Addiction Family Support Privacy Notice
June 2026 | Review date: June 2027
1. Who We Are
Addiction Family Support is a registered charity (number 1123316) providing support to people affected or bereaved by a loved one’s addiction. We are the data controller responsible for your personal data.
Contact details for data protection queries: |
Email: [email protected] |
Post: Addiction Family Support, 86–90 Paul Street, London, EC2A 4NE |
Nominated Data Protection Contact: Operations Manager |
Addiction Family Support does not meet the threshold requiring a formal Data Protection Officer under Article 37 UK GDPR. Our nominated contact is the Operations Manager who can be reached at the email address above.
If you are unhappy with how we handle your data, you have the right to complain to us directly at [email protected], and if you remain dissatisfied, to the Information Commissioner’s Office (ICO): Website: www.ico.org.uk | Helpline: 0303 123 1113. See Section 14 for our full complaints procedure.
2. About This Notice
This notice explains how Addiction Family Support collects and uses personal data about the different groups of people we work with. Please read the section that applies to you:
Who you are | Jump to section |
Helpline caller or email support client | Section 3 |
Registered client | Section 4 |
Donor | Section 5 |
Newsletter subscriber | Section 6 |
Volunteer | Section 7 |
Website visitor | Section 8 |
Some sections may overlap, for example if you are both a client and a donor. In that case, both sections apply to you.
A note about sensitive information |
Because of the nature of our work, the information you share with us often relates to a loved one’s addiction or your own wellbeing. Under UK data protection law, this is classified as ‘special category data’ and receives extra protection. Where we process this type of data, we explain the specific legal basis in the relevant section below. |
Section 3: Helpline Callers and Email Enquirers
Who this section applies to
Anyone who contacts Addiction Family Support via our helpline (0300 888 3853) or our email support service, including people who make a single contact and do not go on to register for further support.
What data we collect
- Call recordings (helpline calls are recorded – you will be informed of this at the start of your call)
- Call notes made by our volunteers during or after a call
- Any information you share about your situation, including details about a loved one’s addiction
- Email address and any information included in your email (email support)
- Name or pseudonym, if provided
We do not require you to give your real name. You may use a pseudonym if you prefer.
Why we collect it and our legal basis
Purpose | Legal basis |
Providing support during your call or via email | Legitimate Interests (Article 6(1)(f)) – you have contacted us specifically for support and have a reasonable expectation that we will use your information to provide it |
Call recording for quality monitoring and volunteer training | Legitimate Interests (Article 6(1)(f)) |
Maintaining a record to ensure continuity if you contact us again | Legitimate Interests (Article 6(1)(f)) |
Safeguarding – where a disclosure raises a concern about risk of harm | Legal Obligation and Vital Interests (Article 6(1)(c) and (d)) |
Special category data |
Where you share information about addiction, health, or family circumstances, this is special category data. We process this under the Substantial Public Interest condition, specifically Schedule 1, paragraph 18 of the Data Protection Act 2018, which applies to the provision of confidential counselling and support services. We maintain a Policy Document as required by that provision. |
How long we keep your data
- Call notes and support records: 3 years from your last contact
- Call recordings: 1 year
- Safeguarding records: 25 years (legal requirement
Who we share your data with
Your information is held confidentially by Addiction Family Support. We will only share it in the following circumstances:
- Internally, between staff and volunteers involved in your support
- With safeguarding partners (e.g. police, social services) where we have a legal obligation or where there is a risk to life
We will not share your information with any third party for commercial purposes.
Your right to request deletion
Because we rely on Legitimate Interests rather than consent, you have the right to object to our processing and to request deletion of your data. We will consider all such requests carefully. In some cases we may need to retain a minimal record, for example where there is a safeguarding concern. We will always tell you what we have retained and why.
Section 4: Registered Clients
Who this section applies to
People who have registered with Addiction Family Support to receive one-to-one support, couples support, or group support.
