Updated October 2025
This is the Privacy Policy for AIIChild , a company limited by guarantee and registered in England and Wales under number 08991196 with registered charity number 1160947 whose registered office is at 1 EdCity, 1 Edcity Walk, London W12 7TF.
AIIChild is the Data Controller for your information and this Privacy Policy sets out the basis on which any personal data we collect from or about you or that you provide to us will be processed by us.
We have a Data Protection Officer (DPO) who is responsible for overseeing our data protection practices and can be contacted at the following email address: dpo@allchild.org. If you have any questions or queries about this Policy you can contact us at dpo@allchild.org or call 0207 998 4044.
At AIIChild, we have a number of data principles:
All Child collects data in the following formats:
The data we will collect and use about AIIChild cohort children and/or their families mainly includes the following information:
We also record the contents of conversations we hold with children and young people that we work with.
We also collect data on children in the schools where we work who are not on our Cohorts in order to support our Cohort identification, to use for benchmarking purposes, and for monitoring equality of opportunities. This data is pseudonymised, such that we never have access to names or addresses.
This data mainly includes:
AIIChild also collects information about children, young people and their families' engagement with services offered by Brent Council. This is collected in order to better understand the a) histories of children we work with and b) the long-term impact we have, e.g. preventing re-engagement with council services. This processing is carried out in line with the specification which is for a targeted ear1y intervention service in schools for individual children who exhibit risk factors indicating poor outcomes later in life by linking children and young people to a range of support services. Data may not be available at the individual child level.
This data includes:
Please note that the information collected is not always at a child level basis.
AIIChild also collects information on individuals and organisations that may enter into a funding relationship with us, or perform contract or consultancy work with or for us. Information collected on these individuals and organisations may include:
AIIChild also collects information about Delivery Partners' facilitators delivering activities with
children. This data mainly includes:
AIIChild also collects information about employees and job applicants ("Job applicant data") at the recruitment stage and during the course of the application process. Job applicant data is collected through online applications submitted via the Talas platform, or through third party recruitment agencies. This data mainly includes:
Please note that the information collected in the equality and diversity monitoring section does not form part of the assessment of applications.
AIIChild collects, stores and uses data listed above in multiple manners. We receive personal information indirectly from the following sources:
We receive personal information directly from you. For example:
The majority of our data collection and processing relates to the delivery of support for children and young people in our partner schools.
We work in partnership with others (including the organisations we list below in the section on data sharing) to identify and understand proxy indicators of educational success of children and young people, and we then provide services to those identified as in need of support (the AIIChild cohort).
We collect and process this information for a number of reasons:
We collect personal information for some other purposes as well. These include:
AIIChild will always share data in a secure manner, ensuring that it is kept safe and only those authorised to view it may do so. We have in place data sharing agreements to ensure that data is dealt with properly by those who receive it.
As part of our work with children and families, we need to share information on our AIIChild cohort of children with other organisations who work with us to provide opportunities to our cohort
These include:
Data is also shared with the relevant Borough Councils to demonstrate successful outcomes: we do this to enable us to receive funding for our work.
There may be some occasions where we have to tell other organisations information about our cohort. We do this if there is any risk toa child's safety or welfare, or if we are legally required to provide the information. Where possible we tell cohort families and get their consent, but we may not always be able to do that.
In the case of facilitators', we may share their data with the school for safer recruitment and safeguarding reasons.
In the case of Job applicant data, we may share this data internally for recruitment purposes and from time to time with external third parties that provide services to us in terms of recruitment and vetting requirements (e.g. DBS checks) once we have made an offer for employment.
In the case of employees, we may share employee personal data with trusted third parties, such as payroll providers, pension schemes, occupational health services, and regulatory bodies, where necessary for the performance of the employment contract, compliance with legal obligations, or our legitimate interests as an employer.
We need to have a lawful basis to use the information we collect for the ways in which we want to use it. These are the bases we rely upon.
