Privacy Policy
Last reviewed: 21 September 2026
Paces Sheffield (“Paces”, “we”, “us”, “our”) respects and protects your privacy. This policy explains what personal data we collect through this website. It also covers why we collect it, how we use it, and what rights you have over it.
This policy applies to the Paces Sheffield charity website (pacessheffield.org.uk). However, it does not cover the separate Paces School website (pacesschool.org.uk), which has its own privacy notice for school admissions and pupil data. Nor does it cover any other website we link to.
1. Who We Are
Paces is a registered charity. We support children, young people and adults with neurological conditions such as cerebral palsy, through Conductive Education, adult day services and related support.
Charity name: Paces Sheffield (Paces Charity)
Registered charity number: 1104356
Company number: 4793176 (a company limited by guarantee, registered in England and Wales)
Registered / operational address: Unit 4, Smithy Wood Business Park, Sheffield, S35 1QN
Phone: 0114 551 0400
Email: info@pacessheffield.org.uk
Paces is the data controller for the personal data in this policy. In other words, we decide how and why we use it.
2. Information We Collect
2.1 Information you give us directly
You give us personal data whenever you choose to share it, for example when you:
- Send us a message using the Contact Us form, and pick a subject such as a general enquiry, an Adult Services referral, a School admissions enquiry, fundraising, Club 300, volunteering, or media and press;
- Register a fundraising challenge or event using the Sign Up to Fundraise form;
- Enquire about joining our Business Club (Club 300) using the How to Join form, either as an individual or for an organisation;
- Apply for a vacancy with us, if and when we advertise one (see 2.4);
- Contact us by phone, email or post, or speak to a member of our team in person;
- Correspond with us about a current or possible place at Adult Services or Paces School.
Our web forms also use Cloudflare Turnstile. This security check helps us tell real visitors from automated bots. Because of that, it processes technical data such as your IP address and browser signals. For more detail, see Sections 8 and 9.
2.2 Information we collect automatically
Like most websites, our site collects some technical information automatically when you visit. This includes your IP address, browser type and version, device type, operating system and referring website. It also covers which pages you view, how long you spend on the site, and the approximate location that your IP address suggests. We use all of this to keep the site secure, to check how it performs, and to improve it. Section 8 (Cookies) explains more.
2.3 Information from other sources
If you donate through JustGiving, we receive limited information from JustGiving. For example, we receive your name, the donation amount, and your Gift Aid declaration status if you give one. We then use it to thank you, to administer Gift Aid, and to keep accurate accounting records. JustGiving is a separate data controller for the information it holds about you, so please read JustGiving’s own privacy policy too.
Sometimes a professional refers someone to our Adult Services or School on their behalf. A social worker, health professional or school might do this. In that case, we may receive personal data directly from that professional, including special category data about care or support needs.
2.4 Recruitment
This website does not currently have an online application form. When we advertise a vacancy, the listing explains how to apply, for example by email or through a linked recruitment platform. We then use any candidate information we receive only to assess your application, to check your eligibility to work, and, where relevant, to meet our safeguarding duties.
3. How We Use Your Information and Our Legal Basis
UK data protection law requires a valid “lawful basis” for each way we use your personal data. Therefore, the tables below set out the main purposes for which this website collects and uses personal data.
