Future Dreams

Privacy Notice for Visitors: Updated Sep 2026

Legal framework

This privacy notice has been prepared in line with the following legal framework:

• UK General Data Protection Regulation (UK GDPR)
• Data Protection Act 2018
• Data (Use and Access) Act 2025
• Privacy and Electronic Communications Regulations 2003 (PECR)

Future Dreams is committed to maintaining the accuracy, confidentiality and security of the personal information it handles. We only collect and use personal information where we have a lawful reason to do so and where it is necessary for our services, safety, governance, legal compliance or legitimate charitable purposes.

1. Who we are

Future Dreams (“FD”, “we”, “us” or “our”) is the data controller for personal information we process about visitors and service users, unless we tell you otherwise.

Registered office for legal notices: 73 Cornhill, London, EC3V 3QQ

Operational address: Future Dreams House, 61 Birkenhead Street, London WC1H 8BB

Registered charity number: 1123526

Contact for privacy matters: Data Protection Lead – [email protected]

Please use [email protected] as the main route for privacy requests and data protection complaints, as this helps us respond promptly. You may also write to either postal address above and mark the envelope “FAO: Data Protection Lead”.

2. Scope of this notice

This notice explains how we collect, use, share and keep personal information relating to your use of Future Dreams House and our services, including services provided in person, online, by telephone or by video.

Separate privacy notices may apply to staff, volunteers, donors, corporate supporters, website users and job applicants. If you fall into more than one category, more than one privacy notice may apply to you.

3. What personal information we collect

We collect the minimum personal information needed to provide services, keep people safe, manage our charity, monitor quality and comply with our legal and governance obligations. Depending on the service, this may include:

• Identification and contact details, such as your name, date of birth, address, email address and telephone number.
• Emergency contact details, where you choose to provide them or where they are needed for safety reasons.
• Health information relevant to the service or support you receive, such as diagnosis, relevant treatment information, GP’s contact details, wellbeing needs, accessibility needs and any information needed for risk assessment or safe participation.
• Therapy, clinical, support or service notes, where these are created by Future Dreams staff or by practitioners acting on our behalf.
• Risk assessments, safeguarding records and incident records, where relevant.
• Equality, diversity and inclusion information, such as ethnicity, religion or other demographic information, where we ask for it. This is optional unless we clearly explain otherwise.
• Booking, attendance, service-use, outcome, feedback and survey information.
• Payment and transaction information where paid services apply. We use payment providers and do not store full card details.
• Email and newsletter preferences and, where relevant, delivery and engagement information such as opens and clicks.
• CCTV footage captured in designated areas of Future Dreams House for security and safety purposes.

We may collect information directly from you, from online booking or enquiry forms, from staff or practitioners involved in providing services, or from another professional involved in your care where you have asked or agreed that they may share information with us. In safeguarding, emergency or serious risk situations, we may collect, use or share information without consent where the law allows or requires this.

Wherever possible, we analyse feedback, outcomes and service data in anonymised or aggregated form so that individuals cannot be identified.

4. How and why we use your information

We must have a lawful basis under Article 6 UK GDPR for each use of personal information. Where we process special category data, such as health information, we must also identify an Article 9 condition and, where required, meet the additional safeguards under the Data Protection Act 2018.

In some cases, the Data (Use and Access) Act 2025 allows organisations to rely on recognised legitimate interests for specified purposes, such as safeguarding vulnerable individuals, responding to emergencies, security and crime prevention. Where recognised legitimate interests apply, the usual legitimate interests balancing test is not required. This does not remove our wider UK GDPR duties, including transparency, data minimisation, security, retention and respect for individual rights.

The table below summarises the main purposes and lawful bases we rely on. The precise basis may vary depending on the service, the type of information and the circumstances.

We will tell you when information is required and what may happen if you choose not to provide it. Where we rely on consent, you may withdraw your consent at any time, but this will not affect processing that has already taken place.

5. Independent practitioners and professional records

Some services may be delivered by independent practitioners or professionals. Future Dreams is the controller for information it collects and uses for registration, booking, service coordination, safeguarding, complaints, payments and charity administration.

Where an independent practitioner creates and holds their own professional, therapy or clinical records, they may be a separate data controller for those records. Where this applies, they should provide you with their own privacy information and you may need to contact them directly to exercise rights relating to records they hold independently.