What data we collect
- Full name and contact details (address, email, phone number)
- Date of birth or age range
- Postcode or nearest town
- Equality, Diversity and Inclusion (EDI) information (e.g. ethnicity, disability) – optional
- Case notes and records of your support sessions
- Details of your situation, including information about a loved one’s addiction
- Referral information, where you have been referred by another organisation
Why we collect it and our legal basis
Purpose | Legal basis |
Providing and managing your support | Legitimate Interests (Article 6(1)(f)) – you have registered specifically to receive support |
Maintaining case notes for continuity of care | Legitimate Interests (Article 6(1)(f)) |
EDI monitoring to improve our services and meet funder requirements | Legitimate Interests (Article 6(1)(f)) – EDI data is always anonymised in reporting |
Safeguarding | Legal Obligation and Vital Interests (Article 6(1)(c) and (d)) |
Marketing and newsletter (only if you have opted in) | Consent (Article 6(1)(a)) |
Special category data |
Support records: Substantial Public Interest – Schedule 1, para 18 DPA 2018 (confidential support services). |
EDI data: Substantial Public Interest – Schedule 1, para 8 DPA 2018 (equality of opportunity monitoring). EDI data is never used in a way that identifies you individually. |
How long we keep your data
- Support records and case notes: 7 years from your last contact
- EDI data: 3 years (anonymised in all reporting)
- Safeguarding records: 25 years
Acknowledgement of our Privacy Notice
When you register, you will be asked to confirm that you have read this Privacy Notice. This is not a consent mechanism; it is a transparency measure. Our legal basis for processing your support data is Legitimate Interests, not consent. This means you do not need to ‘agree’ to us processing your data to receive support, but we want to ensure you are fully informed.
Your right to request deletion
You have the right to object to our processing and request deletion of your data. We will always consider such requests. However, in some cases we may need to retain a record, for example, where there is a safeguarding concern, or where we have a legal obligation to retain information. We will explain our reasons clearly and in writing.
Section 5: Donors
Who this section applies to
Anyone who donates to Addiction Family Support, whether online (via our website), by bank transfer, or in another way.
What data we collect
- Name and contact details
- Donation amount and date
- Gift Aid declaration (where provided)
- Payment information (processed securely by our payment provider – we do not store card details)
Why we collect it and our legal basis
Purpose | Legal basis |
Processing your donation and maintaining a record of it | Legitimate Interests (Article 6(1)(f)) |
Gift Aid administration and reporting to HMRC | Legal Obligation (Article 6(1)(c)) |
Thanking you for your donation and keeping you informed about our work (where you have opted in) | Consent (Article 6(1)(a)) |
Financial record-keeping and audit | Legal Obligation (Article 6(1)(c)) |
Third party processors
Donations made online are processed through GiveWP (provided by Liquid Web LLC, USA). GiveWP acts as a data processor on our behalf. Data transfers to the USA are carried out in accordance with applicable UK data transfer mechanisms.
How long we keep your data
- Donation records and Gift Aid declarations: 7 years (HMRC requirement)
- Marketing preferences: until you opt out
Section 6: Newsletter Subscribers
Who this section applies to
Anyone who has signed up to receive our newsletter or other marketing communications, whether via our website or by another means.
What data we collect
- First name
- Email address
Why we collect it and our legal basis
Purpose | Legal basis |
Sending you our newsletter and updates about Addiction Family Support | Consent (Article 6(1)(a)) for new subscribers; Legitimate Interests (Article 6(1)(f)) via soft opt-in for existing clients and donors who have not opted out |
Soft opt-in applies only where you are an existing client or donor who has previously engaged with Addiction Family Support and have been given a clear opportunity to opt out of marketing, which you have not taken. It does not apply to people who have had no prior relationship with Addiction Family Support.
How we send newsletters
We use Brevo (formerly Sendinblue) to manage and send our newsletters. Brevo is based in France and is subject to EU data protection law, which the UK recognises as providing adequate protection. Your email address and name are stored within Brevo’s platform for the purpose of sending you communications.
How long we keep your data
We will hold your details on our mailing list until you unsubscribe. Every newsletter includes an unsubscribe link. You can also request removal by emailing [email protected].
Section 7: Volunteers
Who this section applies to
All Addiction Family Support volunteers, including helpline volunteers, group facilitators, and any other volunteer roles.
