Privacy Policy

1. Introduction

1.1. Kith and Kin Financial Wellbeing (“we”, “us”, “our”) is a viewing platform for financial wellbeing information and you may choose to contact us for advice and assistance.

1.2. We are committed to protecting your privacy and personal information. This privacy policy explains how we may collect, use, store, and how we protect your data when you use our website, use our services including our Learning Management System (LMS) or interact with us including any data you may provide when you sign up to our mailing list, purchase a product or service or take part in a service or product.

1.3. This policy applies to all users of our website (www.kithandkinwellbeing.org), our financial wellbeing Learning Management System (LMS), and recipients of our financial wellbeing services.

1.4. It is important that you read this privacy policy together with any other privacy policy or fair processing policy we may provide on specific occasions when we are collecting or processing Personal Data about you so that you are fully aware of how and why we may use your data. This privacy policy supplements other notices and privacy policies and is not intended to override them.

Data Controller

1.5. The data controller responsible for your personal information is:

Kith and Kin Financial Wellbeing
NICVA Building
61 Duncairn Gardens
Belfast BT15 2GB
Northern Ireland, United Kingdom
Phone: 028 9087 7777
Email: info@kithandkinfinance.org

Kith and Kin Financial Wellbeing is the trading name of Kith & Kin Financial Solutions C.I.C. registered at Companies House with company number NI634781, (collectively referred to as “Company”, “we”, “us” or “our” in this privacy policy).

1.6. If you have any questions about this privacy policy, including any requests to exercise your legal rights at paragraph 11, please contact us using the information set out in the contact details at paragraph 19.

2. Personal Data We Collect

2.1. Personal data means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data), (“Personal Data”).

2.2. We may collect, use, store and transfer different kinds of Personal Data about you which we have grouped together as follows:

a. Identity Data includes first name, last name, any previous names, username or similar identifier, marital status, title, date of birth, age range, and gender.
b. Contact Data includes billing address, delivery address, email address, telephone numbers and any other information you chose to provide.
c. Financial Data includes bank account, payment card details, financial circumstances and goals (when relevant to the service provided), employment status and income information (for financial advice services) and any other information you chose to provide.
d. Transaction Data includes details about payments to and from you and other details of products and services you have purchased from us.
e. Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, device ID and other technology on the devices you use to access this website.
f. Profile Data includes your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses.
g. Usage Data includes information about how you interact with and use our website, products and services.
h. Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.

2.3.

We may also collect, use and share Aggregated Data such as statistical or demographic data which is not Personal Data as it does not directly (or indirectly) reveal your identity. For example, we may aggregate individuals’ Usage Data to calculate the percentage of users accessing a specific website feature in order to analyse general trends in how users are interacting with our website to help improve the website and our service offering.

3. If you fail to provide Personal Data

Where we need to collect Personal Data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with goods or services). In this case, we may have to cancel a product or service you have with us but we will notify you if this is the case at the time.

4. How Is Personal Data Collected

4.1. Personal Information You Provide

We may collect Personal Data that you voluntarily provide when you:
a. Contact us via phone, email, or web forms;
b. Register for our services, events, workshops, or webinar;
c. Sign up for our mailing list or newsletters;
d. Access our Learning Management System (LMS); and
e. Book 1-to-1 financial advices or consultations;

4.2. Information Automatically Collected

When you visit our website, we may automatically collect certain Technical Data through cookies and similar technologies:
a. IP address and approximate geographic location;
b. Browser type and version;
c. Operating system;
d. Device information;
e. Pages visited and time spent on site;
f. Referring website or source; and
g. Navigation patterns and user interactions.

4.3. Your interactions with us

You may give us your Personal Data by filling in online forms or by corresponding with us by post, phone, email or otherwise. This may include Personal Data you provide when you:
a. apply for our products or services;
b. make a request for us to contact you through our ‘Contact Us’ form;
c. subscribe to our services;
d. request marketing to be sent to you; or
e. give us feedback or contact us.

We may also receive Technical Data about you if you visit other websites employing our cookies. Please see our cookie policy at paragraph 7 for further details.

4.4. Third parties or publicly available sources.

We may receive Personal Data about you from various third parties and public sources as set out below:
a. Technical Data is collected from the following parties:
• analytics providers such as Google;
• advertising networks; and
• search information providers.

b. Contact, Financial and Transaction Data may be collected from providers of technical, payment and delivery services.

c. Identity and Contact Data may be collected from data brokers or aggregators.

d. Identity and Contact Data may be collected from publicly available sources.

