PRIVACY AND COOKIE NOTICE

Aberdeen Befriending Network Website and Related Enquiries

Author	Network Development Manager
Owner	Aberdeen Befriending Network Management Committee
Rationale	Legal and organisational requirement
Date of Issue	August 2026
Policy Type	New	Full Revision	Section(s)
Date of Reviews	Not applicable – first issue
Date of Next Review	August 2027, or sooner if the law, website or processing changes
Key Outcomes	Visitors and contacts understand how ABN uses their information. Personal information is collected lawfully, used fairly and kept secure. Individual rights, retention and complaint routes are clear. Cookies, analytics and embedded content are managed in line with PECR.
Evaluated	Yes	Timescale	Annually and when processing changes
Key Evaluation Methods	Annual privacy, form and cookie audit Review of supplier arrangements and retention Review of information-rights requests and incidents
Responsible for Evaluation	Management Committee, supported operationally by the Network Development Manager
Link to ABN Objectives	Building a trusted, collaborative network Supporting safe and responsible information-sharing Strengthening coordination across befriending services
Scope	Website visitors; people who contact ABN; member and partner representatives; event and meeting participants; speakers, contributors and other professional contacts.

1. Purpose and Scope

This notice explains how Aberdeen Befriending Network (ABN) collects, uses, shares, stores and protects personal information. It is intended for visitors to our website and for people who contact or interact with ABN in connection with membership, partnership working, meetings, training, events, communications or website content.

It is a public privacy notice under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It also explains our use of cookies and similar technologies under the Privacy and Electronic Communications Regulations 2003 (PECR), as amended. It should be read alongside any more specific information given when we collect personal information.

ABN is a network and does not itself provide a befriending service. If you ask us to help you find support, we will normally provide information or ask before passing your details to a member or partner organisation.

2. Who We Are and How to Contact Us

Aberdeen Befriending Network is the controller of the personal information described in this notice. This means that ABN decides why and how that information is used. ABN is governed by its Management Committee.

Data protection contact: info@aberdeenbefriendingnetwork.co.uk

Website: aberdeenbefriendingnetwork.co.uk

Please put “Privacy” in the subject line if your message concerns your personal information or a data protection complaint.

3. Personal Information We Collect and Its Sources

Depending on how you interact with ABN, we may collect:

identity and contact details, such as your name, email address, telephone number, role and organisation;
the contents of enquiries, correspondence, feedback and complaints, including information you choose to put in the website contact form;
membership and professional relationship information, including your organisation, interests, meeting participation and records of relevant decisions or communications;
event, training or meeting information, such as bookings, attendance and accessibility or dietary requirements;
directory, news and content information supplied by member organisations, including organisational contacts, service descriptions, photographs, video, quotations and testimonials;
communication preferences and records of consent or withdrawal;
technical information generated when you use the website, which may include IP address, date and time, pages visited, referring page, browser, device, operating system, approximate location, form-security data and server logs; and
records needed to handle information-rights requests, safeguarding concerns, legal claims or security incidents.

Where the information comes from

Most information comes directly from you. We may also receive professional contact or directory information from your organisation, an ABN member, a partner, an event organiser, a person acting with your authority, publicly accessible sources such as organisational websites, or our website, hosting, analytics and communications providers. Where we obtain personal information from another source, we will provide privacy information within the period required by law unless an exception applies.

Sensitive information

ABN does not ask for health information or other special category data in its general contact form. Please do not include sensitive or confidential details unless they are necessary. Where ABN asks you to provide sensitive information, for example an accessibility requirement, we will explain why it is needed and identify an Article 9 condition. Where we rely on explicit consent, you may withdraw that consent at any time. If sensitive information is provided unexpectedly, we will restrict its use to what is necessary to deal with the matter and delete it as soon as reasonably possible.

4. How We Use Personal Information and Our Lawful Bases

We must have a lawful basis under Article 6 UK GDPR for every use of personal information. Where special category information is used, we must also identify an Article 9 condition and, where required, a condition in Schedule 1 to the Data Protection Act 2018.

