Privacy Policy

Link Maker Systems Limited ("we" or “us”) are committed to protecting and respecting your privacy.

This policy (together with our User Terms and Letter Swap User Terms, and any other documents referred to in this policy) sets out the basis on which any personal data we collect from you, that you provide to us, or that we collect from other sources about you, will be processed by us.

This policy applies where you use the “Link Maker” sites (including www.linkmaker.co.uk and www.letterswap.co.uk) (our site(s)), use our Services or communicate with us in relation to our site or our services, whether as a guest or a registered user. “Use” of our site or services includes accessing, browsing, registering to use, uploading content to, or downloading content from, or communicating via our site or via our services, communicating with us.

Responsibility for personal data

Our site and the services available using our site is a platform to enable organisations licensed to provide adoption or children’s social care services (such as a local authority, an adoption agency or an Independent Fostering Provider (which, together with those working on their behalf we refer to as an “Organisation”) or an individual registered with one of those Organisations, to upload and manage their own information, and to access information uploaded by others including via the community support network, or to exchange communications via Letter Swap. This includes:

For the Link Maker adoption and commissioning services:

Organisations may upload information to our site about children who require adoption or fostering, about prospective adoptive or foster parents who have registered with that Organisation, or about individuals that work for those organisation, such as a social workers working for an adoption agency.
Prospective adopters and foster carers registered with an Organisation may upload their information to our site as part of using the services of that Organisation, which may be accessed by Organisations registered with us.
Information that is uploaded to our site may then be accessed by other users registered with us, including prospective adopters and foster carers registered with an Organisation, or Organisations acting on their behalf.
Organisations may transfer case files, using our site, to other Organisations. For example, where another Organisation has been employed to family-find on behalf of an Organisation.

For the Link Maker Letter Swap serivce:

Organisations may upload information to our site about contact arrangements between adopted children or children in care, and their birth family or about individuals that work for that organisation, such as practitioners working for an organisation..
Adoptive families and birth families can exchange communications relating to adopted children or children in care.
In this policy:
An “adoptive family” means individuals or members of a family who have been invited via Letter Swap by an Organisation to maintain contact with the birth family of an adopted child or a child in the care of the Organisation.
A “birth family” means individuals who have been invited via Letter Swap by an Organisation to maintain contact with an adopted child or a child in care of the organisation.

For the Link Maker community support network:

You may use the community support network to upload your content and view content of other members of the network. This includes the Adoption UK Community.

We act as a processor (rather than a controller) in relation to personal data which is uploaded to the Link Maker site and where that personal data is accessed via the Link Maker site by Organisations for the purposes of the Link Maker adoption and commissioning services., and where you use Letter Swap. This means we act on behalf of the Organisations and their registered user individuals which upload to, and access information via Link Maker site for the purposes of using the Link Maker adoption and commissioning services., or where those users use Letter Swap. We do have obligations as a processor under the applicable data protection legislation, which we have reflected in this policy, and our Link Maker User Terms, the Letter Swap User Terms, and the Organisation Terms.

As an individual user, you, as the user uploading information to the Link Maker site or sending information via Letter Swap, are responsible for deciding what information to upload or send, how that personal data is used, and when it is updated or deleted.

Where you are an employee or representative of an Organisation, your Organisation will have its own obligations as a controller under the applicable data protection legislation. For example, it must comply with the data protection principles as set out in the General Data Protection Regulation (GDPR) as it applies in the UK. You can find out more about the GDPR here www.ico.org.uk. In particular, any information which you access, download or store about individuals which are using Link Maker as part of your adoption or commissioning service, must be handled and stored securely, must not be disclosed without authorisation, must only be used for the purposes of that adoption and commissioning service, and must not be stored for longer than is necessary for those purposes.

If you are an individual using our site as part of the adoption or commissioning services of the Organisation you are registered with, or your use of Letter Swap, the processing of your personal data will be governed by the privacy policy of the Organisation with which you are registered. You can ask your Organisation for a copy of their privacy policy at any time.

