Privacy & cookies.

Family Unit Trust ("we", "us", "our") is a registered charity (Charity No. 1190524) based at Unit 11, Varley Industrial Estate, Miles Platting, Manchester, M40 8EL. We are the "data controller" for the personal information described here.

For any question about your data, or to exercise your rights, contact us at info@familyunittrust.org.uk or call 0161 879 8398.

Programme registrations: your name, date of birth, contact details, address/postcode, and information specific to the programme (for example dietary needs, reasons for accessing the food bank, emergency contacts, or availability).

Health information: for the Cancer Awareness programme we may collect details you choose to share about medical conditions, accessibility needs, and whether you or someone close to you has been affected by cancer (see 'Special category data').

Children's information: some programmes are for under-18s (e.g. Brave Spaces, Holiday Playscheme). Where a child takes part we collect their details with parental/guardian consent and hold safeguarding information (see 'Children's data').

Volunteers: in addition to contact details, skills/experience, DBS status, references and safeguarding declarations.

Enquiries and live chat: the content of your message and your contact details. Donations: handled by PayPal - we never see or store your card details.

Website use: limited technical information and your cookie preferences. Staff/trustee accounts: for those who log in to our internal admin, an account managed by our sign-in provider.

Some information - particularly health-related details in the Cancer Awareness programme - is 'special category data' and receives extra protection under UK GDPR. We only collect it where you have given us your explicit consent on the form, and we use it solely to deliver the programme safely and to safeguard participants. You can withdraw your consent at any time.

Where a programme involves under-18s, we collect the child's information on the basis of parental or guardian consent and process it in line with our safeguarding policy. We keep it to the minimum necessary and restrict access to staff who need it to deliver the programme and keep children safe.

We use your details to reply to you, run the programmes you register for, manage volunteering and safeguarding, process donations, protect people at risk, and meet our legal and regulatory duties as a charity.

Our lawful bases are: consent; explicit consent for health data; parental consent for children; legal obligation and legitimate interests for safeguarding and charity duties. We never sell your data and we do not use it for automated decision-making or profiling.

We use trusted service providers ('processors') who act on our instructions and may not use your data for their own purposes: Supabase (secure database for form submissions), Microsoft Forms (hosts some sign-up forms, being migrated), PayPal (donations - no card data reaches us), Clerk (staff/trustee sign-in), Vercel (website hosting), and Crisp (the live chat widget).

We may also share information where we are legally required to, or to safeguard someone at risk of harm. Some providers may process data outside the UK; where they do, appropriate safeguards are in place.

Essential cookies: needed for the website to function (for example, remembering your cookie choice). These are always on.

Optional analytics cookies: help us understand how the site is used so we can improve it. These are only set if you choose 'Accept all' in the cookie banner. You can change your mind at any time by clearing this site's data in your browser - the banner will appear again.

Our live chat (Crisp) also sets cookies so a conversation can continue.

We keep personal data only as long as necessary for the purpose we collected it, then securely delete or anonymise it, in line with our records-retention policy. Donation records are kept as long as required for financial and Gift Aid purposes.

Programme data is stored in a database with row-level security and is only accessible to authorised staff through server-side, access-controlled systems. Data is transmitted over encrypted (HTTPS) connections. No payment card details are stored by us - payments are handled entirely by PayPal. Staff admin access requires individual sign-in and is role-restricted.

You have the right to access, correct, erase, restrict or object to our use of your personal data, to data portability, and to withdraw consent at any time (including for health data). To exercise any of these, email us. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.