3.1 Enquiries, referrals and admissions
| Purpose | What we collect | Our lawful basis |
|---|---|---|
| Answering a general enquiry, including one from the Contact Us form | Your name, email address, phone number (optional), subject category and message | Legitimate interests, so that we can answer enquiries you send us. If you tell us about a child’s or an adult’s care needs, we also rely on your explicit consent |
| Handling an Adult Services enquiry or referral | Your name and contact details, plus anything you or a referring professional share about care needs, funding and eligibility | Explicit consent (Article 9(2)(a) UK GDPR). Also, when we assess or provide care, the health or social care condition (Article 9(2)(h)) |
| Handling a School admissions enquiry | Your name and contact details, plus anything you share about a child’s needs | Explicit consent (Article 9(2)(a) UK GDPR) if you share special category information. Otherwise, legitimate interests for general admissions correspondence |
3.2 Fundraising, supporters and donations
| Purpose | What we collect | Our lawful basis |
|---|---|---|
| Registering a fundraising activity (Sign Up to Fundraise form) | Your name, email, phone number, activity details and fundraising target (optional) | Steps we take at your request, so that we can support your fundraising, and legitimate interests |
| Business Club / Club 300 enquiries (How to Join form) | Organisation name, address and website, plus the main contact’s name, industry, email and phone number | Legitimate interests, so that we can manage corporate supporter relationships. Once you join, contract |
| Processing a donation | You donate through JustGiving, an independent platform. JustGiving then sends us limited details, such as your name, the amount and your Gift Aid status | Legitimate interests (charitable administration). For Gift Aid, legal obligation |
| Sending fundraising or supporter updates | Your name, email address and phone number | Consent, or the “soft opt-in” if you already support us and we gave you a clear chance to object. You may opt out at any time |
3.3 Recruitment
| Purpose | What we collect | Our lawful basis |
|---|---|---|
| Recruitment, when we advertise vacancies | Your name, contact details, CV and any supporting information you send | Steps we take at your request before a contract, and legitimate interests |
3.4 Website security and improvement
| Purpose | What we collect | Our lawful basis |
|---|---|---|
| Website security and fraud prevention, such as Cloudflare Turnstile on our forms | Your IP address, device and browser information, plus interaction data that helps us tell humans from bots | Legitimate interests, so that we can keep our website and forms secure |
| Improving our website and seeing how visitors use it | Technical and usage data (see the Cookies section) | Legitimate interests or consent, as our Cookies section describes |
Sometimes we rely on legitimate interests. In those cases, we first consider whether our use of your data is reasonable and proportionate, and whether it unduly affects your rights. If you want more detail about a specific assessment, or if you object to it, please contact us using the details in Section 15.
4. Special Category Data (Health and Disability Information)
Because of the nature of our work, enquiries through this website often touch on health. This is especially true of Adult Services and School admissions enquiries, which may mention a person’s health, disability, or care and support needs. UK GDPR calls this “special category data” and gives it extra protection.
We only collect such information when you, or a referring professional, choose to share it with us. We then use it solely to answer that enquiry, to assess eligibility for our services, and, if you take up a place, to provide safe and appropriate care. For this we rely on your explicit consent. In addition, when we assess or provide health or social care, we rely on the specific UK GDPR condition that permits it (Article 9(2)(h)).
Please share only the level of detail we need in order to help you. Also, do tell us if you would rather discuss sensitive information by phone than in writing.
5. Children’s Information
We designed this website, and the forms on it, for parents, carers, professionals and other adults rather than for children. So if an enquiry concerns a child, for example a School admissions enquiry, we expect a parent, carer or professional to send it on the child’s behalf.
Our Paces Families page shares stories, and sometimes photos, of children, young people and adults we support. Before we publish anything, we obtain separate, specific consent from that person and, where relevant, their parent or carer. We always do this away from the website. You can withdraw that consent at any time by contacting us.
6. Marketing Communications
We will only send you fundraising appeals, newsletters and other marketing by email or text message if you consent. Alternatively, we may contact you under the “soft opt-in” if you already support us and we gave you a clear chance to opt out when you gave us your details. The Privacy and Electronic Communications Regulations permit this.
You can opt out of marketing whenever you like. To do so, use the unsubscribe link in any email we send, or contact us using the details in Section 15. However, opting out will not stop service-related messages that we need to send you, for example about an Adult Services placement.