We act as a controller (which means that we are primarily responsible your personal data and make decisions about how that personal data is used) when:

We process your personal data that you provide in relation to the community support network.
We process some personal data relating to how you use our site and services at a technical level, and for our own statistical analysis to help improve the service. For example, we may collect information about your browser, and computer operating system to allow us to provide an efficient browsing experience. We have set out how we process this type of personal data in more detail below.

It is important that you read this policy together with any other privacy policy or privacy notice we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This privacy policy supplements the other notices and is not intended to override them.

We have appointed a security officer who is responsible for overseeing questions in relation to this policy. If you have any questions about this policy, including any requests to exercise your legal rights, please contact the [email protected] using the details set out below.

Contact Details

Our full details are Link Maker Systems Limited. Our registered office at Alpha House, 159 High Street, Barnet, Hertfordshire EN5 5SU. If you want to contact us in relation to this policy, please contact the security officer by phone 0800 368 8549 or by email to [email protected].

Information we collect

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We collect personal data in two scenarios (1) where we use that personal data for our own purposes (where we act as a controller), and (2) where we process personal data on your behalf (where we act as a processor).

Information we may collect where we process personal data on behalf of an Organisation (where we act as a processor)

For Organisations

For an Organisation’s users of our Adoption and Commissioning Services:

We collect case data which your Organisation gives us as part of its use of the Link Maker adoption and commissioning services. We will receive information about adopters or carers which you are acting for, or where an Organisation has allowed the adopter or carer to upload their own information, and about the child/children being profiled which you are acting for, we call this “User Content”, which includes:
- Family case data - The information we receive in relation to adopters and foster carers which you are acting for. This may include name, address, e-mail address and phone number, personal description and photograph, basic details about adopters and foster carers or other members of their household, and such other information as may be required by the relevant Organisation to demonstrate suitability to provide adoption and fostering care services. The required data includes, whether expressly or by implication from the data supplied, special categories of personal data so that a third-party organisation can consider suitability for placements. For example, ethnic origin, religion, physical and mental health, and sexual orientation or information about criminal convictions and offences. Family case data includes activity data and communication data (each as defined below) in relation to the adopters and foster carers.
- Child case data - The information you give us in relation to a child which you are acting for, to be profiled on our site. This may include the child’s name, address, age, personal description, photograph, details of any specific health and development issues and past life experiences and such other information as may be required by an Organisation to assess a child’s need for adoption and fostering care services. Child case data includes activity data and communication data (each as defined below) in relation to those children.
- Activity data - Data on discussions you have made or received on behalf of a sibling group or family, the outcome of the expressions of interest; audit logs detailing who has added, edited or amended content and when. We provide this information to the user which uploaded the information to allow them to monitor family finding activity and establish accountability for changes to profile data.
- Communication data – All data within messages or documents sent with discussions. This may include sensitive information, including special categories of personal data and criminal offence data, about families and children. Communication data is encrypted to secure the data; everyone’s access to that communication data is secured using an encryption key which is unique to that user, derived from a combination of data provided during their log in which is only available to that user in their session. Link Maker’s admin users have access to encryption keys for administrative purposes and restoring lost access to users but do not have application-level access using these to view content.

For an Organisation’s users of Letter Swap:

We collect case data which your Organisation gives us as part of its use of the Letter Swap services. We will receive information about children which your Organisation is acting for, we call this “User Content”, which includes:
- Child case data - The information you give us in relation to a child which you are acting for. This may include the child’s name, age, gender, details of both the adoptive family and birth family and information relating to a contact agreement. Child case data includes activity data and communication data (each as defined below) in relation to those children.
- Activity data - Data on communications you have made or received in relation to child case data, audit logs detailing who has added, edited or amended content and when. We provide this information to the Organisation to allow them to monitor communication and assess efficient operation of the contact agreement.
- Communication data – All data within messages, documents, videos, and audio messages sent within a contact link. This may include sensitive information, including special categories of personal data and criminal offence data, about families and children. Communication data is encrypted to secure data; everyone’s access to content is secured using an encryption key which is unique to that user, derived from a combination of data provided during their log in which is only available to that user in their session. Link Maker’s admin users have access to encryption keys for administrative purposes and restoring lost access to users but do not have application-level access using these to view content.

