PrivacyPolicy

1. Introduction

Every Sensation Children Services (“we”, “us”, “our”) is committed to protecting and respecting your privacy and the privacy of the children for whom you seek our services. This Privacy Policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us.

This Privacy Policy is issued in accordance with the United Kingdom General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), and the Privacy and Electronic Communications Regulations 2003 (PECR). It applies to all personal data processed through our website at www.everysensationchildservices.co.uk (the “Website”).

We recognise the particular importance of protecting personal data relating to children and individuals with special educational needs, disabilities, and health conditions. We have designed our data processing practices with these considerations at the forefront.

Please read this Privacy Policy carefully to understand our views and practices regarding your personal data and how we will treat it. By using our Website or submitting information to us through our contact form, you acknowledge that you have read and understood this Privacy Policy.

2. Data Controller

For the purposes of the UK GDPR and the Data Protection Act 2018, the data controller is:

The data controller is responsible for, and is able to demonstrate compliance with, the data protection principles set out in Article 5 of the UK GDPR. If you have any questions about this Privacy Policy or our data processing practices, please contact us using the details provided in Section 18 below.

3. Information We Collect

We collect and process the following categories of personal data through our Website:

3.1 Information You Provide via Our Contact Form

When you submit an enquiry through our contact form, we collect the following information:

• Email address (required) — to enable us to respond to your enquiry
• Parent or carer name (required) — to identify the primary contact person
• Phone number (optional) — to provide an alternative means of contact
• Child's name (required) — to identify the child for whom services are being sought
• Child's age (required) — to assess the suitability of our services
• Clinical or medical needs (optional) — to understand any health-related requirements the child may have
• Autism or sensory needs (optional) — to understand the child's specific sensory profile and support requirements
• Preferred staffing ratio (optional) — to understand the level of support required
• Services interested in (optional, multiple selection) — to direct your enquiry to the appropriate service area (e.g. Day Centre, Community Support, PA Support at Home, Out-of-Centre Activities)
• Social worker name (optional) — to facilitate liaison with relevant professionals
• Additional information (optional) — any further details you choose to provide to assist us in understanding your enquiry

All data submitted through the contact form is transmitted directly to our team via email. We do not store form submissions in a database on our Website servers.

3.2 Information Collected Automatically (Analytics Data)

Where you have provided your explicit consent via our cookie consent mechanism, we use Google Analytics to collect the following technical and usage data:

• Anonymised IP address (IP anonymisation is enabled by default)
• Pages visited and time spent on each page
• Browser type, version, and operating system
• Device type and screen resolution
• Referral source (how you arrived at our Website)
• General geographic location (derived from anonymised IP address, at city level or broader)
• Interaction events (e.g. clicks, scrolls)

This data is collected solely for the purpose of understanding how visitors use our Website so that we can improve its content, functionality, and user experience. Analytics data is not used to identify individual visitors.

4. Special Category Data

Some of the information you may choose to provide through our contact form constitutes “special category data” within the meaning of Article 9 of the UK GDPR. This includes, but is not limited to:

• Clinical or medical needs — information concerning a child's physical or mental health conditions, diagnoses, medications, or medical requirements
• Autism or sensory needs — information relating to autism spectrum conditions, sensory processing differences, or other neurodevelopmental conditions

Under Article 9(1) of the UK GDPR, the processing of special category data is generally prohibited unless a specific condition under Article 9(2) applies. We process special category data on the following basis:

• Article 9(2)(a) — Explicit consent: By voluntarily providing health-related information through our contact form, you give your explicit consent to our processing of that data for the purposes of responding to your enquiry and assessing how we may best support the child in question. The provision of clinical and sensory needs information is entirely optional, and you may choose not to include it in your submission.

Additionally, the processing of such data is subject to the conditions set out in Schedule 1, Part 1 of the Data Protection Act 2018, specifically paragraph 2 (health or social care purposes) and paragraph 4 (appropriate policy document requirement). We maintain an appropriate policy document as required.