What data we collect
- Name and contact details
- Application and recruitment information
- DBS (Disclosure and Barring Service) check records
- Training records and completion dates
- Emergency contact details
- EDI information (optional)
Why we collect it and our legal basis
Purpose | Legal basis |
Recruiting, onboarding and managing volunteers | Contract (Article 6(1)(b)) – necessary for your volunteer agreement with Addiction Family Support |
DBS checks – required for working with vulnerable adults | Legal Obligation (Article 6(1)(c)) |
Training records | Legitimate Interests (Article 6(1)(f)) and Legal Obligation (Article 6(1)(c)) |
EDI monitoring | Legitimate Interests (Article 6(1)(f)) – always anonymised in reporting |
Special category data |
DBS records are special category data under UK GDPR and are additionally regulated under the Rehabilitation of Offenders Act 1974. We process this data under the Employment Law condition – Schedule 1, paragraph 1 of the DPA 2018. |
Who we share your data with
- The Disclosure and Barring Service (for DBS checks)
- Internal staff involved in volunteer management
How long we keep your data
- Volunteer records: 6 years from the end of your volunteering
- DBS records: as required by law
Section 8: Website Visitors
Who this section applies to
Anyone visiting www.addictionfamilysupport.org.uk.
Cookies
Our website uses cookies. A cookie is a small file placed on your device when you visit a website. We use the following types of cookies:
Type | Purpose |
Functional (essential) | Necessary for the website to work correctly, including caching and security. These cannot be switched off. |
Statistical | Help us understand how visitors use our site. We use anonymised data only. |
Marketing / third-party | May be set by embedded social media content (Facebook, Instagram, LinkedIn, X). We do not control these cookies. |
You can manage cookie preferences through your browser settings. Please note that disabling cookies may affect the functionality of our website.
Contact forms
If you contact us via a form on our website, the information you submit is passed directly into our CRM system (Bitrix24). This is covered by the relevant section above (Section 3 for support enquiries, Section 5 for donation-related enquiries, Section 6 for newsletter sign-ups).
Server logs
Our web hosting provider may log technical information including IP addresses for security and performance purposes.
10. Your Rights
Under UK GDPR you have the following rights in relation to your personal data. We aim to respond to all requests within one month.
Right | What it means |
Access | You can ask for a copy of the personal data we hold about you (a Subject Access Request). |
Correction | You can ask us to correct inaccurate or incomplete data. |
Erasure | You can ask us to delete your data in certain circumstances. See individual sections above for how we handle this. |
Objection | You can object to us processing your data where we rely on Legitimate Interests. We will consider your objection and explain our decision. |
Restriction | You can ask us to restrict processing in certain circumstances, for example while we consider an objection. |
Portability | Where we process your data by automated means on the basis of consent or contract, you can ask for a copy in a machine-readable format. |
Withdraw consent | Where we rely on consent, you can withdraw it at any time. This will not affect the lawfulness of processing before the withdrawal. |
To exercise any of these rights, please contact us at [email protected]. There is no charge for exercising your rights in most circumstances.
11. How We Keep Your Data Secure
We take the security of your personal data seriously. Our measures include:
- Secure, access-controlled cloud-based systems (Bitrix24 CRM)
- Role-based access controls – staff and volunteers only access data relevant to their role
- Secure email systems
- Regular staff and volunteer training on data protection
- A data breach procedure – we will notify you and the ICO where we are legally required to do so
12. Our Data Processors
We use the following third-party services to process data on our behalf. All processors are required to handle data only in accordance with our instructions.
Processor | Purpose and location |
Bitrix24 | CRM system – stores client, volunteer and donor records. EU-based hosting available; we use the cloud version. A Data Processing Agreement is in place. |
Brevo | Email newsletter platform. Based in France (EU). Covered by UK adequacy decision for the EU. |
GiveWP / Liquid Web | Online donation processing. Based in the USA. |
Activepieces | Automation platform linking our systems. Cloud servers based in Germany (EU). Covered by UK adequacy decision for the EU. |
WPForms | Website contact forms. Data passed directly to Bitrix24. |
13. Changes to This Notice
We may update this Privacy Notice from time to time. We encourage you to review this notice periodically.
This notice was last updated in July 2026.
14. Complaints
If you are unhappy with how we have handled your personal data, you have the right to complain to us directly, and we encourage you to do so in the first instance so that we have the opportunity to put things right.
How to complain
- By email to [email protected]
- By speaking to any member of staff, who will pass your complaint on promptly
What happens next
We will acknowledge your complaint within 30 days of receiving it. We will then look into it, making any enquiries we need to and keeping you updated if this takes longer than expected. Once we have completed our investigation, we will write to you with the outcome and our reasoning.
If you remain dissatisfied with our response, you have the right to complain to the ICO at www.ico.org.uk or by calling 0303 123 1113.