• Worker data – The information we receive from users which work for an Organisation including contact details, name and job role. It also includes information which relates to such workers for example, audit information such as time and date changes are made on child or family cases or the time and date messages are sent to other users.

For Adopters and Foster Carers as part of our adoption and commissioning services:

We collect User Content uploaded by you or by the Organisation you are registered with (see definition above) as part of the Link Maker adoption and commissioning services.

Forusers of Letter Swap:

We collect communication data – All data within messages, documents, videos, and audio messages sent and received via Letter Swap by you or members of your family, within a contact link by adoptive families, birth families and organisations. This may include sensitive information, including special categories of personal data and criminal offence data, about you or others. For example, a letter may contain details of how your health has been, or someone might discuss issues you or they may have had with the Police. Communication data is encrypted to secure the data; everyone’s access to content is secured using an encryption key which is unique to that user, derived from a combination of data provided during their log in which is only available to that user in their session. Link Maker’s admin users have access to encryption keys for administrative purposes and restoring lost access to users but do not have application-level access using these to view content.

Information we receive from other sources

We may receive information about you from local authorities, registered adoption/fostering agencies which is used as part of the Link Maker adoption and commissioning services. or Letter Swap. For example, if you are an individual seeking to register to use the Link Maker site, we check the identity of all new users with the registered Organisation and share with such Organisations the information submitted by you for that purpose. By submitting such information to us, you authorise us to share such information for these purposes.

The Organisations which use our system may ask you for special categories of personal data, and criminal offence data, or share via the Link Maker site, family case data, or child case data which may contain such sensitive types of data. This type of data is only used by an Organisation for them to consider an individual’s suitability for placements. as part of their adoption and commissioning services. Special categories of personal data include details about your race or ethnicity, religious or philosophical beliefs, sexual orientation, and information about your health. Criminal offence data includes data in relation to criminal convictions and offences (including data about criminal allegations, proceedings or convictions) or linked to related security measures.

Information we collect where we use that personal data for our own purposes (where we act as a controller)

We may collect, use, store and transfer different kinds of personal data about you for our own purposes, which we have grouped together as follows:

Identity data which may include first name, last name, title, gender, Organisation with which you are registered or represent, password, PIN, and user type i.e. Adopter, Foster Carer, or practitioner for an Organisation, adoptive family or birth family.
Contact data which includes address, email address and telephone numbers.
Social profile data which you upload or share via the community support network which we only use to provide access to that information to users of the community support network. We do not use this information for any other purposes. This includes the information you provide in relation to your profile when you register and use the community support network. This will include details of family make up and legal status and interests and hobbies but you control this information, and can remove it whenever you wish.
Information we collect about your use of our site and services at a technical level. With regard to each of your visits to our sites we may automatically collect the following information

Technical data, including the Internet protocol (IP) address used to connect your computer to the internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this website;
Usage data, which includes information about your visit, including the full Uniform Resource Locators (URL) clickstream to, through and from our site (including date and time page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs); frequency and number of views of particular profiles; application logs detailing who has added, edited or amended content and when; methods used to browse away from the page and any phone number used to call our customer service number.
Transaction Data -
1. Which includes details about the products and services you have purchased from us as an individual.
2. Where you as an individual pay for our services by card, our payment services provider (which is currently Stripe) collects details about payments (bank account and card payment details) to process your payment. We don’t collect financial data from you and Stripe does not disclose that financial data to us.
Marketing and communications data which includes your preferences in receiving marketing from us and our third parties and your communication preferences.
We also collect, use and share aggregated data such as statistical or demographic data for any purpose. This aggregated data may be derived from your personal data but it is anonymised as this data does not directly or indirectly reveal your identity and therefore it is not considered personal data in law. For example, we may aggregate your usage data to show how many views a profile has had. We may aggregate your profile data to show the number of adopters in the country who have registered with a particular ethnicity, in order to show the national sufficiency of adopters or foster carers. However, if we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this policy.
We do not collect any special categories of personal data or information about criminal convictions and offences, except to the extent that such data is included in the information uploaded by you or your Organisation to our site where we act as a processor.
Information we receive from other sources. We are also working closely with third parties (including, for example, Organisations, sub-contractors in technical, payment and delivery services, analytics providers, search information providers) and may receive information about you from them. Where you register to use the Adoption UK Community, we will contact Adoption UK to verify your membership.