You have the right to withdraw your consent to the processing of special category data at any time. To do so, please contact us using the details provided in Section 18. Withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

5. Children's Personal Data

Given the nature of our services, we routinely process personal data relating to children. We recognise the heightened duty of care owed when processing children's data and have implemented appropriate safeguards in accordance with:

• The UK GDPR, in particular Recital 38, which states that children merit specific protection with regard to their personal data
• The ICO's Age Appropriate Design Code (Children's Code), which sets standards for online services likely to be accessed by children
• Section 123 of the Data Protection Act 2018, which gives the ICO power to prepare the Children's Code

Personal data about children (including their name, age, health information, and support needs) is submitted to us by their parent or carer. We do not collect personal data directly from children through our Website. The parent or carer submitting information through our contact form warrants that they have parental responsibility for the child in question, or have obtained appropriate authorisation to share the child's personal data with us.

We process children's personal data solely for the purpose of assessing and responding to enquiries about our services, and subsequently for the provision of those services where an arrangement is agreed. We apply the following principles to the processing of children's data:

• We collect only the minimum amount of data necessary for the stated purpose
• We do not use children's data for marketing purposes
• We do not share children's data with third parties for commercial purposes
• We apply appropriate technical and organisational measures to protect children's data
• We retain children's data only for as long as is necessary for the purposes for which it was collected

6. How We Use Your Information

We use the personal data we collect for the following purposes:

• Responding to enquiries: To read, assess, and respond to enquiries submitted through our contact form, including contacting you by email or telephone to discuss our services
• Service assessment: To evaluate the suitability of our services for the child based on the information provided, including their age, support needs, and preferences
• Professional liaison: Where you have provided the name of a social worker or other professional, to facilitate communication with relevant parties in connection with the child's care and support
• Service delivery: To plan and deliver appropriate sensory and therapeutic support services where an arrangement is subsequently agreed
• Website improvement: To analyse anonymised usage data (where consent has been given for analytics cookies) in order to improve the content, functionality, and accessibility of our Website
• Legal compliance: To comply with our legal obligations, including those arising under the UK GDPR, DPA 2018, and other applicable legislation

We will not use your personal data for any purpose other than those described in this Privacy Policy unless we have obtained your consent or are otherwise required or permitted to do so by law.

7. Lawful Basis for Processing

Under Article 6 of the UK GDPR, we must have a lawful basis for processing your personal data. The lawful bases upon which we rely are as follows:

7.1 Consent (Article 6(1)(a))

We rely on your consent for the following processing activities:

• The placement of non-essential cookies (specifically Google Analytics cookies) on your device, in accordance with Regulation 6 of PECR
• The processing of special category data (health information) provided voluntarily through our contact form, pursuant to Article 9(2)(a) of the UK GDPR

Where we rely on consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

7.2 Legitimate Interests (Article 6(1)(f))

We rely on our legitimate interests for the following processing activities:

• Processing contact form submissions (excluding special category data) in order to respond to enquiries from parents and carers about our services. Our legitimate interest is the effective operation of our business and the provision of information to prospective service users.
• Maintaining the security and proper functioning of our Website

We have carried out a legitimate interest assessment in respect of each of these processing activities and have concluded that our legitimate interests are not overridden by the interests, rights, or freedoms of the data subjects concerned.

7.3 Legal Obligation (Article 6(1)(c))

Where we are required to process personal data in order to comply with a legal obligation to which we are subject (for example, responding to lawful requests from regulatory authorities or law enforcement agencies), we rely on Article 6(1)(c) as our lawful basis for processing.

9. Google Analytics

We use Google Analytics 4, a web analytics service provided by Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies (as described in Section 8 above) to help us analyse how visitors use our Website.

9.1 What Google Analytics Collects

When analytics cookies are active (i.e. you have given your explicit consent), Google Analytics collects the following types of information:

• Pages viewed, duration of visits, and navigation paths
• Browser type and version, operating system, and device type
• Screen resolution and viewport size
• Referral URL (the website or search engine that brought you to our site)
• General geographic location (city level or broader, derived from anonymised IP address)
• Language settings

9.2 IP Anonymisation

We have enabled IP anonymisation (anonymize_ip: true) in our Google Analytics configuration. This means that your IP address is truncated by Google within member states of the European Economic Area and the United Kingdom before being transmitted to Google servers. In exceptional cases only, the full IP address is sent to a Google server and shortened there. The anonymised IP address transmitted by your browser through Google Analytics will not be associated with any other data held by Google.