6. Who we share information with

We share personal information only where necessary, lawful and proportionate, and with appropriate safeguards. This may include sharing information with:

• Professionals involved in your care or support, such as your GP, NHS or hospital clinical team, independent practitioners or therapists, where you have agreed this or where the law allows or requires it.
• Safeguarding agencies, local authority safeguarding teams, emergency services or the police where necessary to protect you or others from harm, prevent crime or respond to an emergency.
• Our contracted service providers, such as secure booking systems, CRM systems, email and IT support, cloud hosting, payment providers, CCTV/security providers and professional advisers. We put written contracts or appropriate safeguards in place where required.
• Funders, partners or commissioners where this is necessary for reporting and accountability. We use anonymised or aggregated data wherever possible.
• Regulators, statutory authorities, NHS bodies, auditors, insurers, legal advisers or accountants where required or appropriate.
• Other parties where required by law, court order, insurance requirements or legal proceedings.

We do not sell personal information.

7. International transfers

Some suppliers may process personal information outside the UK or European Economic Area, for example where cloud, email, CRM or software support services are hosted internationally. Where this happens, we use appropriate safeguards and transfer mechanisms required by data protection law.

These may include adequacy regulations, the UK-US Data Bridge for certified US organisations, the UK International Data Transfer Agreement, EU Standard Contractual Clauses with the UK Addendum, approved Binding Corporate Rules, or other lawful safeguards. We may also use limited derogations where strictly applicable, such as explicit consent or important reasons of public interest.

Personal data is only transferred internationally where the level of protection for your information is not materially lower than that required under UK data protection law, in accordance with the Data (Use and Access) Act 2025.

8. Marketing, newsletters and surveys

We will only send you electronic marketing, fundraising or newsletter communications where we have your consent or where we are permitted to do so under PECR, including the charitable purposes soft opt-in where applicable.

Where we rely on charitable purposes soft opt-in, we will only do so where the legal requirements are met. This includes giving you a clear opportunity to opt out when we collect your details and in every marketing message. We will consider carefully whether it is appropriate to rely on soft opt-in for people accessing support services, particularly where someone may be vulnerable or at risk of harm.

We will only rely on the charitable purposes soft opt-in where Future Dreams has collected your contact details directly and the other legal requirements are met. We will not assume that soft opt-in applies to contact details collected by third parties, partner organisations, external fundraisers, platforms, or any connected trading entity, unless we have checked that the legal conditions are satisfied.

Where you access support services, we will not use your health information, diagnosis, service attendance or support needs as the reason for sending you fundraising or marketing communications. We will only send electronic marketing, fundraising or newsletter communications where PECR allows this, and we will always give you a clear and simple way to opt out.

You can opt out of marketing at any time by using the unsubscribe link in our messages or by contacting us at [email protected].

Invitations to surveys are optional. You can choose whether to take part and, where possible, we analyse survey and outcome information in anonymised or aggregated form.

9. Automated decision-making

We do not currently make significant decisions about you based solely on automated processing, within the meaning of Articles 22A–22D of the UK GDPR (as amended by the Data (Use and Access) Act 2025), that produce legal effects or similarly significant consequences for you.

If we introduce any automated decision-making of this kind in the future, we will, in accordance with Articles 22A–22D:

• inform you about the decision and how it is made;
• provide meaningful information about the logic involved where required;
• enable you to make representations or challenge the decision;
• ensure human review is available; and
• comply with any further safeguards required by data protection law.

10. CCTV at Future Dreams House

CCTV operates in designated areas of Future Dreams House for security, safety and crime prevention. Signage is in place. CCTV is not used in areas where visitors would reasonably expect privacy.

Footage is reviewed only by authorised staff, contractors or advisers where necessary, and may be disclosed to law enforcement, insurers, legal advisers or other relevant parties where necessary and lawful. CCTV footage is retained in accordance with the organisation’s CCTV Policy and is automatically overwritten unless required for an incident, investigation, insurance matter or legal proceedings.

11. How long we keep information

We keep personal information only for as long as necessary for the purposes described in this notice and to comply with legal, regulatory, safeguarding, insurance, professional and governance requirements. Typical retention periods are:

• Therapy, clinical and support records: normally 7 years from last contact, unless a shorter period is appropriate for the nature of the record or a longer period is required for safeguarding, serious incidents, insurance, legal, regulatory or professional reasons.
• Safeguarding, risk and serious incident records: retained for as long as necessary in light of the nature of the concern, potential legal claims, safeguarding duties and insurance requirements.
• Booking and financial records: normally 7 years from the end of the financial year to which they relate.
• CCTV footage: CCTV footage is retained for varying periods depending on the camera and system configuration (currently approximately 11 days for the internal camera and 29 days for the external camera) and is automatically overwritten unless required for an incident, investigation, insurance matter or legal proceedings.
• Surveys and service-evaluation data: raw identifiable responses are normally retained for 12 months, unless a different project-specific period applies. Aggregated, anonymised or non-identifiable statistics may be kept longer.
• Marketing preferences: retained until you opt out, your email bounces permanently, or the information is no longer needed to manage preferences.