The processing and sharing of the children's personal data relies on the basis of the performance of a task carried out in the public interest (art. 6(1)(e) of the UK GDPR) and in some circumstances on the basis of legitimate interest (Article 6(1)(f) of the UK GDPR) or for compliance with a legal obligation (Article 6(1)(c) of the UK GDPR).
The processing and sharing of the children's Special Categories of Personal Data rely on a joint basis of the performance of a task carried out in the public interest (art. 6(1)(e) of the UK GDPR) and reasons of substantial public interest (art. 9(2)(g) of the UK GDPR) such as for the provision of confidential counselling, advice or support or of another similar service provided confidentially (para 17 of Part 2 of Schedule 1 of the DPA18) and/or for safeguarding of children and of individuals at risk (para 18 of Part 2 of Schedule 1 of the DPA18).
Instead, the sharing of the personal data, including special categories of personal data, between the AIIChild and Delivery Partners rely on consent (art. 6(1)(a) and art. 9(2)(a) of the UK GDPR) given by the parents or legal guardians of the children. In specific circumstances and when possible, we request parents/legal guardians to authorise the processing of their children's personal data, including - if necessary- special categories of personal data (such as at special events/visits) by signing a specific consent form (art. 6(1)(a) and art. 9(2)(a) of the UK GDPR).
When we are doing our benchmarking work, we process the Personal Data on the basis of the legitimate interests condition - i.e. it is necessary for us to be able to demonstrate the impact of our work; we believe this is not outweighed by the privacy rights and expectations of the pupils or their parents/guardians (especially as we take steps to pseudonymise and/or anonymise the data when possible). Moreover, processing the Special Categories of Personal Data on the basis of the Research condition (para 4 of Part 1 of Schedule 1 of the DPA18, Article 9(2)0) of the UK GDPR) implementing measures to pseudonymise and/or anonymise the data.
AIIChild processes information received from Brent Council on a joint basis of the performance of a task carried out in the public interest (art. 6(1)(e) of the UK GDPR) and reasons of substantial public interest (art. 9(2)(g) of the UK GDPR) such as for the provision of confidential counselling, advice or support or of another similar service provided confidentially (para 17 of Part 2 of Schedule 1 of the DPA18) and/or for safeguarding of children and of individuals at risk (para 18 of Part 2 of Schedule 1 of the DPA18).
Information on individuals who may enter into funding or professional relationships with AIIChild is processed on the basis of performance of a contract (art. 6(1)(b) of the UK GDPR) (e.g. where you sign up to receive communications from AIIChild) or legitimate interest (i.e. it is necessary for AIIChild to process the information in order to raise funds to run the organisation, orto make effective decisions about entering into professional arrangements with individuals).
Information on individuals who deliver activities with children is processed on the basis of performance of a contract (art. 6(1)(b) UK GDPR, under art. 6(1)(c) UK GDPR when processing is necessary for compliance with a legal obligation; and/or art. 6(1 )(f) UK GDPR when processing is necessary for the purposes of legitimate interests. Under art. 10 UK GDPR when processing of personal data relating to criminal convictions and offences, the additional condition under the Data Protection Act2018 is: Schedule 1, Part 1, Parag. 1 (processing is necessary for the purposes of employment and social security and social protection law); and/or Schedule 1, Part 2, Parag. 18 (safeguarding of children and individuals at risk).
AIIChild processes information relating to employees job applicants for the following purposes:
When you sign up for our newsletter, we collect the following personal information:
We use the information we collect to:
The lawful basis we rely on for processing your personal data is your consent under article 6(1)(a) of the UK GDPR. We do not sell, rent, or trade your personal information. However, we may share your information with trusted third-party service providers, such as Mailchimp. We use Mailchimp to send our newsletters and manage our subscriber list. By signing up for our newsletter, you acknowledge that your data will be transferred to Mailchimp, which may store your information outside of the UK, including in the United States. We ensure that appropriate safeguards are in place to protect your data when it is transferred.
