Confidentiality and GDPR policy

This is the fuller policy behind the privacy notice, setting out how Bringing Families Together Ltd collects, uses, stores and protects personal information while delivering supervised contact, supported contact and transport, in line with UK GDPR, the Data Protection Act 2018 and safeguarding legislation and guidance.

Scope

This policy applies to:

Personal data relating to children, families and professionals
Contact session records and reports
Transport records and handover information
Communication by email, message or referral

Key principles

All personal data is:

Processed lawfully, fairly and transparently
Collected for specific and legitimate purposes
Adequate, relevant and limited to what is necessary
Accurate and kept up to date
Stored securely and only for as long as necessary
Protected against unauthorised access or loss

What is collected

Personal details such as names, addresses and contact information
Child-related information, including date of birth, school and welfare information
Safeguarding information and risk assessments
Contact session notes and reports
Transport and handover records
Information from referring professionals, such as solicitors or social workers

The lawful basis for using it

Personal data is processed under legal obligation, such as safeguarding responsibilities, under legitimate interest, in providing a safe and effective service, and under consent where appropriate, such as in a referral agreement. Special category data, including safeguarding information, is processed under safeguarding and legal necessity provisions.

Confidentiality

Personal information is kept confidential, shared strictly on a need-to-know basis, and used only for the purpose of delivering the service. Confidentiality does not apply where there is a safeguarding concern. In that case, information is shared with the appropriate authorities.

Who information may be shared with

Information may be shared with local authority social workers, courts and legal representatives, Police Scotland, and emergency services. Information is only shared when it is required by law, necessary to protect a child or vulnerable person, or requested by a court or legal authority.

How it is stored and kept secure

Records are stored securely, in password-protected digital files or locked storage
Access is limited to authorised individuals only
Secure devices and systems are used
Records are protected against data breaches, loss or unauthorised access

How long it is kept

Records are kept only for as long as necessary, typically in line with legal and safeguarding guidance, and are securely deleted or destroyed when no longer required.

Your rights

You have the right to access your personal data, request correction of anything inaccurate, request deletion where appropriate, and restrict or object to processing. Requests are responded to within the legal timeframe.

If there is a data breach

Immediate steps are taken to contain a breach, the Information Commissioner's Office is notified where required, and anyone affected is informed if there is a risk to them.

Professional boundaries and communication

Personal data is never shared via unsecured channels
No information is shared via personal social media
Only professional communication methods are used

Safeguarding comes first

Safeguarding responsibilities override confidentiality. Where there is a risk of harm, information will be shared without consent if necessary, always in the best interests of the child or vulnerable person. Full detail on how concerns are handled is set out in the safeguarding policy.

Reviewing this policy

This policy is reviewed annually, and sooner if legislation changes, if a data breach occurs, or if service delivery changes. It was last reviewed in August 2026.

Questions

For a copy of the full policy, or to raise a question about how your information is handled, contact Aimee on 07934 756 311 or at aimee@bringingfamiliestogether.co.uk. Bringing Families Together Ltd, Company No. SC886103.