9.3 Opting Out of Google Analytics

You can opt out of Google Analytics data collection at any time by:

• Rejecting non-essential cookies through our cookie consent banner (accessible via the “Cookie Preferences” link in the Website footer)
• Installing the Google Analytics Opt-out Browser Add-on
• Configuring your browser to refuse cookies (see Section 8.4 above)

10. Data Sharing and Third Parties

We do not sell, rent, or trade your personal data to any third party. We may share your personal data with the following categories of recipients, solely for the purposes described in this Privacy Policy:

10.1 Google (Analytics)

Where you have consented to analytics cookies, anonymised usage data is shared with Google Ireland Limited through the Google Analytics platform. Google processes this data on our behalf as a data processor. Google's processing of analytics data is governed by the Google Ads Data Processing Terms and Google's Privacy Policy, available at policies.google.com/privacy.

10.2 Email Service Provider

Contact form submissions are transmitted to our team via email. This means your personal data passes through our email service provider's infrastructure during delivery. The email service provider processes this data solely for the purpose of delivering the email and does not retain a separate copy of the data for its own purposes.

10.3 Other Disclosures

We may also disclose your personal data to third parties where we are required to do so by law, in connection with any legal proceedings, or in order to establish, exercise, or defend our legal rights. This may include disclosure to regulatory authorities, law enforcement agencies, or courts as required by applicable legislation.

11. International Data Transfers

Where you have consented to analytics cookies, data collected by Google Analytics may be transferred to and processed by Google on servers located outside the United Kingdom, including servers in the United States of America.

Any such transfer of personal data outside the United Kingdom is carried out in compliance with Chapter V of the UK GDPR (Articles 44–49). Specifically, transfers to Google are protected by:

• Standard Contractual Clauses (SCCs): Google has committed to processing data in accordance with Standard Contractual Clauses approved by the European Commission and recognised under UK law, which provide appropriate safeguards for the protection of personal data transferred outside the United Kingdom
• Adequacy decisions: Where applicable, transfers may also be made to countries that have received an adequacy decision from the UK Secretary of State under Section 17A of the Data Protection Act 2018, confirming that the country provides an adequate level of data protection

Personal data submitted through our contact form is processed within our email infrastructure and is not intentionally transferred outside the United Kingdom. However, email routing may involve transit through servers in other jurisdictions. Where this occurs, appropriate safeguards (including encryption in transit) are in place.

12. Data Retention

In accordance with the data minimisation and storage limitation principles set out in Article 5 of the UK GDPR, we retain personal data only for as long as is necessary to fulfil the purposes for which it was collected.

12.1 Contact Form Data

Personal data submitted through our contact form is delivered to our team via email. We retain this data in our email system for as long as is reasonably necessary to:

• Respond to your enquiry and complete any follow-up communications
• Assess the suitability of our services for the child in question
• Maintain records for the purpose of service delivery, where an arrangement is agreed

Where an enquiry does not proceed to a service arrangement, we will delete or anonymise the associated personal data within 12 months of our last communication with you, unless we are required to retain it for a longer period by law.

12.2 Analytics Data

Google Analytics data is retained in accordance with our configured data retention settings. Analytics cookies have the following lifespans:

• _ga and _ga_*: 2 years from the date of your last visit
• _gid: 24 hours

12.3 Cookie Consent Preference

Your cookie consent preference (stored in localStorage) persists until you clear your browser data or change your preference through our cookie consent mechanism.

13. Data Security

In accordance with Article 32 of the UK GDPR, we have implemented appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

• Encryption in transit: Our Website is served exclusively over HTTPS (TLS/SSL encryption), ensuring that all data transmitted between your browser and our servers is encrypted
• Secure form submission: Contact form data is transmitted over an encrypted connection to our email service
• Access controls: Access to personal data received via our contact form is restricted to authorised members of our team who require access for the purposes described in this Privacy Policy
• No database storage: We do not store contact form submissions in a database on our Website servers, reducing the risk of data breach through server-side vulnerabilities
• Regular review: We regularly review our data processing practices and security measures to ensure they remain appropriate and effective
• Minimal data collection: We collect only the personal data that is necessary for the stated purposes, in accordance with the data minimisation principle

Whilst we take all reasonable precautions to protect your personal data, please be aware that the transmission of information via the internet is not completely secure. We cannot guarantee the security of data transmitted to our Website; any transmission is at your own risk.

