Website Privacy and Cookie Policy

Last updated: 12 July 2026

1. About this policy

This policy explains how the Norfolk Autism Partnership uses personal information collected through its public website.

It applies to:

• people visiting our website;

• people completing a website form;

• people contacting us;

• people applying for a position or opportunity;

• people submitting information about an event;

• people making a complaint or giving feedback;

• people registering an interest in training or other activities.

Registered members of the Norfolk Autism Partnership Board should also read our separate Member Privacy Notice.

2. Who is responsible for your information?

The Norfolk Autism Partnership is facilitated by ASD Helping Hands.

ASD Helping Hands is responsible for looking after the personal information used to operate the Norfolk Autism Partnership website and systems.

Our contact details are:

Norfolk Autism Partnership
c/o ASD Helping Hands
Assembly Rooms
Ruthen Place
Dereham
Norfolk
NR19 2TX

Email: contact@norfolkautismpartnership.org.uk

Telephone: 01362 685860

ASD Helping Hands charity number: 1175729

3. Information we may collect

The information we collect depends on how you use the website.

It may include:

• your name;

• your email address;

• your telephone number;

• your postal address;

• your organisation;

• your job title or role;

• information you enter into a form;

• information about an event;

• information included in a complaint or comment;

• your communication or accessibility needs;

• your consent choices;

• your IP address;

• your browser and device type;

• the pages you visit;

• website security information;

• your cookie choices.

Please only provide information that is relevant to your enquiry or request.

4. Information about another person

You may sometimes give us information about another person.

For example, you may contact us on behalf of someone you support.

You should make sure:

• they know you are contacting us;

• you have their permission to share their information; or

• there is another lawful and appropriate reason for doing so.

5. Sensitive personal information

Some enquiries or forms may include sensitive information.

This could include information about:

• autism;

• disability;

• physical health;

• mental health;

• wellbeing;

• communication needs;

• accessibility requirements;

• support needs.

Data protection law calls some of this information special-category data.

It is given additional protection.

We only collect and use sensitive information when it is relevant and necessary.

6. How we collect information

We may collect information:

• when you complete a website form;

• when you email us;

• when you telephone us;

• when you write to us;

• when you register for an activity;

• when you submit information about an event;

• when you make a complaint;

• when you give feedback;

• automatically through website security tools;

• through non-essential cookies where you have agreed to them.

7. Why we use your information

We may use your information to:

• answer your enquiry;

• provide information or support;

• manage an application;

• contact you about an opportunity;

• manage event submissions;

• administer training or other activities;

• respond to complaints or feedback;

• arrange reasonable adjustments;

• maintain records of our work;

• improve the website;

• understand how the website is used;

• prevent spam, fraud or misuse;

• keep the website secure;

• meet legal and regulatory responsibilities.

We will not use your information for an unrelated purpose without first considering whether we need to tell you or obtain your consent.

8. Our lawful reasons for using information

Data protection law requires us to have a lawful reason for using personal information.

Different lawful reasons may apply to different uses of your information.

Legitimate interests

We normally rely on legitimate interests when it is reasonably necessary to:

• respond to enquiries;

• operate the Norfolk Autism Partnership;

• manage opportunities and activities;

• maintain appropriate records;

• improve our services;

• protect our website and systems.

Our legitimate interest is the effective and secure operation of the Norfolk Autism Partnership.

We consider the possible effect on your rights and privacy before relying on this basis.

Consent

We may rely on your consent when:

• you choose to receive an optional communication;

• you provide optional sensitive information;

• you agree to non-essential cookies;

• you ask us to use your information for a particular purpose.

You can withdraw your consent at any time.

Withdrawing consent does not make earlier use of your information unlawful.

Contract

We may use information where it is necessary to:

• provide something you have requested;

• manage an agreement with you;

• take steps before entering into an agreement.

Legal obligation

We may use or keep information when the law requires us to do so.

This may include:

• financial records;

• charity records;

• tax records;

• responding to a lawful request;

• protecting legal rights.

Vital interests

In a serious emergency, we may use or share information where this is necessary to protect someone’s life.

9. Health, disability and accessibility information

Health, disability and autism-related information is normally special-category data.

Where you voluntarily provide this information to request support or an adjustment, we will normally rely on:

• legitimate interests as our ordinary lawful basis; and

• explicit consent as our special-category condition.

You may be asked to confirm:

I explicitly consent to the Norfolk Autism Partnership and ASD Helping Hands using the health, disability, accessibility or communication information I have provided to respond to my request and arrange appropriate support.

Providing detailed health information is optional unless it is genuinely needed to provide the service or support you have requested.

You may withdraw your consent.

If you withdraw consent, we may no longer be able to use the information to provide a particular adjustment or form of support.

We may continue to keep limited records where there is another lawful reason, such as a legal requirement or an ongoing complaint.

10. Emergencies and serious concerns

In a serious emergency, we may use or share relevant sensitive information where it is necessary to protect someone’s life.

Where information relates to a safeguarding concern, serious risk, legal claim or legal duty, we may need to use another lawful condition provided by UK data protection law.

We will only do this where it is necessary and proportionate.

11. Who we may share information with

We do not sell personal information.

Where necessary, we may share relevant information with:

• authorised ASD Helping Hands staff;

• authorised Norfolk Autism Partnership administrators;

• the person responsible for responding to your enquiry;

• an event, training or activity organiser;

• website hosting providers;

• website developers and technical support providers;

• email providers;

• form and database providers;

• website security providers;

• professional advisers;

• insurers;

• regulators;

• courts;

• police or emergency services;

• public authorities where disclosure is required or permitted by law.