If you fail to provide personal data

Where an Organisation requires specific information about an individual in order to make a placement assessment or decision, where we need to collect personal data by law, or the terms of a contract we have with you require it, and you fail to provide that data when requested, we may not be able to provide our services (for example, to provide you with access to our site and services). In this case, we may have to reject or cancel your account registration, but we will notify you if this is the case at the time.

Cookies

Our website uses cookies to distinguish you from other users of our website. This helps us to provide you with a good experience when you browse our website and also allows us to improve our site. For detailed information on the cookies we use and the purposes for which we use them see our Cookie Policy.

How your personal data is collected (where we process information for your Organisation as a processor)

Where we are providing our adoption and commissioning services, or Letter Swap, to your Organisation, we only collect personal data about individuals where that individual, or an Organisation acting on their behalf, has uploaded that information to the Link Maker adoption or commissioning services or sent that information via Letter Swap.

We are required by local authorities and agencies to verify a new user’s identity data with the relevant local authority or agency prior to registration of the user of the Link Maker adoption and commissioning services and Letter Swap. We do not collect further personal data as part of this process. We also use your personal data to deliver relevant User Content to you as part of the Link Maker adoption and commissioning services, or which you are permitted to view. For example, where you are not permitted to view certain content of other users, we will restrict your access, and that of other users as appropriate.

How your personal data is collected (where we process your information for our own purposes as a controller)

We use different methods to collect data from and about you, including through:

Direct interactions. You may give us your identity or contact details by filling in forms or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you register to use our site, subscribe to our service, participate in discussion boards or other social media functions on our site and when you report a problem with our site, request support, or give us some feedback.
Automated technologies or interactions. As you interact with our site, we may automatically collect technical data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. Please see our Cookie Policy for further details.
Third parties. We may receive personal data about you from various third parties and public sources as set out below:
- Organisations that you were registered with will provide your family name and email address to allow you to continue as a registered user of the Link Maker community support network.
- Technical data from the following parties:
  a) analytics providers such as Google based outside the EU;
- Contact, and transaction data from providers of technical, payment and delivery services:
  b) Stripe based outside the EU

Uses made of the information

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

Where we need to perform the contract we are about to enter into with you or have entered into with you.
Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
Where we need to comply with a legal or regulatory obligation.

Click here to find out more about the types of lawful basis that we will rely on to process your personal data.

Generally, we do not rely on consent as a legal basis for processing your personal data other than in relation to marketing or use of special categories of personal data. You have the right to withdraw consent by Contacting us.

We have set out below a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table below.