Purpose	Information normally used	Lawful basis
Reply to enquiries and provide information or signposting.	Name, contact details and enquiry.	Legitimate interests: responding helpfully and operating the Network. Steps at your request before a contract may apply in limited cases.
Administer membership, partnerships and professional relationships.	Role, organisation, contact details, correspondence and meeting records.	Legitimate interests: coordinating the Network and maintaining effective relationships. Contract where an agreement requires the processing.
Organise meetings, events and training.	Bookings, attendance, contact details and requirements.	Legitimate interests or contract. Explicit consent for special category accessibility or dietary information where required.
Send operational updates and requested news.	Contact details, role and preferences.	Legitimate interests for service or membership communications. Consent for optional public email marketing; PECR also applies.
Publish the directory, news, case studies, photographs, video, quotations or testimonials.	Professional details, organisational information and media.	Legitimate interests for organisational and professional information, following a balancing assessment. Consent where appropriate for identifiable personal stories, portraits or optional promotional content.
Operate, secure and troubleshoot the website and contact form.	IP address, device/browser data, logs, form-security and submission metadata.	Legitimate interests: security, service delivery, fraud/spam prevention and improvement. Legal obligation where processing is required for data security or compliance.
Measure website use and provide social-media or video embeds.	Online identifiers, usage, device and interaction information.	Consent for non-essential analytics, Facebook content and similar tools. Necessary website storage/access may rely on the relevant PECR exception and legitimate interests.
Handle safeguarding concerns, emergencies, legal duties or claims.	Relevant correspondence and any information necessary for the matter.	Legal obligation, vital interests or legitimate interests. For special category data: vital interests or substantial public interest/safeguarding conditions, with DPA 2018 safeguards where applicable.
Respond to privacy requests and complaints and keep evidence of compliance.	Identity, request, correspondence and outcome.	Legal obligation and legitimate interests in demonstrating compliance and resolving disputes.

We will not use personal information for a new purpose that is incompatible with the purpose for which it was collected. If the lawful basis changes or further privacy information is required, we will tell affected individuals before the new use begins.

5. Who We Share Information With

We do not sell personal information. We share it only where this is necessary, lawful and proportionate. Recipients may include:

ABN committee members, workers or authorised volunteers who need the information for their role;
website hosting, email, cloud, form, IT support, security and other service providers acting under contract, including IONOS and the providers supporting our WordPress website;
Google, Meta/Facebook and YouTube where you enable or interact with their website services;
ABN member or partner organisations where you ask us to make an introduction, give permission, or sharing is otherwise lawful and necessary;
event venues, trainers and delivery partners where necessary to provide an event or reasonable adjustment;
professional advisers, insurers, funders, auditors or independent examiners where relevant and subject to appropriate confidentiality; and
the police, emergency services, regulators, courts, local authorities or safeguarding bodies where law requires or permits sharing or where it is necessary to protect someone.

Where a supplier processes information on our behalf, we require an appropriate written contract and suitable security. Where another organisation is an independent or joint controller, its own privacy notice may also apply.

6. International Transfers

Some suppliers, including Google, Meta and YouTube, may process personal information outside the United Kingdom. Where information is transferred to a country without UK adequacy regulations, we require an appropriate transfer safeguard, such as the UK International Data Transfer Agreement or the UK Addendum to approved contractual clauses. A transfer may also be covered by an applicable UK adequacy arrangement, such as the UK Extension to the EU-US Data Privacy Framework, where the recipient is certified.

You may contact us for more information about the safeguard used for a relevant transfer. We also configure services to minimise the information sent and use privacy-enhancing settings where these are available.

7. Cookies, Analytics and Embedded Content

Cookies and similar technologies store or access information on your device. We provide clear information and a “Cookie settings” control so you can accept, reject or later change choices. Rejecting non-essential technologies will not prevent access to the main website. A consent-preference cookie may be used to remember your choice.

Category/service	What it does	Rule/basis	Typical duration
Necessary website and form functions	Deliver pages, submit the form, remember privacy choices, prevent spam and maintain security.	Consent is not required where the communication or strictly necessary PECR exception applies. UK GDPR basis: legitimate interests or legal obligation.	Session to about 12 months, depending on purpose.
Google tag / Analytics	Measures visits, pages, referral source, device/browser and broad location so we can improve the site. ABN does not enable advertising personalisation or Google Signals.	Loaded only after consent unless ABN has configured genuinely aggregate analytics that meet the narrow PECR statistical-purpose exception and offers a simple free objection.	Analytics data: up to 14 months. Cookies such as _ga and _ga_*: up to 2 years.
YouTube privacy-enhanced video	Displays ABN video. YouTube storage/access does not occur until you choose to play or enable the content. YouTube then receives device and viewing information.	Your play/enable choice; strictly necessary for requested playback where configured in privacy mode. Consent is used if additional non-essential purposes apply.	Provider-controlled; session to about 6 months for common video cookies.
Facebook Page Plugin	Displays ABN Facebook content. Meta may receive IP address, browser/page information and identifiers, particularly if you are logged in to Facebook.	Blocked until consent because social plugins and tracking do not normally meet a PECR exception.	Provider-controlled; some Meta cookies can last up to 2 years.

Your choices

Use the Cookie settings link in the website footer to withdraw consent or object where an exception provides that right. You can also delete or block cookies through your browser, although blocking necessary storage may affect a requested function. Withdrawal does not affect processing already carried out lawfully.

Links to other websites are not controlled by ABN. If you follow a link or enable third-party content, that provider will explain its own processing in its privacy information.

