Privacy Policy

Link Maker Systems Limited ("we" or “us”) are committed to protecting and respecting your privacy.

This policy (together with our User Terms and Letter Swap User Terms, and any other documents referred to in this policy) sets out the basis on which any personal data we collect from you, that you provide to us, or that we collect from other sources about you, will be processed by us.

This policy applies where you use the “Link Maker” sites (including www.linkmaker.co.uk and www.letterswap.co.uk) (our site(s)), use our Services or communicate with us in relation to our site or our services, whether as a guest or a registered user. “Use” of our site or services includes accessing, browsing, registering to use, uploading content to, or downloading content from, or communicating via our site or via our services, communicating with us.

Responsibility for personal data

Our site and the services available using our site is a platform to enable organisations licensed to provide adoption or children’s social care services (such as a local authority, an adoption agency or an Independent Fostering Provider (which, together with those working on their behalf we refer to as an “Organisation”) or an individual registered with one of those Organisations, to upload and manage their own information, and to access information uploaded by others including via the community support network, or to exchange communications via Letter Swap. This includes:

For the Link Maker adoption and commissioning services:

For the Link Maker Letter Swap serivce:

For the Link Maker community support network:

We act as a processor (rather than a controller) in relation to personal data which is uploaded to the Link Maker site and where that personal data is accessed via the Link Maker site by Organisations for the purposes of the Link Maker adoption and commissioning services., and where you use Letter Swap. This means we act on behalf of the Organisations and their registered user individuals which upload to, and access information via Link Maker site for the purposes of using the Link Maker adoption and commissioning services., or where those users use Letter Swap. We do have obligations as a processor under the applicable data protection legislation, which we have reflected in this policy, and our Link Maker User Terms, the Letter Swap User Terms, and the Organisation Terms.

As an individual user, you, as the user uploading information to the Link Maker site or sending information via Letter Swap, are responsible for deciding what information to upload or send, how that personal data is used, and when it is updated or deleted.

Where you are an employee or representative of an Organisation, your Organisation will have its own obligations as a controller under the applicable data protection legislation. For example, it must comply with the data protection principles as set out in the General Data Protection Regulation (GDPR) as it applies in the UK. You can find out more about the GDPR here www.ico.org.uk. In particular, any information which you access, download or store about individuals which are using Link Maker as part of your adoption or commissioning service, must be handled and stored securely, must not be disclosed without authorisation, must only be used for the purposes of that adoption and commissioning service, and must not be stored for longer than is necessary for those purposes.

If you are an individual using our site as part of the adoption or commissioning services of the Organisation you are registered with, or your use of Letter Swap, the processing of your personal data will be governed by the privacy policy of the Organisation with which you are registered. You can ask your Organisation for a copy of their privacy policy at any time.

We act as a controller (which means that we are primarily responsible your personal data and make decisions about how that personal data is used) when:

It is important that you read this policy together with any other privacy policy or privacy notice we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This privacy policy supplements the other notices and is not intended to override them.

We have appointed a security officer who is responsible for overseeing questions in relation to this policy. If you have any questions about this policy, including any requests to exercise your legal rights, please contact the [email protected] using the details set out below.

Contact Details

Our full details are Link Maker Systems Limited. Our registered office at Alpha House, 159 High Street, Barnet, Hertfordshire EN5 5SU. If you want to contact us in relation to this policy, please contact the security officer by phone 0800 368 8549 or by email to [email protected].

Information we collect

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We collect personal data in two scenarios (1) where we use that personal data for our own purposes (where we act as a controller), and (2) where we process personal data on your behalf (where we act as a processor).

Information we may collect where we process personal data on behalf of an Organisation (where we act as a processor)

For Organisations

For an Organisation’s users of our Adoption and Commissioning Services:

For an Organisation’s users of Letter Swap:

• Worker data – The information we receive from users which work for an Organisation including contact details, name and job role. It also includes information which relates to such workers for example, audit information such as time and date changes are made on child or family cases or the time and date messages are sent to other users.