4.5. Sensitive Personal Data

When providing financial advice or wellbeing services, we may need to collect sensitive Personal Data relating to your financial circumstances, health (if relevant to financial stress), or other special category data. We will only collect this information with your explicit consent and where necessary to provide our services.

5. How We Use Your Personal Data

5.1. Legal Bases

The law requires us to have a legal basis for collecting and using your Personal Data. Under UK GDPR, we process your Personal Data based on one or more of the following legal grounds:

5.1.1. Consent:

Only where you have given explicit consent to use your Personal Data for a specific purpose (e.g., newsletter subscriptions, marketing communications).

5.1.2. Contract:

To fulfil our contractual obligations when providing services.

5.1.3. Legal Obligation:

To comply with legal and regulatory requirements that we are subject to. We will identify the relevant legal obligation when we rely on this legal basis.

5.1.4. Legitimate Interests:

To improve our services and communicate relevant information (where not overridden by your rights), for example to prevent fraud and enable us to give you the best and most secure customer experience. We make sure we consider and balance any potential impact on you and your rights (both positive and negative) before we process your Personal Data for our legitimate interests. We do not use your Personal Data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).

5.2. Service Delivery

• To provide financial wellbeing services, advice, and support;
• To deliver workshops, webinars, and training sessions;
• To administer your access to our Learning Management System;
• To schedule and conduct 1-to-1 financial clinics; and
• To manage employer membership programmes.

5.3. Communication

• To respond to your enquiries and requests;
• To send service-related notifications and updates;
• To provide newsletters and marketing communications (with your consent); and
• To inform you about events, programmes, and new services.

5.4. Website Improvement

• To analyse website usage and improve functionality;
• To enhance user experience and navigation;
• To troubleshoot technical issues.

5.5. Legal and Compliance

• To comply with legal obligations and regulatory requirements;
• To protect our rights and prevent fraud or misuse;
• To maintain records for audit and accountability purposes.

5.6. Direct marketing

During the registration process on our website when your Personal Data is collected, you will receive marketing communications from us if you have requested information from us or purchased goods or services from us and you have not opted out of receiving the marketing.

We may also analyse your Identity, Contact, Technical, Usage and Profile Data to form a view which products, services and offers may be of interest to you so that we can then send you relevant marketing communications.

5.7. Third-party marketing

We will get your express consent before we share your Personal Data with any third party for their own direct marketing purposes.

5.8. Opting out of marketing

You can ask to stop sending you marketing communications at any time by following the opt-out links within any marketing communication sent to you.

If you opt out of receiving marketing communications, you will still receive service-related communications that are essential for administrative or customer service purposes for example relating to online training modules.

5.9. Cookies

For more information about the cookies we use and how to change your cookie preferences, please see below at paragraph 7.

6. Purposes for which we will use your Personal Data

We have set out below, in a table format, a description of all the ways we may use the various categories of your Personal Data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

Potential Purpose/Use	Type of data	Legal basis for processing including basis of legitimate interest
To register you as a new customer	(a) Identity (b) Contact	Performance of a contract with you
To process and deliver your order including: (a) Manage payments, fees and charges (b) Collect and recover money owed to us	(a) Identity (b) Contact (c) Financial (d) Transaction (e) Marketing and Communications	(a) Performance of a contract with you (b) Necessary for our legitimate interests (to recover debts due to us)
To manage our relationship with you which will include: (a) Notifying you about changes to our terms or privacy policy (b) Dealing with your requests, complaints and queries	(a) Identity (b) Contact (c) Profile (d) Marketing and Communications	(a) Performance of a contract with you (b) Necessary to comply with a legal obligation (c) Necessary for our legitimate interests (to keep our records updated and manage our relationship with you
To enable you to partake in a prize draw, competition or complete a survey	(a) Identity (b) Contact (c) Profile (d) Usage (e) Marketing and Communications	(a) Performance of a contract with you (b) Necessary for our legitimate interests (to study how customers use our products/services, to develop them and grow our business)
To administer and protect our business and this website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)	(a) Identity (b) Contact (c) Technical	(a) Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise) (b) Necessary to comply with a legal obligation
To deliver relevant website content and online advertisements to you and measure or understand the effectiveness of the advertising we serve to you	(a) Identity (b) Contact (c) Profile (d) Usage (e) Marketing and Communications (f) Technical	Necessary for our legitimate interests (to study how customers use our products/services, to develop them, to grow our business and to inform our marketing strategy)
To use data analytics to improve our website, products/services, customer relationships and experiences and to measure the effectiveness of our communications and marketing	(a) Technical (b) Usage	Necessary for our legitimate interests (to define types of customers for our products and services, to keep our website updated and relevant, to develop our business and to inform our marketing strategy)
To send you relevant marketing communications and make personalised suggestions and recommendations to you about goods or services that may be of interest to you based on your Profile Data	(a) Identity (b) Contact (c) Technical (d) Usage (e) Profile (f) Marketing and Communications	Necessary for our legitimate interests (to carry out direct marketing, develop our products/services and grow our business)

7. Cookies and Tracking Technologies

Our website may use cookies and similar tracking technologies to enhance your experience and analyse site usage.

