IRM Cymru and Children in Wales are committed to protecting your personal data. We will only send you information if we have your consent and we will never sell or share your information to marketing companies.
IRM and Children in Wales will always process your personal data lawfully and be fair and transparent in how we do this. This Privacy Policy tells you how, we collect and store your data, why we need it and what we do with it.
If you have any questions or concerns regarding our Privacy Policy, the information you receive or the information we store, please contact:
The Data Protection Lead
Children in Wales
21 Windsor Place
Cardiff
CF10 3BY
Email: info@childreninwales.org.uk
Phone: 029 2034 2434
IRM (Independent Review Mechanism) Cymru offers an independent review panel process if your fostering or adoption agency is proposing not to approve you or to terminate your approval, or if you are a foster carer and your agency is proposing to change your terms of approval without your agreement.
IRM is hosted by Children in Wales. Children in Wales is the national umbrella body for organisations and individuals who work with children, young people and their families. Children in Wales is a registered charity (1020313) and a company limited by guarantee (2805996). You can find out more about Children in Wales by visiting their website (hyperlink http://www.childreninwales.org.uk/ )
We recommend that you also read Children in Wales’ Privacy Policy (insert hyperlink)
As an independent review mechanism, IRM will only process information that you have provided or have agreed to us obtaining. This will always include your name, address and contact details.
In order for our panel to review your agency’s proposed decision, we will also need access to the same information used by your agency. This is likely to include information on your personal circumstances and medical records.
We will only collect and process this information if you have given your consent and will always process it lawfully and securely.
IRM Cymru is hosted and managed by Children in Wales. Under the Data Protection Act 2018, Children in Wales acts as the Data Controller for IRM and has overall responsibility for the processing and security of your personal information.
IRM is a Data Processor, which means that they collect and process your information. Both Children in Wales and IRM are allowed to do this as long as we have a valid, lawful reason for doing so.
The Independent Review Mechanism is a voluntary process, instigated by you. This means that at all stages of the process, we will need your consent to obtain and process your personal information. You can withdraw your consent at any time during the process. Should you withdraw your consent, the review process will cease as we will no longer have your permission to continue.
· Assess the suitability of your application. This is in our legitimate interests to allow us to assess the suitability or your review request.
· Review your agency’s decision. We will rely on your consent to legally obtain and process your personal data. In order to review your agency’s decision, we ask for your consent to obtain all relevant records and personal data held by your agency. You can withdraw your consent at any time (see the What are your rights section below). We will rely on your written consent to legally process your personal data.
· Record your confidentiality agreements. This is in our legitimate interests to ensure that all disclosed information relating to an individual review remain confidential.
· Provide you with information regarding the date, venue and time of the panel meeting. This processing is necessary for the performance of the independent review mechanism.
· Provide you with relevant information relating to the applicant’s request for an independent review of your agency’s decision. This processing is necessary for the performance of the independent review.
· Record timelines and communication history. This processing is necessary for the performance of the independent review and ensures that all relevant and up to date information is available to the review panel.
Under the Data Protection Act 2018, Children in Wales is the 'data controller' in respect of the personal information that we hold about you. This means that Children in Wales is responsible for keeping your personal information secure at all times and only use it in a way that you have agreed to. IRM act as the ‘data processor’ as they collect, process and use your data.
As an applicant, you request an independent review. This means that the initial personal information that we process is provided by you. Should your review progress, we will ask you to provide more information and complete a consent form. This consent form will allow IRM to obtain additional, relevant information needed to conduct the review.
As an applicant’s supporter, your contact details will be provided to us either directly from you or via the applicant you are supporting. We only process the information provided.
As a panel member, all of the personal information we process is provided by you or you have given your consent to allow IRM to obtain additional information. This may include references and conflicts of interests.
Your information is processed by IRM and stored at Children in Wales’ offices in Cardiff. We will only use your information if you have said we can and only in a way that you know about. We make sure that your information is kept safe and we regularly check to make sure we are doing this right.
We will not use your information to carry out automated decision making in relation to you and we never share or sell your information to marketing companies.
We do use cloud computing software to do our work, provided by Microsoft. Their data is processed in the UK. You can click here to see at which data centres.
Your personal information is shared with panel members involved in your review. This is necessary in order to conduct the independent review. All panel members sign a confidentiality agreement.
We will initially need to obtain basic personal data, which may include your name, address, phone number and email address.
Should your review progress, we will need additional information. This is likely to include medical and legal reports as well as all agency reports and documents relevant to the case. This information will be obtained from you and your agency. We will always gain your consent before requesting information from your agency and if applicable, other third parties.
We will keep your case files and all relevant documentation for a period of up to 18 months. After this time, all of your information is confidentially destroyed.
Under the Independent Review of Determinations (Adoption and Fostering (Wales)) Regulations 2010, we are required to keep minutes of panel meetings and the reasons for the recommendations. This information will be kept for a period of 5 years.
We never sell or share your information to marketing companies and we will never market any of our own services directly to you.
In order to conduct the independent review, we share personal information with the panel members, advisors and where applicable, your agency. All personal information is shared and stored securely.
