Legal, Governance & Policies

Last updated: 30 September 2026

1. Privacy Notice (GDPR)
Data Controller: Rebecca Hemmings, Thrive Advocacy Herts & Essex CIC
Contact: Rebecca Hemmings — Thrive.advocacy.herts.essex@gmail.com
 •  What we collect: Child ID/initials, parent contact, EHCP, school/LA correspondence, meeting notes.
 •  Why: To provide SEND advocacy. Lawful basis: Consent and Legitimate Interest.
 •  Storage: Encrypted OneDrive / SharePoint (UK/EU), 2FA, restricted folders. ICO ZC259497.
 •  Retention: 6 years after case closes (or until age 25 if safeguarding), then secure deletion.
 •  Your rights: Request access/correction/deletion — contact Rebecca Hemmings at Thrive.advocacy.herts.essex@gmail.com
 •  ICO: You can complain to ICO.org.uk

2. Safeguarding — Designated Safeguarding Lead
DSL is Rebecca Hemmings — Thrive.advocacy.herts.essex@gmail.com
We follow Working Together to Safeguard Children 2023. All concerns logged and referred to Herts/Essex MASH within 24 hours. Enhanced DBS held.

Please See the Safeguarding page for our full policy

3. Confidentiality

All information shared with Thrive Advocacy Herts & Essex CIC is treated as strictly confidential.

 •  We do not share any family, child or school information without your explicit written or verbal consent, except where there is a safeguarding concern in line with Working Together to Safeguard Children 2023.
 •  Case files are stored using child initials and ID numbers only — never full names in file titles. Files are held on encrypted, password-protected OneDrive with 2FA and restricted access. ICO Registration: ZC259497.
 •  We never discuss cases on social media, WhatsApp, personal email, or in public spaces. All staff and volunteers sign a confidentiality agreement and have enhanced DBS checks.
 •  You can ask to see what information we hold about you at any time by contacting Rebecca Hemmings at Thrive.advocacy.herts.essex@gmail.com. You can withdraw consent at any time, though this may limit the advocacy support we can provide.
 •  If we work with your Local Authority, we will only share information you have agreed we can share in your signed consent form.


4. Equality, Diversity & Inclusion
Rebecca Hemmings ensures advocacy is available to all regardless of background, disability, race, gender, religion.
At Thrive Advocacy Herts & Essex CIC, Equality, Diversity and Inclusion is not just a policy — it is who we are.
I am Rebecca Hemmings, a mixed-race, gay woman and parent of a gay child. I know personally what it feels like to have to explain your family, your identity, or to worry if you will be treated differently. No family who comes to Thrive will ever have to feel that here.
We are deeply committed to treating every child, parent, carer and professional with respect, dignity and kindness, and to actively celebrating our differences — including race, religion and belief, disability, sexual orientation, gender identity, sex, age, and cultural background.
What this means in practice:
 •  We support all children and families, regardless of background, race, ethnicity, religion or belief, disability, sexual orientation, gender identity, or family make-up.
 •  We challenge discrimination, prejudice and exclusion in all its forms — including in meetings, schools and LA processes where we advocate for you.
 •  We make reasonable adjustments for disability, language, communication needs and access — please tell us what you need and we will put it in place.
 •  Our language is inclusive and respectful, and we will always respect how you describe your family, your child and yourself.
 •  We welcome feedback — if we ever get it wrong, tell us at Thrive.advocacy.herts.essex@gmail.com and we will learn and put it right.

Thrive exists because every child deserves to be seen, heard and celebrated for exactly who they are — and every family deserves an advocate who truly understands.
5. Complaints — Lead: Rebecca Hemmings
Stage 1: Email Rebecca Hemmings at Thrive.advocacy.herts.essex@gmail.com — reply within 5 working days.
Stage 2: Independent board member review within 15 working days.
Stage 3: CIC Regulator / LA commissioner.

6. Data Protection & Information Security — Lead: Rebecca Hemmings
ICO ZC259497. All devices encrypted, 2FA enforced. Breaches reported within 72 hours.




Thrive Advocacy Herts & Essex CIC | Lead: Rebecca Hemmings | Thrive.advocacy.herts.essex@gmail.com | ICO: ZC259497 | Privacy | Policies