7.1. What Are Cookies?

Cookies are small text files placed on your device when you visit a website. They help websites remember your preferences and improve functionality.

7.2. Types of Cookies We Use

Essential Cookies/Strictly Necessary Cookies: These cookies are necessary for the website to function properly. They enable basic features like page navigation, form submission, and secure access. These cookies do not require consent under UK GDPR. These essential cookies are always enabled because our website won’t work properly without them. They may include, for example, cookies that enable you to log into secure areas of our website. You can switch off these cookies in your browser settings but you may then not be able to access all or parts of our website.

Analytical or performance Cookies: We may use analytics cookies to understand how visitors interact with our website, which pages are most popular, and how we can improve user experience. These cookies collect anonymous statistical data.

Functionality cookies: These are used to recognise you when you return to our website. This enables us to personalise our content for you, greet you by name and remember your preferences (for example, your choice of language or region).

Targeting cookies: These cookies may record your visit to our website, the pages you have visited and the links you have followed. We will use this information to make our website and the advertising displayed on it more relevant to your interests. We may also share this information with third parties for this purpose so that they can serve you with relevant advertising on their websites.

Marketing Cookies: Marketing cookies may be used by third-party advertisers or platforms to deliver personalised content and track advertising effectiveness. We only use marketing cookies with your explicit consent.

7.3. Managing Cookie Preferences

You can manage your cookie preferences through the cookie consent banner displayed when you first visit our website. You may accept or reject non-essential cookies at any time. You can also adjust cookie settings through your browser settings, though this may affect website functionality.

For users under 16 years old, we require consent from a parent or guardian before setting non-essential cookies.

You can also choose to “Reject All” cookies in the cookie banner.

However, if you use your browser settings to block all cookies (including essential cookies) you may not be able to access all or parts of our website.

If you have any questions or concerns about our use of cookies, please get in contact with us.

8. Data Sharing and Disclosure

We do not sell your personal information to third parties. We may share your data with trusted partners and service providers only when necessary for the delivery of the purposes for which we will use your Personal Data at paragraph 6 above, or with your consent, for example, when you chose to make use of our services with the Openwork Partnership.

We require all third parties to respect the security of your Personal Data and to treat it in accordance with the law. We do not allow our third-party service providers to use your Personal Data for their own purposes and only permit them to process your Personal Data for specified purposes and in accordance with our instructions.

8.1. Service Providers

We may work with third-party service providers who assist us with:

Website hosting and technical infrastructure;
Financial services and advice delivery;
Learning Management System (LMS) delivery; and
Analytics and website performance monitoring.

8.2. Employer Services

When we provide services to employers, we may share aggregated, anonymised data about employee engagement and programme effectiveness with the employer organisation. Individual employee information remains confidential unless you explicitly consent to disclosure.

8.3. Legal Requirements

We may disclose your information if required by law, regulation, legal process, or governmental request, including:

Compliance with legal obligations;
Protection of our rights, property, or safety; and
Prevention of fraud or unlawful activity.

8.4. Funding Partners

As a social enterprise, we receive funding from various organisations. We may share anonymised programme data and impact metrics with funders for reporting and evaluation purposes. Personal identifiable information is not shared without consent.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal information from being accidently lost or from unauthorised access, alteration, disclosure, or destruction. Our security measures include:

Secure server infrastructure with encryption;
Access controls limiting access to Personal Data to a business need to know basis;
Regular security assessments and updates;
Staff training on data protection and confidentiality;
Secure disposal of data when no longer needed;
Confidential handling of sensitive financial information.

However, no method of transmission over the internet or electronic storage is completely secure. While we strive to protect your data, we cannot guarantee absolute security. We have put in place procedures to deal with any suspected Personal Data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

10. Data Retention

10.1. We may retain your personal information only for as long as reasonably necessary to fulfil the purposes for which it was collected, including to comply with legal, regulatory, tax, accounting and reporting obligations, resolve disputes, provide our service and enforce our agreements.

