Privacy Policy

Last updated: 21 July 2026

IDACH respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how IDACH collects, uses, stores, and protects personal information when you visit https://idach.co.uk, submit an enquiry through the website, or contact IDACH by email.

This Privacy Policy primarily covers use of the website and initial enquiries. Where an organisation commissions IDACH to provide professional services, additional confidentiality, information-sharing, data-protection, and record-handling arrangements may be set out in the relevant commissioning agreement or terms of engagement.

1. Who is responsible for your information?

For the purposes of applicable UK data-protection law, the data controller responsible for information collected through this website is:

IDACH
Email: [email protected]

References in this Privacy Policy to “IDACH”, “we”, “us”, or “our” refer to the person or organisation responsible for operating the website and handling enquiries submitted through it.

IDACH does not currently publish a business or correspondence address on the website. Privacy and data-protection enquiries may be submitted using the email address above.

2. Information we collect

Information submitted through the enquiry form

When you submit an enquiry through the website, we collect:

• your name;
• the name of your organisation;
• your email address;
• the contents of your message;
• confirmation that you agree to be contacted about the enquiry; and
• any other information you choose to include in your message.

The enquiry form is intended for general enquiries, training enquiries, commissioning discussions, and initial contact concerning IDACH’s services.

Information provided by email

If you contact IDACH directly by email, we may collect:

• your name;
• your email address;
• your organisation and professional role, where provided;
• the contents of your correspondence;
• any attachments you send; and
• any other information you choose to provide.

Technical information

When you access the website, certain technical information may be collected automatically by the website, hosting provider, server, or security systems.

This may include:

• your IP address;
• browser type and version;
• device type;
• operating system;
• pages visited;
• referring website;
• date and time of access;
• approximate location derived from your IP address;
• error and diagnostic information; and
• security-related information.

This information is generally used to operate, maintain, secure, and troubleshoot the website.

3. Sensitive information and case details

IDACH provides services relating to adoption disruption, placement breakdown, learning reviews, panel chairing, and professional training.

Information connected with these services may potentially include highly sensitive personal information relating to children, adopters, birth families, foster carers, professionals, or other individuals.

This may include information concerning:

• children and family relationships;
• adoption or fostering;
• physical or mental health;
• disabilities or additional needs;
• racial or ethnic origin;
• religious or philosophical beliefs;
• sexual orientation;
• social-care involvement;
• allegations, complaints, or safeguarding concerns;
• criminal offences or alleged offences; and
• other private or confidential circumstances.

Some of this information may constitute special category personal data or criminal-offence data under UK data-protection law.

Do not submit case records through the enquiry form

The public enquiry form is not intended for the transmission of:

• adoption case files;
• child permanence reports;
• assessments;
• medical records;
• court documents;
• meeting minutes;
• safeguarding records;
• documents containing identifiable information about children or families; or
• other confidential case materials.

At the initial enquiry stage, please provide only the information reasonably necessary for IDACH to understand the nature of your request.

Where confidential documents are required after a service has been commissioned, IDACH and the commissioning organisation should agree an appropriate and secure method of transfer.

4. Information about other people

Your enquiry may refer to colleagues, professionals, adopters, children, family members, or other individuals.

You should provide information about another person only where it is necessary, proportionate, and lawful to do so.

Where possible, avoid including names or other identifying details about children, families, or individuals in the initial enquiry.

The commissioning organisation remains responsible for ensuring that it has an appropriate lawful basis for sharing personal information with IDACH as part of any commissioned service.

5. How we use personal information

We may use information collected through the website or by email to:

• receive and respond to enquiries;
• communicate with you about your enquiry;
• understand the nature and scope of a potential commission;
• provide information about IDACH’s services, availability, fees, or commissioning process;
• discuss training, independent chairing, learning reviews, or related services;
• maintain a record of correspondence;
• follow up on an enquiry where appropriate;
• manage complaints, concerns, or data-protection requests;
• protect the website against spam, fraud, misuse, or malicious activity;
• maintain the security and functionality of the website;
• obtain professional advice;
• comply with legal and regulatory obligations; and
• establish, exercise, or defend legal claims.

Information submitted through the enquiry form will not be used for unrelated purposes.

6. Lawful bases for processing

Under UK data-protection law, IDACH must have a lawful basis for processing personal information.

Depending on the circumstances, we may rely on the following lawful bases.

Taking steps before entering into a contract

We may process your information where it is necessary to:

• respond to a request for information;
• discuss a potential commission;
• provide information about services or fees;
• clarify the proposed scope of work; or
• take other steps at your request before an agreement is entered into.

Performance of a contract

Where IDACH has been commissioned to provide services, personal information may be processed where necessary to perform the relevant agreement.

Specific processing arrangements may also be set out in the commissioning agreement, terms of engagement, privacy information, data-sharing agreement, or data-processing agreement.