Provider information: Google Privacy & Terms; YouTube Privacy; and Meta Privacy Centre.

8. How Long We Keep Information

We keep personal information only for as long as it is needed for the purpose described, including legal, safeguarding, accountability and dispute requirements. We securely delete or anonymise information when it is no longer required. Our normal periods are:

Record	Normal retention
General website or email enquiry	Up to 12 months after the enquiry is concluded, unless it becomes part of another relationship, complaint, safeguarding matter or legal record.
Member, partner and professional contacts	Reviewed at least annually; retained while the relationship is active and, where needed for governance, agreements or claims, for up to 6 years afterwards.
Meeting, event and training administration	Normally up to 2 years. Sensitive accessibility or dietary information is deleted shortly after the event unless there is a clear continuing need.
Marketing consent and suppression records	While communications continue; evidence of consent or withdrawal may be retained for up to 6 years to demonstrate compliance.
Directory, news, photographs, video and testimonials	For as long as the content remains relevant and lawful. Content is reviewed periodically and removed earlier where consent is withdrawn and no other basis applies.
Security and server logs	Usually 30 to 90 days, unless a longer period is necessary to investigate an incident or protect the service.
Google Analytics	User and event-level data is retained for no more than 14 months; aggregate reports may be retained longer where individuals are not identifiable.
Privacy requests, complaints, incidents and legal records	Normally up to 6 years after closure, or longer where required by law or an active claim.

A particular record may be kept for a shorter or longer period where documented circumstances justify it. When deciding, we consider the amount, nature and sensitivity of the information, the risk of harm, the purpose, legal requirements and whether the purpose can be achieved another way.

9. How We Protect Information

ABN uses proportionate technical and organisational measures to protect personal information against accidental or unlawful loss, alteration, disclosure or access. Measures include limiting access to people who need it, role-appropriate confidentiality, strong authentication, secure and supported systems, updates and backups, protected email and cloud services, supplier checks, appropriate contracts, retention controls and secure disposal.

No internet or email system can be guaranteed completely secure. If a personal data breach occurs, we will contain and assess it, keep the records required by law, notify the Information Commissioner’s Office without undue delay and, where feasible, within 72 hours if the legal threshold is met, and inform affected individuals where the breach is likely to result in a high risk.

10. Your Data Protection Rights

Depending on the circumstances and lawful basis, you may have the right to:

be informed about how we use your personal information;
ask for access to your personal information and a copy of it;
ask us to correct inaccurate or incomplete information;
ask us to erase information where the legal conditions apply;
ask us to restrict processing in certain circumstances;
object to processing based on legitimate interests and object at any time to direct marketing;
receive information you provided in a portable format where processing is automated and based on consent or contract;
withdraw consent at any time, without affecting earlier lawful processing; and
not be subject to a decision based solely on automated processing that has legal or similarly significant effects, subject to legal exceptions.

YOUR RIGHT TO OBJECT: You may object to processing based on legitimate interests for reasons relating to your situation. We will stop unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims. You may object to direct marketing at any time and we will stop.

To exercise a right, email our data protection contact. We may ask for information needed to confirm identity and understand the request. We normally respond within one month. We do not usually charge a fee, but the law allows a reasonable fee or refusal where a request is manifestly unfounded or excessive. Some rights are not absolute, and we will explain any lawful restriction.

11. Children and Young People

The website is primarily intended for adults, professionals and organisations. ABN does not knowingly invite children under 13 to create accounts or subscribe to marketing, and it does not profile children. A child or young person may still contact us for information. We will use clear language, collect only what is needed and give particular weight to the child’s best interests and privacy.

A parent, carer or professional should avoid sending unnecessary information about a child through the general contact form. Contact ABN first if sensitive information may be required. If we need to share a child’s information for safeguarding, we will do so only where lawful, necessary and proportionate.

12. Automated Decision-Making and Profiling

ABN does not use personal information to make solely automated decisions that have legal or similarly significant effects. We do not use website information for behavioural advertising or to build profiles of individual visitors.

13. Questions and Complaints

Please contact ABN first if you have a question or concern. We will investigate and aim to resolve the matter promptly.

Email: info@aberdeenbefriendingnetwork.co.uk

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority:

Information Commissioner’s Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113

Website: ico.org.uk/make-a-complaint

14. Changes to This Notice

We review this notice at least annually and whenever our website, services, suppliers, purposes or the law changes. The current version will be published on the website with its date of issue. If a change materially affects individuals, we will use a proportionate method to bring it to their attention.

15. Legislation and Guidance

This notice has been prepared with reference to the following legislation and current ICO guidance:

Approved by: Aberdeen Befriending Network Management Committee

Approval date: 27.8.26

Next review: August 2027, or sooner if required

Privacy and Cookie Notice