren.org.uk or writing to us at the address in section 1. Please tell us what happened and what you would like us to do.

• We will acknowledge your complaint within 30 days.
• We will look into it without undue delay and keep you updated.
• We will tell you the outcome of your complaint and what we have done about it.

You can also complain to the Information Commissioner's Office (ICO), the UK's data protection authority, at any time. The ICO will usually expect you to have raised your complaint with us first.

16. Changes to this policy

We may update this policy from time to time. Changes will be posted on this page with an updated date.

Last updated: September 2026