Legitimate interests

We may process personal information where it is necessary for IDACH’s legitimate interests, provided those interests are not overridden by your rights and interests.

These legitimate interests may include:

• responding to professional enquiries;
• operating and administering the service;
• maintaining appropriate business records;
• communicating with commissioning organisations;
• securing and maintaining the website;
• preventing spam, fraud, or misuse;
• managing complaints;
• obtaining professional or legal advice; and
• establishing or defending legal claims.

Legal obligations

We may process information where necessary to comply with a legal obligation, court order, regulatory requirement, or lawful request from a public authority.

Consent

In some circumstances, we may rely on consent.

The website enquiry form asks you to confirm that IDACH may contact you about your enquiry.

Where processing is based on consent, you may withdraw your consent at any time by contacting [email protected].

Withdrawal will not affect the lawfulness of processing that took place before consent was withdrawn.

7. Special category and criminal-offence data

Special category personal data requires both a lawful basis and an additional condition under UK data-protection law.

Where this information is processed as part of an initial enquiry or commissioned service, the applicable condition will depend on the circumstances and may include:

• explicit consent;
• processing necessary for the establishment, exercise, or defence of legal claims;
• processing necessary for reasons of substantial public interest where supported by law;
• processing necessary to protect vital interests in exceptional circumstances; or
• another condition permitted under the UK GDPR and Data Protection Act 2018.

Criminal-offence data will be processed only where permitted by law and where appropriate safeguards are in place.

The commissioning organisation and IDACH should establish their respective data-protection responsibilities before confidential case information is transferred.

8. Commissioned services

Where a local authority, regional adoption agency, voluntary adoption agency, or other organisation commissions IDACH, the work may involve:

• reviewing relevant documentation;
• liaising with professionals and adopters;
• coordinating meetings;
• chairing disruption or placement-breakdown meetings;
• taking minutes;
• preparing reports;
• conducting learning reviews;
• chairing adoption or fostering panels; or
• delivering training and reflective-learning sessions.

The nature and extent of personal-information processing will depend on the commissioned service.

Before case information is shared, the commissioning organisation and IDACH should agree matters including:

• the purpose and scope of processing;
• whether IDACH acts as an independent controller, joint controller, or processor;
• the lawful basis for information sharing;
• what information is necessary;
• how documents will be transferred;
• who may access the information;
• retention and deletion arrangements;
• information-security requirements;
• procedures for data-protection requests;
• procedures for personal-data breaches; and
• arrangements for returning or securely deleting documents after the work concludes.

This website Privacy Policy does not replace those case-specific or contractual arrangements.

9. Enquiry form and email communications

Information submitted through the website enquiry form is transmitted so that IDACH can receive and respond to your message.

The website hosting provider, website platform, form-processing system, email provider, or spam-prevention system may process or temporarily store information submitted through the form.

Reasonable measures are used to protect communications. However, no online form or ordinary email system can be guaranteed to be completely secure.

You should not send confidential case files or highly sensitive documents to [email protected] unless an appropriate transfer method has first been agreed.

10. Cookies and similar technologies

Cookies are small text files placed on your device when you visit a website.

The website may use cookies or similar technologies where necessary to:

• operate the website;
• maintain security;
• prevent spam or malicious form submissions;
• remember privacy preferences;
• provide reliable page delivery; and
• support essential website functionality.

Strictly necessary cookies may be used without consent where they are required for the website to function.

The website does not provide:

• online customer accounts;
• online payment processing;
• appointment-booking functionality; or
• online meeting functionality.

Where non-essential analytics, advertising, embedded media, or similar technologies are introduced, any consent required by law should be obtained before those technologies are activated.

You can control or delete cookies through your browser settings. Blocking essential cookies may affect the operation of parts of the website.

11. Analytics and tracking

IDACH does not use information submitted through the enquiry form for advertising profiling.

Where the website does not use third-party analytics or advertising technologies, only basic technical information may be collected through hosting, server, security, and diagnostic logs.

Should analytics or tracking technologies be introduced in the future, this Privacy Policy and any cookie notice should be updated accordingly.

12. Sharing personal information

IDACH does not sell or rent personal information.

Information collected through the website may be shared only where reasonably necessary with:

• website hosting providers;
• website maintenance and technical-support providers;
• email providers;
• form-processing or spam-prevention providers;
• professional advisers, including legal advisers, accountants, insurers, or information-security advisers;
• regulators, courts, law-enforcement agencies, safeguarding authorities, or public bodies where disclosure is required or permitted by law; and
• another person or organisation where you have authorised the disclosure.

Where IDACH has been commissioned to provide professional services, information may also be shared with authorised participants or representatives of the commissioning organisation where necessary for the agreed work.

Service providers should process personal information only as necessary to provide their services and should apply appropriate confidentiality and security measures.

13. International transfers

Some hosting, email, security, or technical providers may process information outside the United Kingdom.

