Privacy Notice

Introduction

Dravet Syndrome UK (also referred to as “us” or “we”) are committed to protecting and
respecting your privacy. This notice sets out how we treat any personal data that we collect
from or about you. We aim to be clear when we collect your data and not do anything you
wouldn’t reasonably expect.

If you have any questions about how we use your information, or want to exercise your rights
over your information, you can contact us in writing, by phone or email (see Contact Us
below).

Who we are and how to contact us

Data Controller: For the purpose of UK data protection law, the data controller is Dravet
Syndrome UK.

Registered Charity: 1128289

Address: Dravet Syndrome UK, PO Box 756, Chesterfield, S43 9EB

Telephone: 01246 912 421

Email: [email protected]

ICO Registration: We are registered with the UK Information Commissioner’s Office (ICO),
the supervisory authority for data protection law in the UK. Our registration number is
ZA229576.

What information do we collect, and why?

When you contact us

If you get in touch with us – by phone, email, post, in person, or via the website – you may
provide us with personal information. For example, if you use our website contact form, we
ask for your name, email address and contact details. We will only use the information you
provide to deal with your enquiry, unless you have opted in to receive further
communications.

We justify this processing on the basis of your consent in contacting us.

To manage our relationship with you

We collect information about families, health and social care professionals. This may include
demographic details, contact details and preferences, information about your family and
professional life, and information about your interactions with us.

Some people choose to share more about their experiences with Dravet Syndrome. This
helps us enormously and provides assistance to other people and families affected. This
may include sensitive personal information related to health and family life. Where we have the explicit and informed consent of individuals, or their parent or guardian if they are under
18, this information may be made public at events, in fundraising or campaigning materials,
or in documents such as our annual report.

We also manage information relating to your online account such as log in information,
passwords and details of files accessed.

We do this based on our legitimate interest in fulfilling the charity’s objectives, including
supporting families and working with health and social care professionals. When we process
personal information on this basis, we balance any potential impact on you and your privacy
rights. We will not use your personal information for activities where our interests are
overridden by the impact on you.

Where we collect sensitive information such as health data, we do so only with your consent,
or the consent of an adult with legal responsibility for you.

To manage and sell products in our shop

For this we collect information such as your payment details (handled securely by a third
party), delivery address, and information relating to purchases, refunds and queries. We
justify this processing based on the performance of a contract and our legitimate interest in
maintaining an efficient retail operation.

To promote our work

We may contact you to let you know about the work we do and the ways in which we are
trying to fulfil our objectives. We may also use information about you to promote our work
through social media, publications such as our annual report, or other channels. We will only
do this with your consent, which you can withdraw at any time.

To run events for families and professionals

When we run events we may collect information about you such as contact details, dietary
preferences, and accessibility requirements. Where we collect sensitive information such as
health data, we do so only with your consent or the consent of an adult with legal
responsibility for you.

To inform you about our services and products
We may contact you to let you know about the services and products we offer, such as grant
opportunities and other support, or products we sell through our online shop. We will only do
this with your consent, which you can withdraw at any time.

To raise funds for the work that we do

We collect information about our donors including demographic information, contact details,
payment details, and information about donations including size and giving habits. We do
this based on our legitimate interest to raise and manage funds for the charity.

You may also give us your information indirectly, for example through fundraising sites such
as JustGiving. This happens only with your consent. You should check the relevant
platform’s privacy policy to understand how they process your data.

If you express an interest in Dravet Syndrome UK and our work, we may also contact you
about our fundraising activities by email or text message. We will do this on the basis of our
legitimate interest (under the so-called ‘soft opt-in’ under the terms of the Data [Use and
Access] Act 2025). We will always offer you a clear and easy way to opt out of receiving
such communications, and we will stop contacting you if you tell us you would prefer not to
hear from us.

If you would prefer not to receive fundraising communications from us, you can also register
with the Fundraising Preference Service at fundraisingpreference.org.uk.

To run and govern the charity

We may process information about you in order to run and govern the charity. This may
include information about behaviour, demographic information, and information relating to
risks and concerns, such as safeguarding matters. We do this in order to fulfil our legal
obligations under UK charity law.

To manage our website

We may collect information about your device, including your IP address, operating system
and browser type. This is collected only in the event of an error on the site and is for
diagnostic purposes only. We do this based on our legitimate interest to run the charity
effectively and efficiently.