In particular, Mailchimp is compliant with UK GDPR and has provided us with a Data Processing Agreement (DPA), ensuring that your data is handled in accordance with data protection laws. We will retain your personal data for as long as necessary to fulfil the purposes outlined in this Privacy Policy or as required by law. If you no longer wish to receive our newsletter, you can unsubscribe at any time by clicking the "unsubscribe" link in any of our emails or by contacting us
directly.
This section outlines the additional information relevant to the use of personal data for publicising the work of AIIChild. We may - as part of our work - take photographs, videos or other media of those with experience of our services for publicising the work of AIIChild in:
Consent is the legal basis for this additional information collecting, processing and sharing (art. 6(1)(a) of the UK GDPR). Media relating to a child or another data subject will not be used or stored for any longer than 3 years and 5 years regarding internal purposes, unless the parent and/or child and/or data subject ask us to stop using it before then.
AIIChild will retain your data only as required or permitted under data protection law and while it has a legitimate purpose for doing so. Moreover, data will be kept in compliance with our data retention policy for the further protection of data subjects and in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.
In particular, Job applicant data is retained for purposes of any future opportunities and the data collected before and during the recruitment process (e.g. interview notes, etc) will be retained by AIIChild for up to a period of 6 months.
AIIChild adheres at all times to data protection legislation (currently the Data Protection Act 2018 and UK GDPR), which provides the following rights for individuals:
This policy outlines our approach to ensuring these rights are met and maintained. If you have any concerns or questions relating to your rights regarding personal data, please contact our DPO.
Withdrawing consent
Where we need your consent in order to process your personal data, you have the right to withdraw consent at any time.
To withdraw consent, please email dpo@allchild.org or call 0207 998 4044.
You have the right to access the data we hold on you at any time.
You do not have to pay to make an access request.
Requesting access to your data will not affect your relationship or your child's relationship with
AIIChild, your child's school, or any delivery partners.
We work with children from age 3 to age 18. Although very young children would not be considered 'competent' to exercise rights in relation to their date, some of the older children we work with can be considered 'competent' to exercise their rights, including to submit a Subject Access Request. Where this is the case:
AIIChild typically considers children to be competent to exercise this right from the age of 13. To make a data access or rectification request, please email dpo@allchild.org or call 0207 998 4044.
To prevent unauthorised access or disclosure, to maintain data accuracy, and to ensure the appropriate use of the information, AIIChild will take all reasonable and appropriate procedures to safeguard the information we collect and process. In particular, when transferring confidential or sensitive/ special category information we will protect it appropriately. These measures include encryption, password protection and secure storage.
AIIChild uses certain suppliers in the general running of its business and to assist it in providing its services. A supplier is a third party service provider (a Data Processor) engaged by AIIChild, who has or potentially will have access to or process personal data. AIIChild engages different types of suppliers to perform various functions as explained in the table below.
AIIChild requires its suppliers to enter into agreements that satisfy the requirements of Article 28 UK GDPR, including but not limited to obligations to:
The following is an up-to-date list (as at the date at the top of this policy) of the names of AIIChild's key suppliers and the purposes for which they process personal data, as well as which clients these are potentially applicable to.
This Privacy Policy applies to all of the information dealt with by AIIChild as a data controller. This Privacy Policy does not provide information on the data management of other organisations, including those that we share data with. For more information on how any of the other organisations mentioned in this policy deal with personal data please read their privacy policies which should be accessible through their websites.
If you have any concerns or a complaint regarding our collection and use of your data or a possible breach of your privacy, please email dpo@allchild.org. We will aim to ensure that your complaint is resolved in a timely and appropriate manner. If you remain unhappy you have the right to complain to the Information Commissioner. You can find out more information about this at: www.ico.org.uk.
Should we elect to change our Privacy Policy, we will post the changes here. If we consider the changes are significant, we will contact you directly.