For Adopters and Foster Carers as part of our adoption and commissioning services:

Forusers of Letter Swap:

Information we receive from other sources

We may receive information about you from local authorities, registered adoption/fostering agencies which is used as part of the Link Maker adoption and commissioning services. or Letter Swap. For example, if you are an individual seeking to register to use the Link Maker site, we check the identity of all new users with the registered Organisation and share with such Organisations the information submitted by you for that purpose. By submitting such information to us, you authorise us to share such information for these purposes.

The Organisations which use our system may ask you for special categories of personal data, and criminal offence data, or share via the Link Maker site, family case data, or child case data which may contain such sensitive types of data. This type of data is only used by an Organisation for them to consider an individual’s suitability for placements. as part of their adoption and commissioning services. Special categories of personal data include details about your race or ethnicity, religious or philosophical beliefs, sexual orientation, and information about your health. Criminal offence data includes data in relation to criminal convictions and offences (including data about criminal allegations, proceedings or convictions) or linked to related security measures.

 

Information we collect where we use that personal data for our own purposes (where we act as a controller)

We may collect, use, store and transfer different kinds of personal data about you for our own purposes, which we have grouped together as follows:

If you fail to provide personal data

Where an Organisation requires specific information about an individual in order to make a placement assessment or decision, where we need to collect personal data by law, or the terms of a contract we have with you require it, and you fail to provide that data when requested, we may not be able to provide our services (for example, to provide you with access to our site and services). In this case, we may have to reject or cancel your account registration, but we will notify you if this is the case at the time.

Cookies

Our website uses cookies to distinguish you from other users of our website. This helps us to provide you with a good experience when you browse our website and also allows us to improve our site. For detailed information on the cookies we use and the purposes for which we use them see our Cookie Policy.

How your personal data is collected (where we process information for your Organisation as a processor)

Where we are providing our adoption and commissioning services, or Letter Swap, to your Organisation, we only collect personal data about individuals where that individual, or an Organisation acting on their behalf, has uploaded that information to the Link Maker adoption or commissioning services or sent that information via Letter Swap.

We are required by local authorities and agencies to verify a new user’s identity data with the relevant local authority or agency prior to registration of the user of the Link Maker adoption and commissioning services and Letter Swap. We do not collect further personal data as part of this process. We also use your personal data to deliver relevant User Content to you as part of the Link Maker adoption and commissioning services, or which you are permitted to view. For example, where you are not permitted to view certain content of other users, we will restrict your access, and that of other users as appropriate.

How your personal data is collected (where we process your information for our own purposes as a controller)

We use different methods to collect data from and about you, including through:

Uses made of the information

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

Click here to find out more about the types of lawful basis that we will rely on to process your personal data.

Generally, we do not rely on consent as a legal basis for processing your personal data other than in relation to marketing or use of special categories of personal data. You have the right to withdraw consent by Contacting us.

We have set out below a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table below.