When you apply for a job or voluntary position with us

When you apply for a job with us, the personal information you provide may include your
name, address, email address, job and career history, educational background, professional
membership, and other relevant information from your CV. We may also require reference
checks and/or a criminal record check ahead of your working with us. We process this
information on the basis of discussing a possible employment contract and to fulfil our legal
obligations to safeguard vulnerable people from harm.

How long we keep your information

We will not keep your personal information for longer than is necessary for the purpose for
which it was collected. The table below sets out our general retention approach:

When data is no longer required, it is securely deleted or anonymised.

How we protect your information

We only allow access to personal information about you to our staff, volunteers and partners
who require that information to carry out the activities described in this notice. We ensure
that third parties who work with us to make our website available, and to deal with orders
and requests, agree to protect your personal information. All information you provide to us is
stored on our secure servers.

Unfortunately, the transmission of information via the internet cannot be guaranteed to be
completely secure. Although we will do our best to protect your personal data, we cannot
guarantee the security of data transmitted to our site. Once we have received your
information, we will use strict procedures and security features to prevent unauthorised
access.

International data transfers

Dravet Syndrome UK stores its information in the UK on secure servers. Some third-party
services we use, such as website analytics and email marketing, may process data on
servers outside the UK as part of how those services operate. We use providers (WordPress
CMS, Google Analytics, Beacon CRM) who are required by our contract with them, and
applicable law, to handle data in compliance with UK GDPR requirements; this includes
implementing appropriate safeguards in place for international transfers.

Your rights

Under UK data protection law, you have the following rights in relation to your personal data:

1. The right to be informed: to know how and why your personal data is being used, as set
out in this notice.
2. The right of access: to request a copy of the personal data we hold about you (a
‘subject access request’).
3. The right to rectification: to ask us to correct inaccurate or incomplete personal data.
4. The right to erasure: to ask us to delete your personal data in certain circumstances
(also known as ‘the right to be forgotten’).
5. The right to restrict processing: to ask us to limit how we use your data in certain
circumstances.
6. The right to object: to object to our processing of your personal data where we rely on
legitimate interests as the lawful basis.
7. The right to data portability: where applicable, to transfer your personal data to another
organisation, where processing is based on consent or contract and carried out by
automated means.

To exercise any of these rights, please contact us using the details in the ‘Who we are’
section above. We will respond within one month. We do not charge for exercising your
rights, unless a request is manifestly unfounded or excessive.

Making a data protection complaint

Under the Data (Use and Access) Act 2025, you have the right to raise a data protection
complaint directly with Dravet Syndrome UK if you believe we have handled your personal
data in a way that does not comply with UK data protection law. We ask that you contact us
in the first instance so that we can try to resolve your concern directly.

How to raise a data protection complaint with us

You can contact us by any of the following methods:
• Email: [email protected] (please mark your message ‘Data Protection Complaint’)
• Post: Dravet Syndrome UK, PO Box 756, Chesterfield, S43 9EB
• Phone: 01246 912 421

What to include

To help us investigate your complaint promptly, please include your full name and contact
details, a description of your concern, and any relevant dates or communications.

What happens next

We will acknowledge your complaint within three working days of receiving it. We will
investigate your concern and respond to you without undue delay, keeping you informed of
progress. Our response will set out our findings and any action we are taking and will
confirm your right to escalate to the ICO if you remain dissatisfied.

Escalating to the ICO

If you remain dissatisfied after raising your complaint with us, or if we fail to respond within a
reasonable time, you have the right to escalate your complaint to the Information Commissioner’s Office (ICO):

• Information Commissioner’s Office Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9
  5AF
• Website: www.ico.org.uk
• Email: [email protected]
• Telephone: 0303 123 1113

Cookies

Our website uses cookies. For full details of the cookies we use and how to manage your
preferences, please see our Cookies Notice.

Changes to this notice

We may update this Privacy Notice from time to time. When we do, we will update the ‘Last
updated’ date at the bottom of this page. We encourage you to check this page periodically.
Continued use of our website or services following any changes constitutes acceptance of
the updated notice.

Any dispute which may arise over privacy will be subject to this notice and the provisions of
English law.