7. Who We Share Your Information With
We never sell your personal data. Furthermore, we share it only where necessary, and only with:
- Our staff and trustees, on a need-to-know basis, so that they can answer enquiries and deliver our services;
- Service providers who process data for us under contract, such as our website hosting and IT support provider, our email providers, and Cloudflare, which runs the Turnstile security check on our forms;
- JustGiving, when you choose to donate through the Donate link on this site;
- Local authorities, NHS bodies and other professionals involved in your care, or a family member’s care, where this helps us arrange or deliver support, or where the law requires it;
- Regulators, auditors and professional advisers, where the law requires it, or where we need to protect our legal rights;
- Any other organisation that the law requires us to share data with, such as HMRC for Gift Aid, or the Charity Commission.
8. Cookies and Similar Technologies
At the time of this review, this website sets only strictly necessary cookies. For example, WordPress uses cookies for core site functionality, and Cloudflare Turnstile sets cookies that help our forms tell genuine visitors from bots. Because these cookies are essential to the site working securely, the Privacy and Electronic Communications Regulations (PECR) do not require your consent for them.
We do not currently use analytics, advertising or social media tracking cookies. If we introduce any of these in future, for instance Google Analytics or a social media pixel, we will update this policy. We will also show a cookie banner so that you can accept or reject non-essential cookies first, as the law requires.
9. International Transfers
We aim to store and process personal data within the United Kingdom. Nevertheless, some of our service providers, such as Cloudflare and JustGiving, may process data on servers outside the UK, including in the United States or the European Economic Area. Where that happens, we rely on the safeguards that UK data protection law recognises. These include the UK’s international data transfer provisions, such as the UK Addendum to the EU Standard Contractual Clauses, or a provider’s membership of an approved data protection framework. As a result, your data keeps an appropriate level of protection.
10. How Long We Keep Your Information
We keep personal data only for as long as we need it. In addition, we follow our data retention policy and any legal, accounting or safeguarding duties. As a guide:
- General enquiries that lead to no further contact usually stay with us for up to 24 months;
- Records about Adult Services or School admissions enquiries follow our care and education record-keeping duties, which can require longer;
- Fundraising and Gift Aid records stay with us for as long as HMRC and charity accounting rules require, currently at least six years;
- Finally, we usually delete recruitment records for unsuccessful applicants after 12 months.
11. Keeping Your Information Secure
We use appropriate technical and organisational measures to protect your personal data from unauthorised access, alteration, disclosure or destruction. For example, we use secure website hosting, access controls and regular staff training. We also choose reputable third-party providers, who must meet data protection duties themselves. No method of transmission over the internet is completely secure, but we work to protect your information at every stage.
12. Your Rights
Under UK data protection law, you have the right to:
- Be informed about how we use your personal data, as this policy sets out;
- Access a copy of the personal data we hold about you;
- Ask us to correct data that is inaccurate or incomplete;
- Request erasure of your data, in certain circumstances;
- Tell us to restrict how we use your data, in certain circumstances;
- Object to how we use your data, including for direct marketing, where we rely on legitimate interests;
- Ask us to send data you gave us to you, or to another organisation, in a portable format where this is technically feasible;
- Withdraw your consent whenever you like, where we rely on consent. This does not affect anything we did lawfully beforehand.
To use any of these rights, please contact us using the details in Section 15. We will then reply within one month, as the law requires. First, though, we may need to verify your identity.
13. Automated Decision-Making
We do not make decisions about you by solely automated means, without any human involvement, where those decisions would have a legal or similarly significant effect on you.
14. Changes to This Policy
We may update this policy from time to time, for example to reflect changes in the law or in how our website works. Whenever we do, we will post the changes on this page and update the “last reviewed” date above. So please check back here now and then.
15. How to Contact Us
Do you have questions about this policy, or do you want to use any of your rights? If so, please contact us:
- By email: info@pacessheffield.org.uk
- By phone: 0114 551 0400
- By post: Paces Sheffield, Unit 4, Smithy Wood Business Park, Sheffield, S35 1QN
If our response does not satisfy you, or if you believe we have not handled your personal data lawfully, you can complain to the UK’s data protection regulator:
- Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
- Helpline: 0303 123 1113
- Website: ico.org.uk/make-a-complaint
First, though, we would welcome the chance to put things right ourselves.