 
Purpose/Activity Type of data Lawful basis for processing including basis of legitimate interest Retention period(see further below
To provide and manage the Link Maker services a) Identity
b) Contact
a) Our legitimate interests in performing our contract with an Organisation to allow users to access the Link Maker services. a) Identity data is deleted at the request of the user. Records are marked for deletion and after 14 days the data deleted. Or for adoption and commissioning services if the user has not logged on to the system for a period of 3 years.
b) Contact data is deleted at the request of the user. Records are marked for deletion and after 14 days the data deleted. Or for adoption and commissioning services if the user has not logged on to the system for a period of 3 years.
To verify your identity a) Identity
b) Contact
a) Our legitimate interests in performing our contract with an Organisation to allow only registered members to access the Link Maker services. a) Identity data is deleted at the request of the user. Records are marked for deletion and after 14 days the data deleted. Or for adoption and commissioning services if the user has not logged on to the system for a period of 3 years.
b) Contact data is deleted at the request of the user. Records are marked for deletion and after 14 days the data deleted. Or for adoption and commissioning services if the user has not logged on to the system for a period of 3 years.
To provide and manage the community support network a) Identity
b) Contact
c) Social profile data
a) Performance of a contract with you to access the community support network
b) Our legitimate interests to manage the community support network.
c) Any special categories of personal data or criminal offence data where made manifestly public when you publish the information on the community support network
a) Identity and contact data deleted at the request of the user. Records are marked for deletion and after 14 days the data is anonymised Or if the user has not logged on to the system for a period of 3 years.
b) Contact data is deleted at the request of the user. Records are marked for deletion and after 14 days the data deleted. Or for adoption and commissioning services if the user has not logged on to the system for a period of 3 years.
c) Social profile data is kept until your account is closed in which case records are marked for deletion and after 14 days the data is anonymised Or can be deleted at any time.
To manage our relationship with you which will include:
a) Notifying you about changes to our terms or privacy policy.
a) Identity
b) Contact
c) Marketing and Communications
a) Performance of a contract with you
b) Necessary to comply with a legal obligation
c) Necessary for our legitimate interests (to keep our records updated and to study how customers use our products/services)
a) Identity and contact data deleted at the request of the user. Records are marked for deletion and after 14 days the data is anonymised Or if the user has not logged on to the system for a period of 3 years.
b) Contact data is deleted at the request of the user. Records are marked for deletion and after 14 days the data deleted. Or for adoption and commissioning services if the user has not logged on to the system for a period of 3 years.
c) Marketing and communication preferences can be changed by the user.
b) Asking you to leave a review or take a survey a) Identity
b) Contact
c) Marketing and Communications
a) To the extent that we have contacted you to review or take a survey we process that data on the basis of consent. a) Identity and contact data deleted at the request of the user. Records are marked for deletion and after 14 days the data is anonymised Or if the user has not logged on to the system for a period of 3 years.
b) Contact data is deleted at the request of the user. Records are marked for deletion and after 14 days the data deleted. Or for adoption and commissioning services if the user has not logged on to the system for a period of 3 years.
c) Marketing and communication preferences can be changed by the user.
To moderate the content on the community support network, including to communicate with Adoption UK as part of the monitoring and moderation of the community support network a) Identity
b) Contact
c) Social profile data
a) Performance of a contract with you to access the community support network
b) Our legitimate interests to manage the community support network in accordance with the Link Maker Systems Acceptable Use Policy and User Terms only for the benefit of the community members.
a) Identity and contact data deleted at the request of the user. Records are marked for deletion and after 14 days the data is anonymised Or if the user has not logged on to the system for a period of 3 years.
b) Contact data is deleted at the request of the user. Records are marked for deletion and after 14 days the data deleted. Or for adoption and commissioning services if the user has not logged on to the system for a period of 3 years.
c) Social profile data is kept until your account is closed in which case records are marked for deletion and after 14 days the data is anonymised Or can be deleted at any time.
To administer and protect our business and our site (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data) a) Identity
b) Contact
c) Technical
a) Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise)
b) Necessary to comply with a legal obligation
a) Identity and contact data deleted at the request of the user. Records are marked for deletion and after 14 days the data is anonymised Or if the user has not logged on to the system for a period of 3 years.
b) Contact data is deleted at the request of the user. Records are marked for deletion and after 14 days the data deleted. Or for adoption and commissioning services if the user has not logged on to the system for a period of 3 years.
c) Technical data is retained for a period of 1 year
To use data analytics to improve our site, and our services, customer relationships and experiences a) Technical
b) Usage
a) Necessary for our legitimate interests (to define types of customers for our products and services, to keep our website updated and relevant, to develop our business and to inform our marketing strategy) a) Technical data records is retained for a period of 1 year
b) Usage data record is retained for a period of 1 year
To make suggestions and recommendations to you about our services that may be of interest to you a) Identity
b) Contact
c) Technical
d) Usage
a) Necessary for our legitimate interests (to develop and our products and grow our business.)
a) Identity and contact data deleted at the request of the user. Records are marked for deletion and after 14 days the data is anonymised Or if the user has not logged on to the system for a period of 3 years.
b) Contact data is deleted at the request of the user. Records are marked for deletion and after 14 days the data is anonymised.
c) Technical data is retained for a period of 1 year
d) Usage data is retained for a period of 1 year.