Children in Wales is committed to keeping your personal information secure. When we need to destroy confidential, printed information, we do this securely through an external confidential shredding company, Taclus Confidential. If you would like further information on how they securely dispose of your information, click here
We are also required to publish an annual report. In this, all information is anonymised and presented as statistical information. This ensures that no individuals or cases are identified.
If a disclosure of child abuse is made, Children in Wales will pass on personal information to the appropriate organisation, which may include the Police or Social Services.
When you use the IRM website, the following information is automatically collected:
Your visit to our website will still remain anonymous as none of the data collected is linked to any personal information. We will only store and process personal data if you voluntarily provide personal details via an online form or enquiry. If you do this, we will only use your personal data for the purposes that you have provided it.
The website information collected is only used to assess popular pages and downloads and fix any problems with our server. This helps us to continually improve our website and your experience.
Our website may contain links to other websites. We have no control over other websites and are, therefore, not responsible for their content or their Privacy Policies. We advise that you read the Privacy Policies of other websites before you use them.
Cookies are small text files that are put onto your device when you visit a website. They usually collect and store the information that you provide. For example, your password or your address may already be typed in as the cookies on that website are remembering them.
IRM uses cookies on our website. Click here to view the IRM cookie policy.
Where invoices are paid via BACS (Bankers’ Automated Clearing Services), we process name, address, bank name, sort code number, account number and payment amount. This information is processed and stored securely by Children in Wales.
Click here to view BACS Privacy Policy https://www.bacs.co.uk/Pages/PrivacyPolicy.aspx
Under data protection law, you have a number of different rights relating to our use of your personal information. The law relating to when these rights apply, the exceptions to your rights and our obligations are complicated. As a result, we have only set out below a brief summary of your rights and our obligations. To view additional information about your rights, please visit the Information Commissioners Office (ICO)
· You have the right to ask IRM or Children in Wales whether we are processing your information.
· You have the right to see the personal information we hold about you. There is no charge for this and when requested, we will provide you with a copy of your personal data as soon as possible, but always within 28 days.
· You have the right to ask IRM or Children in Wales to rectify your personal data if it is inaccurate or incomplete.
· You have the right to have your personal data erased as long as:
- We no longer need this data in relation to the purpose for which it was obtained
Or;
- Our legal ground for processing your personal information was consent and you are now withdrawing your consent.
If the above does apply, IRM and Children in Wales must delete the personal information. Please note that you can withdraw your consent at any time, however, this means that IRM may not be able to conduct or progress your independent review.
· In some circumstances, you may have the right to ask us to provide you with an electronic copy of your personal information either for your own use or so that you can share it with a third party. Where this right applies, you can ask us to transmit your personal data directly to the third party.
· You have the right to object to us processing your personal data where:
- The basis for our processing is that we have a legitimate interest to do so, but you are adversely affected by us doing this
Or,
- We are using your personal information for the purposes of direct marketing.
Where this applies, you have the right to ask us to stop processing your personal information.
· You have the right to block processing of your personal information. If IRM or Children in Wales are required to restrict our processing of your information, we will be able to store it, but not use it. We can only retain enough information about you to ensure that the restriction is respected in the future.
Where our use of your personal data is based on your consent, you have the right to withdraw consent. Please note that should you wish to withdraw your consent, IRM may not be able to conduct or progress your independent review.
You can withdraw you consent in the following ways:
Email, phone or post your withdrawal of consent request to IRM:
IRM
Email: irm@childreninwales.org.uk
Phone: 029 2034 2434 (Monday – Friday, 9am – 5pm)
Post: IRM at Children in Wales, 21 Windsor Place, Cardiff, CF10 3BY
Once we have received notification that you wish to withdraw your consent, we will no longer process your information for the purposes that you originally agreed to. Please note, depending on our legal bases for processing your information, we may still process your data for different purposes.
· You can make a request to us to exercise any of the rights summarised above. You can do this by phone, post or email. Please see contact details at the top of the page.
· We will respond to your request within 28 days.
· IRM and Children in Wales may have the right to refuse to comply with your request. If this is the case, we will contact you within 28 days and explain our reasons.
· IRM and Children in Wales will not charge you for exercising your rights.
Email: irm@childreninwales.org.uk
Phone: 029 2034 2434 (Monday – Friday, 9am – 5pm)
Post: IRM at Children in Wales, 21 Windsor Place, Cardiff, CF10 3BY
If you wish to raise a complaint about how we have handled your personal data, our Complaints, Compliments and Suggestions Procedure can be found on our website.
If you are not happy with our response or believe we are not processing your personal data within the law, you can complain to the Information Commissioner’s Office (ICO). https://ico.org.uk/concerns/
If we make substantial changes to our Privacy Policy, we will post these on the homepage of our website. If any of these changes are significant or we decide to use your personal information in a different manner, we will contact you directly so that you can choose whether or not we can use your information in this new manner. You will always have an informed choice about how we use your personal information.
Our Privacy Policy is reviewed regularly. Last reviewed July 2021.