10.2. To determine the appropriate retention period for Personal Data, we consider the amount, nature and sensitivity of the Personal Data, the potential risk of harm from unauthorised use or disclosure of your Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

10.3. By law we have to keep basic information about our customers (including Contact, Identity, Financial and Transaction Data) for six years after they cease being customers for tax purposes.

10.4. In some circumstances you can ask us to delete your data: see paragraph 11 below for further information.

10.5. In some circumstances we will anonymise your Personal Data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

11. Your Rights

11.1. Under UK GDPR and Data Protection Act 2018, you have the following rights regarding your Personal Data: Request Access (commonly known as a “subject access request”). You can request a copy of the Personal Data we hold about you, along with details of how we use it.

11.2. Request Rectification: If your Personal Data is inaccurate or incomplete, you can request that we correct or complete it. We may need to verify the accuracy of the new data you provide to us.

11.3. Request Erasure: You can request deletion or removal of your Personal Data in certain circumstances, such as when it’s no longer necessary for the purpose it was collected or when you withdraw consent.

11.4. Right to Restrict Processing: You can request that we limit how we use your Personal Data in specific situations, such as while we investigate a complaint about data accuracy.

11.5. Right to Data Portability: You can request your Personal Data in a structured, commonly used format to transfer to another service provider.

11.6. Right to Object: You can object to processing based on legitimate interests or for direct marketing purposes. We will stop processing unless we have compelling legitimate grounds.

11.7. Right to Withdraw Consent: Where processing is based on consent, you can withdraw it at any time. This won’t affect the lawfulness of processing before withdrawal.

12. Exercising Your Rights

12.1. No fee usually required

You will not have to pay a fee to access your Personal Data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

12.2. What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access your Personal Data (or to exercise any of your other rights). This is a security measure to ensure that Personal Data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

12.3. Time limit to respond

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

To exercise any of these rights, please contact us at:

Email: info@kithandkinfinance.org Phone: 028 9087 7777

We will respond to your request within one month. In complex cases, we may extend this by two months and will notify you of any delay.

13. Data Mapping and Processing Activities

13.1. We maintain comprehensive records of all data processing activities in accordance with UK GDPR requirements. Our data mapping includes:

Categories of Personal Data processed;
Purposes for which data is used;
Data subjects and sources of information;
Third parties with whom data is shared;
Data retention schedules;
Security measures in place; and
International data transfers (if applicable).

13.2. We regularly review and update our data mapping to ensure compliance with data protection regulations.

13.3. For further information, please see our data mapping policy.

14. International Data Transfers

We primarily process data within the United Kingdom. If we need to transfer data outside the UK or European Economic Area, we will ensure appropriate safeguards are in place, such as:

Adequacy decisions by the UK government;
Standard contractual clauses; and
Other legally recognised transfer mechanisms.

15. Children’s Privacy

15.1. Our website and general services are not intended for children under 16. We provide youth financial education programmes for young people entering working life, which may involve collecting limited personal information with appropriate consent from parents, guardians, or educational institutions.

15.2. For website users under 16, we require parental or guardian consent before setting non-essential cookies or collecting personal information.

16. Third-Party Links

Our website may contain links to third-party websites and services. We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies before providing any personal information.

17. Changes to This Policy

17.1. We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. We will notify you of significant changes by posting the updated policy on our website with a new “Last Updated” date.

17.2. We encourage you to review this policy periodically. Continued use of our services after changes indicates your acceptance of the updated policy.

18. Complaints

If you have concerns about how we handle your Personal Data, please contact us first so we can address your concerns:

Email: info@kithandkinfinance.org Phone: 028 9087 7777

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s supervisory authority for data protection:

Information Commissioner’s Office Wycliffe House, Water Lane Wilmslow, Cheshire SK9 5AF Phone: 0303 123 1113 Website: www.ico.org.uk

However, before doing so please make sure you have first made your complaint to us or asked us for clarification if there is something you do not understand. Please contact us.

19. Contact Information

For questions, concerns, or requests regarding this Privacy Policy or your Personal Data, please contact us:

Kith and Kin Financial Wellbeing NICVA Building 61 Duncairn Gardens Belfast BT15 2GB Northern Ireland, United Kingdom Phone: 028 9087 7777 Email: info@kithandkinfinance.org Alternative Email: info@kithandkinwellbeing.org Website: www.kithandkinwellbeing.org

This Privacy Policy was last reviewed and updated in November 2025 by Edwards Solicitors.