Where personal information is transferred internationally, reasonable steps will be taken to ensure that the transfer is permitted under UK data-protection law.

Safeguards may include:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to the European Commission’s standard contractual clauses;
• appropriate contractual and technical safeguards; or
• another legally recognised transfer mechanism.

You may contact [email protected] for further information about the safeguards relevant to a particular provider.

14. How long we retain information

Personal information is retained only for as long as reasonably necessary for the purpose for which it was collected.

As a general guide:

• initial enquiries that do not result in further discussions may normally be retained for up to 12 months after the last meaningful communication;
• commissioning and contractual correspondence may normally be retained for up to 6 years after the relevant work or agreement ends;
• financial and business records may be retained for the period required by tax, accounting, insurance, or legal obligations;
• website security and server logs may be retained for a shorter period determined by the relevant provider;
• complaints, disputes, safeguarding concerns, or legal claims may be retained for as long as reasonably necessary to address the matter; and
• case documents and professional records will be retained in accordance with the relevant commissioning agreement, information-sharing arrangements, legal obligations, and agreed retention schedule.

Personal information may be deleted earlier where it is no longer required.

It may be retained for longer where required by law or necessary to protect legal rights.

15. Data security

Reasonable technical and organisational measures are used to protect personal information against:

• unauthorised access;
• accidental loss;
• misuse;
• alteration;
• disclosure; and
• destruction.

These measures may include:

• encrypted website connections;
• secure website hosting;
• access controls;
• password protection;
• multi-factor authentication where available;
• software and security updates;
• spam and security controls;
• secure document-transfer methods;
• backups;
• confidentiality requirements; and
• limiting access to individuals who reasonably require the information.

No method of transmitting or storing information electronically is completely secure. Absolute security cannot therefore be guaranteed.

16. Confidentiality

Information received through enquiries and commissioned services will be handled confidentially, subject to legal and professional limitations.

Information may be disclosed where:

• disclosure has been authorised;
• disclosure is necessary to provide the commissioned service;
• disclosure is required by law, court order, or lawful authority;
• disclosure is necessary to obtain confidential legal, insurance, or professional advice;
• there is a safeguarding concern involving a child or vulnerable person;
• there is a serious risk of harm to an individual; or
• disclosure is otherwise necessary and permitted under applicable law.

Statutory safeguarding and decision-making responsibilities remain with the relevant commissioning organisation.

17. Your data-protection rights

Depending on the circumstances, you may have the right to:

• request access to personal information held about you;
• request correction of inaccurate or incomplete information;
• request deletion of your information;
• request restriction of processing;
• object to processing based on legitimate interests;
• withdraw consent where processing is based on consent;
• request the transfer of information you provided in a structured and commonly used format;
• request information about international-transfer safeguards; and
• complain to a data-protection supervisory authority.

These rights are not absolute.

In some circumstances, IDACH may be required or permitted to retain information or refuse a request. This may apply where information concerns other people, legal obligations, safeguarding matters, professional confidentiality, or legal claims.

Where IDACH processes information on behalf of a commissioning organisation, a request may need to be referred to that organisation.

We may need to verify your identity before responding to a request.

To exercise a data-protection right, contact:

[email protected]

18. Complaints

Please contact IDACH first if you have concerns about how your personal information has been handled:

[email protected]

You also have the right to complain to the UK data-protection supervisory authority:

Information Commissioner’s Office

Information about raising a concern is available through the Information Commissioner’s Office website.

19. Children’s information

The website is intended primarily for adult professionals and organisations.

Children should not submit personal information through the website.

Although IDACH’s professional services may concern children, identifiable information about a child should not be submitted through the public enquiry form.

Where children’s information is processed as part of a commissioned service, it will be handled with particular care and in accordance with the relevant legal, contractual, safeguarding, and information-sharing requirements.

20. Marketing communications

Submitting an enquiry will not automatically add you to a marketing mailing list.

The website does not currently provide a newsletter or marketing registration form.

IDACH may contact you only as reasonably necessary to respond to or follow up on your enquiry.

If marketing communications are introduced in the future, they will be sent only where there is an appropriate lawful basis. Recipients will be able to unsubscribe at any time.

21. Automated decision-making

Personal information submitted through the website is not used to make solely automated decisions that produce legal or similarly significant effects concerning an individual.

22. Third-party links

The website may contain links to websites or services operated by third parties.

IDACH is not responsible for the privacy, security, content, or practices of third-party websites. You should review their privacy information before submitting personal information to them.

23. Changes to this Privacy Policy

This Privacy Policy may be updated from time to time to reflect changes to:

• the website;
• the enquiry form;
• IDACH’s services;
• service providers;
• data-protection practices;
• contractual arrangements; or
• legal and regulatory requirements.

The updated version will be published on this page with a revised “Last updated” date.

24. Contact

For questions about this Privacy Policy, the use of personal information, or your data-protection rights, contact:

IDACH
Email: [email protected]