Skip to main content
Tamil Special Children UK

Tamil Special Children

Privacy Policy

How we collect, use and protect your personal data.

Tamil Special Children UK (registered charity no. 1191001) is committed to protecting your privacy. This policy explains how we collect, use, store and protect your personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

Tamil Special Children UK is the data controller for the personal data described in this policy. You can contact us about anything in this policy at:

Our data protection leads are Florina Kalaimaran and Viroshan Piranavanathan.

2. What this policy covers

This policy covers personal data collected through:

  • Our main website (tamilspecialchildren.org.uk), including the contact form
  • Our event bookings website (tickets.tamilspecialchildren.org.uk), including event booking forms, activity interest forms, and ticket payments
  • Volunteer applications (via our Google Form)
  • Messages we send to families by email
  • Photography and filming at our events

3. What data we collect

Contact form (main website): your name, phone number, reason for contacting us, and your message.

Event bookings (tickets site): the booking parent or guardian's name, phone number and email address; the number of people attending; the names and ages of children attending; dietary requirements and allergies (see section 5); a booking reference; and, on the day of an event, a record of whether you checked in.

Activity interest forms: your name, phone number, how many children you would bring, and your preferred activities, days and weeks.

Ticket payments: payments for paid events are processed by Stripe. Your card details are entered directly on Stripe's secure payment page and never reach our systems. We receive confirmation of your payment, the amount, and the booking it relates to.

Volunteering: if you apply to volunteer through our Google Form, the information you enter there (typically your name, contact details and availability).

Photos and videos: we take photographs and video at our events for our newsletters, website galleries and social media. See section 6.

We collect this information directly from you. We do not buy data or collect it from other sources.

4. Children's data

We are a charity supporting families of children with special educational needs and disabilities, so much of the data we hold is information about children, provided to us by their parents or guardians when booking events or registering interest in activities.

  • We only collect information about children from a parent or guardian, never directly from children. Our forms are intended for use by adults.
  • We collect only what we need to run the event safely: names, ages, and any dietary or medical needs the parent chooses to share.
  • Parents and guardians can ask us at any time to see, correct or delete the information we hold about their child (see section 12).

If you believe a child has submitted personal data through our websites, please contact us immediately so we can delete it.

5. Dietary and allergy information

Allergy and dietary information can reveal information about health, which is treated as special category data under the UK GDPR. We collect it only so that we can cater safely at our events, and only with your explicit consent, which we ask for on the booking form. It is seen only by the organising team, is never used for any other purpose, and is deleted shortly after the event (see section 9).

Parents and guardians remain fully responsible for the supervision of their children at all times during our events, unless explicitly stated otherwise.

6. Photography and filming

We take photos and video at our events to share our work in newsletters, on our website and on social media. Every booking form includes a notice explaining this, along with contact details to use if you would prefer that you or your child does not appear; please tell us before the event day where possible. If an image of you or your child appears in our materials and you would like it removed, contact us and we will take it down from the channels we control as quickly as we can.

7. How we use your data and our legal bases

  • Respond to your enquiry or message (legitimate interests: running the charity)
  • Take and manage your event booking, send booking confirmations, ticket QR codes and event reminders (contract: taking the steps you have asked us to take)
  • Manage event capacity, check-in and safety on the day (legitimate interests: running safe, well organised events)
  • Cater safely for allergies and dietary needs (explicit consent)
  • Process ticket payments and keep financial records (contract, and legal obligation under accounting rules)
  • Plan future activities based on interest forms (legitimate interests)
  • Send you news about our activities (consent: you can withdraw at any time)
  • Publish event photos and video (legitimate interests: showing our work and its impact, with clear notice at booking and the option to opt out at any time)

We do not use your data for automated decision-making or profiling, and we never sell, trade or rent your personal data to anyone.

8. Where your data is stored and who helps us process it

Different parts of our website are run with the help of trusted service providers (processors) who store or handle data on our behalf under written data protection agreements:

  • Kualo (UK): hosts our main website and runs our email system. Contact form messages and booking emails are sent through our own charity email.
  • Vercel (USA): hosts our bookings website.
  • Google Sheets (USA): stores booking and interest form records, in a Google Workspace account managed for us by Vshan Software Solutions Ltd, our IT services provider, under a data processing agreement.
  • Notion (USA): stores volunteer records.
  • Stripe (USA): processes card payments for paid events.

Contact form submissions on the main website are processed on our UK hosting and delivered to our team through our own email system; they are not stored in a website database.

Donations made through JustGiving are collected by JustGiving under their own privacy policy.

9. How long we keep your data

We keep personal data only as long as we need it, then delete it:

  • Contact form enquiries: up to 2 years
  • Event booking details (names, contact details, children's names and ages): up to 6 months after the event, then deleted or reduced to anonymous attendance numbers
  • Dietary and allergy information: deleted within 1 month after the event
  • Activity interest forms: up to 12 months, then deleted
  • Volunteer records: while you volunteer with us, plus up to 2 years
  • Payment and financial records: 6 years, as required by UK accounting rules (transaction records only, not full booking details)
  • Published photos and videos: until you ask us to remove them

10. International transfers

Some of our service providers (Vercel, Notion, Google and Stripe) are US companies, so data they hold for us may be stored or processed outside the UK. These transfers are protected by safeguards approved under UK law: the UK Extension to the EU-US Data Privacy Framework where the provider is certified, and otherwise the UK's International Data Transfer Agreement or Addendum incorporated into each provider's data protection terms.

11. Cookies

Main website: we use only essential cookies and similar storage needed for the site to work, such as remembering your cookie choice. We do not use analytics, advertising or tracking cookies. If that ever changes we will update this policy and ask for your consent first.

Bookings website: the only cookie set is an essential login cookie used by our volunteer check-in team on event days. Visitors booking tickets are not tracked. If you pay for a ticket, payment happens on Stripe's own page, which uses Stripe's cookies for secure payment processing.

12. Your rights

Under the UK GDPR you have the right to:

  • Access the personal data we hold about you or your child
  • Correct inaccurate data
  • Delete your data (right to erasure)
  • Receive your data in a portable format
  • Object to processing based on legitimate interests
  • Restrict how we use your data
  • Withdraw consent at any time, where consent is our basis for processing

To exercise any of these rights, email contact@tamilspecialchildren.org.uk. We will respond within one month.

13. Security

We protect your data with appropriate technical and organisational measures, including encrypted connections (HTTPS) across our websites, access limited to the small number of trustees and volunteers who need it, and password protection with two-factor authentication on the accounts where records are stored.

14. Data breaches

If a personal data breach poses a risk to your rights and freedoms, we will report it to the Information Commissioner's Office (ICO) within 72 hours of becoming aware of it, and where the risk to you is high we will also tell you directly without undue delay.

15. Complaints

If you are unhappy with how we handle your data, please contact us first and we will do our best to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection authority.

16. Changes to this policy

We may update this policy from time to time. Changes will be posted on this page with an updated date.

Last updated: July 2026