14. Your Rights Under UK GDPR

Under the UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data. These rights are not absolute and may be subject to certain exemptions or limitations:

14.1 Right of Access (Article 15)

You have the right to request confirmation as to whether or not we are processing your personal data, and where we are, to request access to that data. This is commonly referred to as a “Subject Access Request” (SAR). We will provide a copy of the personal data being processed, free of charge, within one month of receiving your request.

14.2 Right to Rectification (Article 16)

You have the right to request the rectification of inaccurate personal data concerning you without undue delay. Taking into account the purposes of the processing, you also have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

14.3 Right to Erasure (Article 17)

You have the right to request the erasure of your personal data without undue delay where one of the following grounds applies: the data is no longer necessary for the purposes for which it was collected; you withdraw consent on which the processing is based and there is no other legal ground for the processing; you object to the processing and there are no overriding legitimate grounds; the data has been unlawfully processed; or the data must be erased for compliance with a legal obligation. This right is also commonly known as the “right to be forgotten”.

14.4 Right to Restriction of Processing (Article 18)

You have the right to request the restriction of processing of your personal data where: you contest the accuracy of the data (for a period enabling us to verify accuracy); the processing is unlawful and you oppose erasure and request restriction instead; we no longer need the data for the purposes of processing but it is required by you for the establishment, exercise, or defence of legal claims; or you have objected to processing pending verification of whether our legitimate grounds override yours.

14.5 Right to Data Portability (Article 20)

Where the processing is based on consent or on a contract and the processing is carried out by automated means, you have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format. You also have the right to request that we transmit that data to another controller where technically feasible.

14.6 Right to Object (Article 21)

You have the right to object, on grounds relating to your particular situation, to processing of your personal data which is based on our legitimate interests (Article 6(1)(f)). Where you exercise this right, we shall cease processing the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or where the processing is necessary for the establishment, exercise, or defence of legal claims.

14.7 Rights in Relation to Automated Decision-Making and Profiling (Article 22)

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. We confirm that we do not carry out any automated decision-making or profiling in relation to your personal data.

14.8 Right to Withdraw Consent (Article 7(3))

Where we rely on your consent as the lawful basis for processing (including consent for analytics cookies and consent for the processing of special category data), you have the right to withdraw that consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. You may withdraw consent for analytics cookies by using our cookie consent mechanism, and you may withdraw consent for the processing of special category data by contacting us using the details in Section 18.

15. How to Exercise Your Rights

To exercise any of the rights described in Section 14, or to make any enquiry or complaint regarding our processing of your personal data, please contact us at:

We will respond to your request without undue delay and in any event within one month of receipt. This period may be extended by a further two months where necessary, taking into account the complexity and number of requests. Where we extend the response period, we will inform you of the extension and the reasons for the delay within one month of receiving the request, in accordance with Article 12(3) of the UK GDPR.

We may need to verify your identity before processing your request, to ensure that personal data is not disclosed to any person who is not entitled to receive it. We may request additional information from you to confirm your identity.

In accordance with Article 12(5) of the UK GDPR, requests to exercise your rights are provided free of charge. However, where requests are manifestly unfounded or excessive, in particular because of their repetitive character, we may charge a reasonable fee taking into account the administrative costs of providing the information or taking the action requested, or refuse to act on the request.

16. Right to Lodge a Complaint

If you are dissatisfied with any aspect of our processing of your personal data, you have the right to lodge a complaint with the supervisory authority. In the United Kingdom, the supervisory authority for data protection is the Information Commissioner's Office (ICO):

We would, however, appreciate the opportunity to address your concerns before you approach the ICO. Please contact us in the first instance using the details provided in Section 18, and we will endeavour to resolve the matter to your satisfaction.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data processing practices, changes in applicable law, or for other operational, legal, or regulatory reasons. Any changes we make to this Privacy Policy will be published on this page.

Where changes are significant (for example, changes to the purposes for which we process your personal data or changes to the categories of personal data we collect), we will take reasonable steps to notify you, which may include displaying a prominent notice on our Website or, where appropriate, contacting you directly.

The “Last updated” date at the top of this Privacy Policy indicates when it was most recently revised. We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information.

18. Contact Us

If you have any questions, comments, or concerns about this Privacy Policy, our data processing practices, or if you wish to exercise any of your rights as described in this Privacy Policy, please contact us at:

We will endeavour to respond to all enquiries as promptly as possible and within the timeframes required by applicable legislation.