If we anonymise information so that it can no longer identify you, we may keep it for research, statistics, reporting, service improvement and charitable impact purposes.

12. Security

We use appropriate technical and organisational measures to protect personal information. These include role-based access controls, password and account security, encryption where supported, staff training, confidentiality requirements, secure disposal, supplier due diligence and written contracts with providers where required.

We limit access to personal information to staff, volunteers, practitioners, trustees, advisers and suppliers who need it for their role or service. We also require our suppliers to protect information appropriately.

13. Your rights

You have rights over your personal information. These rights are not absolute and may depend on the lawful basis, the type of information and the circumstances. Your rights include the right to:

• Access a copy of your personal information. We will make reasonable and proportionate searches to locate your information.
• Ask us to correct inaccurate or incomplete information.
• Ask us to delete information in certain circumstances.
• Ask us to restrict processing in certain circumstances.
• Object to processing based on legitimate interests or recognised legitimate interests, and an absolute right to object to direct marketing.
• Ask for data portability where the processing is based on consent or contract and carried out by automated means.
• Withdraw consent at any time where we rely on consent. This will not affect processing already carried out before withdrawal.
• Complain to the Information Commissioner’s Office (ICO) – which is in the process of being reconstituted as the Information Commission under the Data (Use and Access) Act 2025 – if you are unhappy with how we handle your personal information or your rights request.

We normally respond to rights requests within one month.

We do not usually charge a fee unless a request is manifestly unfounded or excessive. If a request is complex or you make multiple requests, we may extend the response period by up to two further months and will tell you why.

Where we reasonably need information to verify your identity, the response period will not begin until we have received the information we need. Where we reasonably need clarification to understand the request, the response period may pause until clarification is received.

14. How to exercise your rights or update your details

Please contact the Data Protection Lead at [email protected]. You can also write to either address in Section 1 and mark your envelope “FAO: Data Protection Lead”.

We may ask for information to verify your identity. For therapy, clinical or support records, we may consult the relevant practitioner or professional to ensure disclosures are accurate, safe, lawful and do not unfairly reveal information about third parties. If an independent practitioner holds their own records as a separate controller, you may need to contact that practitioner directly.

15. Data protection complaints and concerns

From 19^th June 2026, under section 164A of the Data Protection Act 2018, you have a statutory right to raise a data protection complaint directly with Future Dreams as the data controller.

If you have concerns about how we handle your personal information, you can raise a data protection complaint with us at any time, by any means. We accept complaints regardless of how they are submitted – including by email, post, telephone, our Data Protection Complaints Form, or any other channel. Our Data Protection Complaints Form is available on request and, where available, via our website. You do not have to use the form, but it may help us gather the information needed to investigate your complaint efficiently. You do not need to use a specific form for us to consider your complaint.

Contact details for data protection complaints:

Online form: Future Dreams Data Protection Complaint Form – Fill in form

Email: [email protected]

Post: Data Protection Lead, Future Dreams, Future Dreams House, 61 Birkenhead Street, London WC1H 8BB

Post: Data Protection Lead, Future Dreams, 73 Cornhill, London EC3V 3QQ

We will:

• Acknowledge your complaint within 30 calendar days of receiving it.
• Make appropriate enquiries and investigate your concern without undue delay.
• Keep you informed of progress where appropriate.
• Tell you the outcome and any action taken, where appropriate.
• Maintain records of data protection complaints and how they were resolved.

You also have the right to complain directly to the Information Commissioner’s Office (ICO) – which is in the process of being reconstituted as the Information Commission under the Data (Use and Access) Act 2025 – at any time. You do not need to wait for our response or exhaust our internal process first, although we welcome the opportunity to resolve concerns directly.

Website: ico.org.uk

Telephone: 0303 123 1113

Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

16. Changes to this notice

We may update this notice to reflect changes in our services, systems, suppliers, legal requirements or regulatory guidance. We will make the latest version available on our website and, where appropriate, notify you directly of significant changes.

Appendix: examples of data collected by channel