Purpose/Activity	Type of data	Lawful basis for processing including basis of legitimate interest	Retention period(see further below
To provide and manage the Link Maker services	a) Identity b) Contact	a) Our legitimate interests in performing our contract with an Organisation to allow users to access the Link Maker services.	a) Identity data is deleted at the request of the user. Records are marked for deletion and after 14 days the data deleted. Or for adoption and commissioning services if the user has not logged on to the system for a period of 3 years. b) Contact data is deleted at the request of the user. Records are marked for deletion and after 14 days the data deleted. Or for adoption and commissioning services if the user has not logged on to the system for a period of 3 years.
To verify your identity	a) Identity b) Contact	a) Our legitimate interests in performing our contract with an Organisation to allow only registered members to access the Link Maker services.	a) Identity data is deleted at the request of the user. Records are marked for deletion and after 14 days the data deleted. Or for adoption and commissioning services if the user has not logged on to the system for a period of 3 years. b) Contact data is deleted at the request of the user. Records are marked for deletion and after 14 days the data deleted. Or for adoption and commissioning services if the user has not logged on to the system for a period of 3 years.
To provide and manage the community support network	a) Identity b) Contact c) Social profile data	a) Performance of a contract with you to access the community support network b) Our legitimate interests to manage the community support network. c) Any special categories of personal data or criminal offence data where made manifestly public when you publish the information on the community support network	a) Identity and contact data deleted at the request of the user. Records are marked for deletion and after 14 days the data is anonymised Or if the user has not logged on to the system for a period of 3 years. b) Contact data is deleted at the request of the user. Records are marked for deletion and after 14 days the data deleted. Or for adoption and commissioning services if the user has not logged on to the system for a period of 3 years. c) Social profile data is kept until your account is closed in which case records are marked for deletion and after 14 days the data is anonymised Or can be deleted at any time.
To manage our relationship with you which will include: a) Notifying you about changes to our terms or privacy policy.	a) Identity b) Contact c) Marketing and Communications	a) Performance of a contract with you b) Necessary to comply with a legal obligation c) Necessary for our legitimate interests (to keep our records updated and to study how customers use our products/services)	a) Identity and contact data deleted at the request of the user. Records are marked for deletion and after 14 days the data is anonymised Or if the user has not logged on to the system for a period of 3 years. b) Contact data is deleted at the request of the user. Records are marked for deletion and after 14 days the data deleted. Or for adoption and commissioning services if the user has not logged on to the system for a period of 3 years. c) Marketing and communication preferences can be changed by the user.
b) Asking you to leave a review or take a survey	a) Identity b) Contact c) Marketing and Communications	a) To the extent that we have contacted you to review or take a survey we process that data on the basis of consent.	a) Identity and contact data deleted at the request of the user. Records are marked for deletion and after 14 days the data is anonymised Or if the user has not logged on to the system for a period of 3 years. b) Contact data is deleted at the request of the user. Records are marked for deletion and after 14 days the data deleted. Or for adoption and commissioning services if the user has not logged on to the system for a period of 3 years. c) Marketing and communication preferences can be changed by the user.
To moderate the content on the community support network, including to communicate with Adoption UK as part of the monitoring and moderation of the community support network	a) Identity b) Contact c) Social profile data	a) Performance of a contract with you to access the community support network b) Our legitimate interests to manage the community support network in accordance with the Link Maker Systems Acceptable Use Policy and User Terms only for the benefit of the community members.	a) Identity and contact data deleted at the request of the user. Records are marked for deletion and after 14 days the data is anonymised Or if the user has not logged on to the system for a period of 3 years. b) Contact data is deleted at the request of the user. Records are marked for deletion and after 14 days the data deleted. Or for adoption and commissioning services if the user has not logged on to the system for a period of 3 years. c) Social profile data is kept until your account is closed in which case records are marked for deletion and after 14 days the data is anonymised Or can be deleted at any time.
To administer and protect our business and our site (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)	a) Identity b) Contact c) Technical	a) Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise) b) Necessary to comply with a legal obligation	a) Identity and contact data deleted at the request of the user. Records are marked for deletion and after 14 days the data is anonymised Or if the user has not logged on to the system for a period of 3 years. b) Contact data is deleted at the request of the user. Records are marked for deletion and after 14 days the data deleted. Or for adoption and commissioning services if the user has not logged on to the system for a period of 3 years. c) Technical data is retained for a period of 1 year
To use data analytics to improve our site, and our services, customer relationships and experiences	a) Technical b) Usage	a) Necessary for our legitimate interests (to define types of customers for our products and services, to keep our website updated and relevant, to develop our business and to inform our marketing strategy)	a) Technical data records is retained for a period of 1 year b) Usage data record is retained for a period of 1 year
To make suggestions and recommendations to you about our services that may be of interest to you	a) Identity b) Contact c) Technical d) Usage	a) Necessary for our legitimate interests (to develop and our products and grow our business.)	a) Identity and contact data deleted at the request of the user. Records are marked for deletion and after 14 days the data is anonymised Or if the user has not logged on to the system for a period of 3 years. b) Contact data is deleted at the request of the user. Records are marked for deletion and after 14 days the data is anonymised. c) Technical data is retained for a period of 1 year d) Usage data is retained for a period of 1 year.