We only share the information needed for the relevant purpose.

Organisations providing services to us must protect personal information and must not use it for their own unrelated purposes.

12. Automated decisions

We do not use information collected through the public website to make decisions about you solely by automated means where those decisions would have a legal or similarly significant effect.

13. International data transfers

Some website, email, database or technical service providers may process information outside the United Kingdom.

Where this happens, we take steps to make sure the information remains protected.

Safeguards may include:

• processing in a country approved by the UK government;

• approved contractual clauses;

• the UK International Data Transfer Agreement;

• the UK Addendum to approved contractual clauses;

• another safeguard permitted under UK data protection law.

14. How long we keep information

We only keep personal information for as long as it is needed.

Our usual retention periods are set out below.

General enquiries

Normally kept for up to two years after the enquiry has been closed.

Complaints and formal concerns

Normally kept for up to six years after the matter has been closed.

Information may be retained for longer where there is an ongoing legal, safeguarding or regulatory reason.

Applications and opportunities

Unsuccessful applications are normally kept for up to 12 months after the application process ends.

If a person takes up a role, relevant information may become part of their membership, volunteer or other organisational record.

Event submissions

Normally kept for up to two years after the event.

Information published as part of a public event listing may remain in archived website records.

Training and activity records

Normally kept for up to six years where the information forms part of an administrative, contractual or financial record.

Accessibility and support information

Normally kept only while it is needed to provide the requested support.

It will usually be deleted within six months after the activity, enquiry or support arrangement ends, unless:

• you ask us to keep it for future activities;

• it forms part of an ongoing complaint or concern;

• there is another lawful reason to retain it.

Website security logs

Normally kept for up to 12 months.

Information may be retained longer where it is needed to investigate a security incident.

Cookie consent records

Normally kept for up to two years after your last recorded cookie choice.

Financial records

Financial and accounting records are normally kept for at least six years after the end of the relevant financial year.

Website backups

Backup copies are normally overwritten within 90 days.

Information may remain in a secure backup for a short period after it has been removed from the live system.

15. Deleting and anonymising information

When information is no longer needed, we may:

• securely delete it;

• remove identifying details;

• combine it with other information;

• keep it in an anonymised form for reporting or historical purposes.

Information that has been properly anonymised is no longer personal information because it cannot be linked back to an individual.

16. How we protect information

We use reasonable organisational and technical measures to protect information.

These may include:

• secure website connections;

• passwords;

• restricted staff access;

• role-based permissions;

• software updates;

• security tools;

• spam protection;

• security logs;

• backups;

• staff procedures;

• contracts with service providers;

• reviewing access when roles change.

No website or computer system can be guaranteed to be completely secure.

If a personal data breach occurs, we will assess it and notify affected people and the Information Commissioner’s Office where required.

17. Your rights

Depending on the circumstances, you may have the right to:

• be told how your information is used;

• ask what information we hold about you;

• receive a copy of your information;

• correct inaccurate or incomplete information;

• ask us to delete information;

• ask us to restrict how information is used;

• object to some uses of your information;

• withdraw consent;

• receive certain information in a portable format;

• complain about how your information is used.

These rights do not apply in every situation.

For example, we may need to keep some information to meet a legal requirement or maintain financial records.

18. Making a data protection request

To make a request, contact:

Email: contact@norfolkautismpartnership.org.uk

Telephone: 01362 685860

Post:

Norfolk Autism Partnership
c/o ASD Helping Hands
Assembly Rooms
Ruthen Place
Dereham
Norfolk
NR19 2TX

Please tell us:

• your name;

• what you are asking for;

• how we can contact you.

We may ask you to confirm your identity.

We normally respond within one month.

19. Complaints

Please contact us first if you are unhappy with how your information has been used.

You can also complain to the Information Commissioner’s Office.

The Information Commissioner’s Office is the UK’s independent data protection regulator.

Website: www.ico.org.uk

Telephone: 0303 123 1113

Cookie information

20. What are cookies?

Cookies are small files stored on your device when you visit a website.

They can help the website:

• work properly;

• remember your choices;

• keep accounts secure;

• protect forms;

• understand how the website is used.

Similar technologies, such as local storage, may perform related functions.

21. Essential cookies

Essential cookies are needed for the website to operate.

They may be used for:

• website security;

• member logins;

• form protection;

• maintaining a website session;

• remembering your cookie choices.

Essential cookies do not normally require consent.

Some parts of the website may not work if you block them.

22. Analytics cookies

We may use analytics tools to understand:

• how many people visit the website;

• which pages are viewed;

• what devices and browsers are used;

• how visitors move through the website;

• whether website errors occur.

Analytics helps us improve the website.

Where required, analytics cookies will only be used after you agree to them.

23. Third-party content

Some pages may include content or services provided by another organisation.

This could include:

• videos;

• maps;

• social media content;

• calendars;

• external forms;

• event or booking services.

These providers may use their own cookies or collect technical information.

Non-essential third-party content should only load after the appropriate cookie choice has been made.

24. Managing cookies

You can manage cookies using:

• the cookie controls on our website;

• your browser settings.

You can delete existing cookies or block future cookies.

Blocking some cookies may affect how the website works.

25. Links to other websites

Our website may contain links to websites operated by other organisations.

Those organisations are responsible for their own websites, security and privacy practices.

You should read their privacy information before providing personal information.

26. Changes to this policy

We may update this policy when:

• our website changes;

• we introduce a new form or service;

• we use a new provider;

• legal requirements change;

• we need to explain something more clearly.

The latest version will be published on this page.