In Your Corner
Privacy Notice
UK GDPR & Data Protection Framework
Version 1.0 · Effective:
Download the Privacy Notice (PDF)This is an In Your Corner document. It is not issued, approved or endorsed by the Information Commissioner’s Office.
1. Who is responsible for your information?
In Your Corner (IYC) is currently operated by William McAllister as an independent, volunteer-led, unincorporated not-for-profit project. William McAllister is the data controller for personal information processed by IYC at this stage.
Privacy contact: hello@inyourcorner.org.uk — use the subject line “Privacy / data protection”.
2. Our approach
We aim to collect only the information we actually need. Children’s education, SEND, disability, health, neurodevelopmental and safeguarding information can be highly sensitive. Our approach is staged: first we establish whether we can help, then we agree what evidence is needed and how it should be handled.
For an initial enquiry, tell us what happened, the outcome you want, the organisation involved, any deadline, your Kent/Medway area and any communication adjustment you need. Do not send unnecessary medical records, full EHCP bundles, social-care records or safeguarding evidence unless we ask for them and agree the sharing route.
3. What information we may use
- Contact details and communication preferences.
- Basic information needed to assess scope, location, conflict, capacity and urgency.
- Information about the child or young person relevant to the issue, including education, SEND, disability, health or neurodevelopmental information.
- Correspondence, chronologies, professional evidence and case records where a case is accepted.
- Authority and consent records.
- Complaint, safeguarding and information-security records where relevant.
- Case outcome information and anonymised learning where appropriate.
4. Initial enquiries
We use ordinary personal information in an initial enquiry because it is necessary for our legitimate interests in receiving enquiries, deciding whether IYC can assist, responding to the person who contacted us and operating a safe and accountable service. Our Article 6 lawful basis is legitimate interests (Article 6(1)(f) UK GDPR).
If you choose to include health, disability, SEND or other special-category information in an initial enquiry, we will ask for explicit consent to use that information for the limited purpose of understanding the enquiry, checking whether we can help and responding to you. The Article 9 condition is explicit consent (Article 9(2)(a) UK GDPR).
If sensitive information is sent before valid explicit consent has been obtained, we will limit access and use while we decide whether the information is necessary and whether a lawful basis/condition exists. We may ask for consent or delete information that is not needed.
Read and copy the initial-enquiry consent statement.
5. Accepted casework
If IYC accepts a case, we may process relevant personal information because it is necessary for our legitimate interests in providing the advocacy support requested and agreed (Article 6(1)(f)). Where the case involves health, disability, neurodevelopmental or other special-category information, we normally rely on explicit consent under Article 9(2)(a).
Authority for IYC to contact a school, local authority, NHS service or other organisation is recorded separately from data-protection consent. We will only communicate within the agreed scope and will aim to share only information reasonably necessary for that purpose.
Where information relates to a child, IYC will consider the child’s age and understanding, who has parental responsibility or other appropriate authority, and whether the child’s own views or consent should also be sought. Consent is not assumed merely because an adult is related to the child.
6. Complaints about IYC
We use ordinary personal information to receive, investigate and respond to complaints because this is necessary for our legitimate interests in operating an accountable service (Article 6(1)(f)). If a complaint requires an independent review and the review needs special-category information, we will normally seek explicit consent for the reviewer to receive and use relevant information from the IYC case file.
A reviewer may receive the complete relevant case file where this is reasonably necessary for a fair and independent review. Information unrelated to the complaint, or information about other people that is not necessary for the review, should not be shared.
7. Safeguarding and legal requirements
IYC does not promise absolute confidentiality. In exceptional circumstances we may need to use or share information without ordinary consent where this is lawfully necessary to safeguard a child or person at risk, comply with a legal obligation, or establish, exercise or defend legal claims.
For safeguarding of children or individuals at risk, IYC may rely on the relevant UK GDPR and Data Protection Act 2018 provisions only where their legal tests are actually met. Where Article 9(2)(g) and Schedule 1 paragraph 18 are used, IYC maintains an Appropriate Policy Document and records why the processing was necessary and why consent could not reasonably be obtained.
Read the public Safeguarding Statement and local reporting routes.
8. Who may receive information?
- William McAllister and any person specifically appointed by IYC who needs access for an authorised purpose.
- An independent complaint reviewer, where relevant and authorised/otherwise lawfully justified.
- Schools, local authorities, NHS bodies, GPs or other professionals where this is within the agreed advocacy scope and properly authorised.
- Microsoft 365 and other service providers that host, transmit, protect or administer IYC systems.
- Authorities or safeguarding bodies where disclosure is lawfully necessary.
People appointed by IYC are expected to use individual accounts, keep information confidential, follow IYC instructions and access only the information needed for their role.
9. Storage and security
IYC’s approved case-storage standard is a Microsoft 365 business environment. SharePoint is the preferred master case-file store. OneDrive for Business may be used as an interim business storage location where SharePoint is not yet available. Personal cloud-storage accounts and shared passwords are not approved for casework.
- Multi-factor authentication (MFA) on accounts with case access.
- Individual user accounts rather than shared logins.
- Access limited to people who need it.
- Device PIN/biometric protection, automatic locking and device encryption where supported.
- Avoiding unnecessary local downloads and duplicate copies.
- Use of agreed secure transfer routes for sensitive evidence where appropriate.
10. Retention
On a narrow screen, scroll this table sideways. Keyboard users can focus the table area and use the arrow keys.
| Record | Normal retention |
|---|---|
| Enquiries not taken on | 6 months after the enquiry is closed. |
| Accepted casework | 3 years after the case is closed. |
| Complaints about IYC | 3 years after the final complaint response/review is completed. |
| Consent and authority records | Kept with the relevant enquiry/case/complaint record for the same period. |
| Safeguarding records | Reviewed at closure and at least annually if retained; normally no longer than 3 years after case closure unless a continuing safeguarding, legal or accountability reason requires longer retention. |
| Fully anonymised statistics or learning | May be kept longer because the information no longer identifies an individual. |
These are IYC policy periods, not universal statutory deadlines. A record may be kept for longer where there is a documented legal, safeguarding, complaint or dispute reason. If that happens, the reason and next review date should be recorded.
11. Your rights
Depending on the circumstances and lawful basis, you may have rights to access your personal information, correct inaccurate information, ask for erasure or restriction, object to certain processing, or receive information in a portable form where that right applies. Where IYC relies on consent, you may withdraw that consent at any time. Withdrawal does not make earlier lawful processing unlawful, but it may mean IYC cannot continue support that requires the information.
You may also complain to the Information Commissioner’s Office (ICO).
12. Website, email and cookies
The current IYC website does not intentionally set analytics/advertising cookies, use behavioural advertising trackers or provide a public sensitive-document upload form. Site search runs in the browser. IYC uses Microsoft 365 for email and business communications, and the website host may process routine server/security data needed to deliver and protect the site. This notice should be updated before non-essential analytics, tracking, public upload forms or materially different processors are introduced.
13. International processing
Some technology providers may process or support information from locations outside the UK. Where this occurs, IYC will use providers whose contractual arrangements include an applicable UK international-transfer mechanism or other lawful safeguard, and will keep those arrangements under review.
14. Keeping this notice up to date
This notice should be reviewed when IYC changes legal structure, introduces new technology, changes casework processes, appoints new processors, or materially changes how personal information is used.