Communications and Marketing

Link Maker systems may contact registered users on occasion to inform them of system changes or new features.

Users can opt out of marketing emails on registration and from the username menu when logged in. Each marketing email sent also offers an opportunity to unsubscribe.

Change of purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please Contact us.

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

Disclosure of your information

We may have to share your personal data with the parties set out below:

If your Organisation has agreed to transfer a case file to another Organisation, then you may instruct us to transfer that case file on your behalf using the Transfer case process, which can be found on the admin menu for those with managers permissions. On completion of that process, the new Organisation will be responsible for the case file, and all related activity data, and that Organisation will become a controller in relation to any personal data contained in that case file. You must not transfer a case file to another Organisation unless you have all relevant approvals, consents and authorisations to make that transfer, and that Organisation has all relevant approvals, consents and authorisations to receive access to that file.
If you work on behalf of an Organisation, that Organisation’s files stored via our site may retain your personal data, and we may help that Organisation to retrieve information about you from those files during the period you work for them, until they ask us to delete the relevant files or otherwise in accordance with our normal retention process. For example, the time and date you entered information onto a child’s file or the messages you sent relating to a case to other users of the system.
External third parties in their capacity as our sub-contractors in providing our services to you, including Organisations and the specific third parties listed below:
- Rackspace Ltd, who manages Link Maker's server infrastructure, located in the UK.
- Amazon Web Services EMEA SARL, the owners of the UK data centre where the servers reside.
- Amazon Web Services EMEA SARL, AWS Elemental Media Convert is the tool used for transcoding any videos uploaded to the Link Maker site. The video transcoding service is located in the UK.
- Mailgun Technologies Inc, the company used to send application emails to notify users if they have a new message within their account on the Link Maker site. Mailgun Technologies Inc. are based in California state, US. The data is processed by Mailgun in EU data centres. The only personal data processed by Mailgun is the email address of users, all other content of the email is made anonymous.
- Twilio Ireland ltd, used to stream video and audio data within video conferencing functionality (where selected by users). Users of the video conferencing facility will create an encrypted connection with Twilio’s media servers in Ireland directly from their device, and all media is transported through this secure connection.
- Sales Force Ltd, CRM systems used to store issues raised with the support helpdesk or information relating to the purchase of an Organisations licence.
Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy notice.
If we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our terms of service and other agreements; or to protect the rights, property, or safety of Link Maker Systems Limited, our customers, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and the protection of minors.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

Where we store your personal data and our security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

The Link Maker Systems servers are on a virtualised network infrastructure that is fully redundant, with load balanced components so that components can be upgraded/replaced with no loss of service. The data centre is based in the UK and is climate controlled, with high level security, fire suppression and power redundancy. In the event of a non-recoverable data centre event, then the offsite backup can be restored at an alternative data centre within 24 hours.

The Link Maker Systems Disaster recovery policy and procedure primary objective is to ensure continuity of service for licenced users. This policy describes the procedures and process to recover IT systems, applications and data from any type of major outage. Disaster recovery testing is scheduled on an annual basis to ensure that the DR procedure and plan detailed is still valid.

Link Maker Systems use an external CESG and CHECK approved IT Security health check provider to perform both network and application level vulnerability scans annually. Link Maker Systems is accredited to ISO270001, and subject to internal independent audits to ensure compliance to its information security management policies.

All information you provide to us is stored on our secure servers. Any payment transactions will be encrypted using SSL technology. Where you have chosen a password, which enables you to access certain parts of our site, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

Limiting access to data

We limit access to User Content, contact data, and identity data, communications data to users that need to view that information for the purposes of linking an adopter, foster care or care placement provider with a child in care or to provide technical support to our users for those purposes.