Communications and Marketing

Link Maker systems may contact registered users on occasion to inform them of system changes or new features.

Users can opt out of marketing emails on registration and from the username menu when logged in. Each marketing email sent also offers an opportunity to unsubscribe.

Change of purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please Contact us.

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

Disclosure of your information

We may have to share your personal data with the parties set out below:

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

Where we store your personal data and our security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

The Link Maker Systems servers are on a virtualised network infrastructure that is fully redundant, with load balanced components so that components can be upgraded/replaced with no loss of service. The data centre is based in the UK and is climate controlled, with high level security, fire suppression and power redundancy. In the event of a non-recoverable data centre event, then the offsite backup can be restored at an alternative data centre within 24 hours.

The Link Maker Systems Disaster recovery policy and procedure primary objective is to ensure continuity of service for licenced users. This policy describes the procedures and process to recover IT systems, applications and data from any type of major outage. Disaster recovery testing is scheduled on an annual basis to ensure that the DR procedure and plan detailed is still valid.

Link Maker Systems use an external CESG and CHECK approved IT Security health check provider to perform both network and application level vulnerability scans annually. Link Maker Systems is accredited to ISO270001, and subject to internal independent audits to ensure compliance to its information security management policies.

All information you provide to us is stored on our secure servers. Any payment transactions will be encrypted using SSL technology. Where you have chosen a password, which enables you to access certain parts of our site, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

Limiting access to data

We limit access to User Content, contact data, and identity data, communications data to users that need to view that information for the purposes of linking an adopter, foster care or care placement provider with a child in care or to provide technical support to our users for those purposes.

We limit access to Communications data only to the relevant sender and recipient and their families. Link Maker does not routinely access your communications data stored via Letter Swap. Communication data is encrypted to secure the data; everyone’s access to content is secured using an encryption key which is unique to that user, derived from a combination of data provided during their log in which is only available to that user in their session. Link Maker’s admin users have access to encryption keys for administrative purposes and restoring lost access to users but do not have application-level access using these to view content. So for example, we do not review or vet, or answer questions relating to the content. Any question in relation to the content of a communication, should be directed to the relevant Organisation which you are registered with.

In relation to your personal data collected in relation to the community support network your social profile data is only used by us to deliver the community support network, and only shared with other members of the community support network.

Except as stated above, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk.

 

How long will you store my personal data for?

Where we act as a controller, we will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Details of retention periods for different aspects of your personal data where we act as a controller, are in the table above.

Where we process your personal data as a processor, we retain that information for the following periods:

In some circumstances we may anonymise your personal data which we collect in relation to the Link Maker adoption and commissioning services (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

Your rights

Our sites may, from time to time, contain links to and from the websites of our partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own terms and conditions and privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites.

Where we act as a controller, you have rights under data protection laws in relation to your personal data. If you are using the Link Maker adoption or commissioning service or Letter Swap, as an individual user it is likely that these rights should be exercised by you in relation to the Organisation you are registered with or which you represent. The rights you have under data protection legislation in the UK, depending on the specific circumstances, include:

If you wish to exercise any of the rights set out above, please Contact us OR email the [email protected].

No fee usually required - You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

What we may need from you - We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Time limit to respond - We try to respond to all legitimate requests. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Changes to our privacy policy and your duty to inform us of changes

This version was last updated April 2022 and historic versions can be obtained by contacting us.

Any changes we may make to our privacy policy in the future will be posted on this page and, where appropriate, you will be notified via an announcement on your personal home page.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.