Privacy Notice

For the purpose of the Data Protection Act 1998 our data controller is Little Sandbox.

Preservation of your privacy is important to Little Sandbox and we are committed to letting you know how we use your personal information and to making only responsible use of your data.

References to “we”, “us”, “you” or “our” in this Privacy Policy are references to Little Sandbox, registered company number: 7358305. Little Sandbox takes your privacy seriously. Your personal information will not be sold or otherwise distributed to third parties without your consent. Little Sandbox is not a source of unsolicited  e-mail.

What Our Privacy Notice Covers

  • What information we collect from you and our lawful bases
  • Why we collect this information
  • Who might we share your information with
  • What do we do with your information
  • How long do we keep hold of your information
  • How you can access the information we hold about you


This policy does not cover the practices of companies other than Little Sandbox or people who are not employed or managed by Little Sandbox.

What Information do we collect from you?

We process the personal data of individuals, which includes:

  • names
  • addresses
  • telephone numbers
  • email addresses
  • financial details
  • family/emergency contact details
  • visual images
  • behaviour

We also process sensitive personal data, or ‘special categories’ of data, which includes:

  • physical or mental health details
  • racial or ethnic origin

Why does Little Sandbox need to collect and store personal data?

Little Sandbox undertakes a number of activities including:

  • Provision of youth work and child care services
  • Education and Training
  • Marketing, fundraising, campaigning and consultation
  • Monitoring, evaluation and audit of service provision
  • Staff, trustee and volunteer recruitment

In order for us to undertake the above we need to collect personal data from you for either correspondence purposes or detailed service provision, depending on the service you are accessing.

We have reviewed the purposes of our processing activities, and selected the most appropriate lawful basis for each activity.  We believe that in order to achieve our duties and social objectives we have a legitimate interest to process the data for its relevant purpose, and are satisfied that there is no other reasonable way to achieve that purpose.

The basis of our legitimate interest is;

  • Our use of your personal information is necessary to carry out a contract or take steps to enter into a contract with you
  • We need to process your personal information to comply with relevant legal or regulatory obligations, which may include submitting reports to the authorities or government departments. All data is anonymised for the purpose of reporting.

Our aim is not to be intrusive and we undertake not to ask irrelevant or unnecessary questions.

Who might we share your information with? 

If we need to pass sensitive identifiable data on to any third parties we will only do so where there is a service need and once we have obtained your explicit consent.  In certain circumstances we will share your information without prior consent if we are legally required to do so, those circumstances are as follows;

  1. We receive a subpoena, court order or other legal demand for your information.
  2. We believe it is necessary to share information in order to investigate, prevent or take action regarding illegal activities, suspected fraud, to safeguard yourself or others, or as otherwise required by law.
  3. Little Sandbox is acquired by or merged with another company. In this event Little Sandbox will notify you before your information is transferred and becomes subject to a different privacy policy.
  4. Some of our services allow you to make certain information public or accessible to certain individuals. If you make use of these services Little Sandbox will share your information as you request.
  5. For the purpose of creating a mailing list to contact parents and members about important notices regarding their membership, we use Mailchimp software. Email addresses, names and the registered club are the only details stored on our mailchimp account.
  6. Through our online subscription service or our shop, your details may also be stored by Stripe or Paypal, which handles our online card payments.

What do we do with your information? 

The information that we collect and store relating to you is primarily used to enable us to provide our services to you, but we may also use this information to help us to improve our services to you.

We will use this information to enable us to offer you appropriate services, to keep you informed of Little Sandbox news and developments, and to seek feedback to monitor and evaluate our services.

How long do we keep hold of your information?

We will endeavour to keep your information accurate and up to date and not keep it for longer than is necessary. Once you no longer need our services we have to keep records for a certain amount of time depending on the type of data that we hold. After this time we will securely destroy it according to our records retention and disposal procedures.  Please contact us for further information on our retention periods.


How you can access the information we hold about you

The Data Protection Act 1998 gives you the right to access the information that we hold about you. Should you wish to receive details on information that we hold about you please contact us via the address below to request and complete our Data Subject Access Request Form.  We have to respond within 40 days of receiving all the relevant information needed to deal with your request. We reserve the right to charge £10 per request but may waive this fee in exceptional circumstances or for basic requests.

 How we keep your personal information safe

We take appropriate measures to secure your personal information and protect it against unauthorised or unlawful processing, as well as against its accidental loss, destruction or damage, including:

  • using secure servers to store your personal information
  • using Secure Sockets Layer (SSL) software or other similar encryption technologies to encrypt confidential data in transit and at rest
  • verifying the identity of individuals that access your personal information
  • providing access to the minimum personal data necessary, using appropriate restrictions and making the data anonymous or unidentifiable whenever possible
  • using secured storage to store your personal information in media other than electronic

 What happens if Little Sandbox makes a change to this policy?

If Little Sandbox intends to make a change to our privacy policy we will post a notice on our website and we will also notify you by e-mail.

How to unsubscribe

If no longer wish to receive updates on the services that we offer you can unsubscribe by clicking the link in the footer of our emails.

If you would like us to correct or update any information, or if you would like information deleted from our records, then please email us at

Other information 

What are cookies and why do we use them?

Cookies are a standard Internet technology, and many major web sites use them to provide useful features for their members. Cookies allow us to store and retrieve login and other information on a user’s system. They provide us with data that we can use to improve our service to you. Cookies themselves do not personally identify users, although they do identify a user’s computer. You will be asked if you choose to accept the cookies. If you choose not to accept cookies you will not be able to take full advantage of the Little Sandbox website.

How you can contact us

If you have any question or concern on how we collect, handle, store or secure your personal information, contact our Data Protection Officer:

Data Protection Officer
Little Sandbox
5 Brasenose Road
L9 0JW

Telephone: 0151 922 9483



You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

Information Commissioner’s Office
Wycliffe House
Water Lane

Telephone: 0303 123 1113


Retention Periods

Record Retention Period
Staff employment records 6 years after employment ceases to cover the time limit for any civil legal actions including contractual claims
Application forms/interview notes for unsuccessful candidates 1 year
Trustee and Volunteer records 6 years after involvement with Little Sandbox ends to cover the time limit for any civil legal actions including contractual claims
Financial records 7 years after a project ends to cover the time limit for any civil legal actions including contractual claims, unless otherwise specified by a funder.
Disclosure & Barring Service (DBS) Disclosures No more than 6 months, unless in very exceptional circumstances it is considered necessary to keep certificate information for longer. In these cases, Little Sandbox will consult with the Disclosure & Barring Service and will give full consideration to the Data Protection and Human Rights of the individual before doing so.
Health and Safety consultations including records relating to safeguarding issues and risk assessments. Permanently (based on government guidance from Business Link)
Minutes of Trustee meetings and Annual General Meetings;

Annual Reports;

Little Sandbox publicity and information materials;

Any other non-confidential Little Sandbox documents.

Permanently – to be deposited yearly with Liverpool Records Office as part of the Local Deposit Agreement.