We limit access to Communications data only to the relevant sender and recipient and their families. Link Maker does not routinely access your communications data stored via Letter Swap. Communication data is encrypted to secure the data; everyone’s access to content is secured using an encryption key which is unique to that user, derived from a combination of data provided during their log in which is only available to that user in their session. Link Maker’s admin users have access to encryption keys for administrative purposes and restoring lost access to users but do not have application-level access using these to view content. So for example, we do not review or vet, or answer questions relating to the content. Any question in relation to the content of a communication, should be directed to the relevant Organisation which you are registered with.

In relation to your personal data collected in relation to the community support network your social profile data is only used by us to deliver the community support network, and only shared with other members of the community support network.

Except as stated above, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk.

How long will you store my personal data for?

Where we act as a controller, we will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Details of retention periods for different aspects of your personal data where we act as a controller, are in the table above.

Where we process your personal data as a processor, we retain that information for the following periods:

Your social profile data as part of our community support network is deleted at the request of the user and once 3 years has passed since the last interaction you had with the community support network or your profile.
Case data for Adoption and Commissioning services, is deleted at the request of the relevant individual’s Organisation. An inactive case is deleted if there has been no activity against the case for three years (or the Organisation’s selected data retention period if different). If the Customers’ licence has expired, inactive cases are deleted after 3 months. Such data is marked for deletion and no longer available in the application. Fourteen days after the data is anonymised in accordance with the ‘Anonymisation Code of Practice’ issued by the ICO. This anonymised data is held by Link Maker for statistical purposes
Case data for Letter Swap is deleted at the request of the relevant individual’s Organisation. Case data is deleted 3 months after the customers Licence has expired. Such data is marked for deletion, and no longer available in the application for organisations. Registered users of Letter Swap who have access to communication data within that case will be notified via email and have 14 days to download any information. Fourteen days after the data is deleted.
A user record is deleted on request from the user, or if the user is registered for the community support network only has not logged on for 3 years.
Worker data – is deleted at the request of the relevant individual’s Organisation or 3 months after the worker user account has been deleted and the Organisation’s licence has expired.
In some circumstances you can ask us to delete your data: see Request erasure below for further information.

In some circumstances we may anonymise your personal data which we collect in relation to the Link Maker adoption and commissioning services (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

Your rights

Our sites may, from time to time, contain links to and from the websites of our partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own terms and conditions and privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites.

Where we act as a controller, you have rights under data protection laws in relation to your personal data. If you are using the Link Maker adoption or commissioning service or Letter Swap, as an individual user it is likely that these rights should be exercised by you in relation to the Organisation you are registered with or which you represent. The rights you have under data protection legislation in the UK, depending on the specific circumstances, include:

Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data held about you and to check that it is being lawfully processed.
Request correction of your personal data that is held about you. This enables you to have any incomplete or inaccurate data held about you corrected, though the accuracy of the new data you provide may need to be verified.
Request erasure of your personal data. You can ask for your personal data to be deleted or removed where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
Object to processing of your personal data. Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
Request restriction of processing your personal data. This enables you to ask that processing of your personal data to be suspended in the following scenarios: (a) if you want us to establish the data’s accuracy; (b) where use of the data is unlawful but you do not want it to be erased; (c) where you need the data to be held even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to the use of your data but we need to verify whether we have overriding legitimate grounds to use it.
Request transfer of your personal data to you or to a third party. You can ask to be provided with, or that a third party you have chosen is provided with, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
Right to withdraw consent where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

If you wish to exercise any of the rights set out above, please Contact us OR email the [email protected].

No fee usually required - You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

What we may need from you - We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Time limit to respond - We try to respond to all legitimate requests. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Changes to our privacy policy and your duty to inform us of changes

This version was last updated April 2022 and historic versions can be obtained by contacting us.

Any changes we may make to our privacy policy in the future will be posted on this page and, where appropriate, you will be notified via an announcement on your personal home page.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.