Effective from July 2025

Little Troopers (“we”, “us”, “our”) is committed to respecting and protecting your privacy. This policy explains how we collect, use, and look after your personal data when you visit our website or interact with us. It also tells you about your rights and how the law protects you.

1. Who We Are

This website is operated by Little Troopers, a registered charity supporting military children. We are the controller responsible for your personal data. We are committed to complying with the UK General Data Protection Regulations (UK GDPR) and the Data Protection Act 2018, as well as the ICO’s Age Appropriate Design Code (Children’s Code), especially when processing the data of children.

If you have any questions about this policy or your data, contact us at:

Email: [email protected]
Post: Little Troopers, Gladstone House, 77-79 High Street, Egham, Surrey TW20 9HY

2. The Data We Collect

We may collect and use the following types of personal data:

• Identity Data: name, title, date of birth
• Contact Data: email address, postal address, phone number
• Shop payment data (we do not directly store your payment card details. Payments for our shop are processed securely by via Stripe.  We only receive confirmation of payment from Stripe, not your full card details.)
• Technical Data: IP address, browser type, device ID
• Usage Data: how you use our site
• Marketing Preferences: your choices for how we contact you

2.1 Special Considerations for Data Collected About Children (Therapy Referral Form)

Whilst we do not knowingly collect information from children under 13 across our website, we do collect personal data about children under 13 specifically through our Therapy Referral Form. 

This data is provided by a parent, carer, or school on behalf of the child. This data is collected solely for the purpose of assessing eligibility for and facilitating access to our therapy scheme for military children.

The types of personal data we collect about children via the Therapy Referral Form may include:

• Child’s Identity Data:Name, date of birth.
• Child’s Background Information:Details relevant to their military family background and the specific challenges or needs for which therapy is being sought. This may include sensitive information related to the child’s health or wellbeing, which is considered ‘special category data’ under UK GDPR.
• Parent/Carer/School Contact Data:Details of the adult making the referral, including their name, relationship to the child, and contact information, necessary for obtaining consent and coordinating the therapy.

We only collect the minimum amount of data necessary for the purpose of the therapy referral, in line with the Age Appropriate Design Code’s data minimisation principle (Standard 8).

3. How We Collect Your Data

We may collect your data:

• When you fill out forms (e.g., sign up for our newsletter, donate, apply to events, therapy referral form, purchase via online shop)
• When you email, call, or write to us
• Automatically through cookies and similar technologies (see our Cookie Policy)
• From third-party services (e.g., Google Analytics)

3.1. Collecting Data About Children (Under 13) via the Therapy Referral Form 

For data about children under 13, which is provided by a parent, carer, or school through the Therapy Referral Form, we require verifiable parental consent before processing this personal data. This is in accordance with Article 8 of the UK GDPR.

Our process for obtaining verifiable parental consent typically involves:

• Parental/Carer/School Declaration:The adult completing the Therapy Referral Form must confirm they have parental responsibility for the child (or appropriate authority from the parent/legal guardian if a school) and provide their explicit consent for the collection and processing of the child’s data for therapy referral purposes.
• Follow-up Verification:We may follow up with the parent/carer/school using contact details provided (e.g., a phone call or email to a verified address) to confirm consent and identity.
• Specific Consent for Sensitive Data:For any ‘special category data’ relating to a child’s health or wellbeing collected via the therapy referral form, explicit consent from the parent or legal guardian is specifically requested.

4. How and Why We Use Your Data

We only use your data when the law allows us to. Common reasons include:

Purpose: To send you our newsletter
Type of Data: Contact
Legal Basis: Your consent

Purpose: To manage donations or orders
Type of Data: Identity, Contact, Financial
Legal Basis: Contract or legitimate interest

Purpose: To improve our site and content
Type of Data: Technical, Usage
Legal Basis: Legitimate interest

Purpose: To comply with law
Type of Data: All as required
Legal Basis: Legal obligation

We never sell your data. We may share it with trusted third parties (e.g., our IT providers or donation processors) strictly for the purpose it was collected.

You can unsubscribe from our emails anytime by clicking the unsubscribe link or emailing us.

We never use data collected about children via the Therapy Referral Form for marketing, profiling, or targeted advertising purposes, in line with the Age Appropriate Design Code (Standards 12 and 13)

4.1. How and Why We Use Data Collected About Children (Therapy Referral Form) 

For data collected about children under 13 via the Therapy Referral Form, we use this information solely for the following purposes:

• To assess the child’s eligibility for the Little Troopers Therapy Programme.
• To facilitate the referral to appropriate therapy partners.
• To monitor the progress and effectiveness of the therapy programme (in an anonymised or aggregated form where possible, or with further parental consent for specific case studies).
• Legal Basis:We process children’s personal data, including special category data, based on explicit parental consent (Article 9(2)(a) UK GDPR) and/or for reasons of substantial public interest (Article 9(2)(g) UK GDPR) relating to charitable activities supporting children’s welfare.

5. Marketing and Your Choices

We may send you updates about our charity, campaigns, or events if:

• You’ve opted in, or
• You’ve previously supported us and didn’t opt out

You can update your preferences at any time.

We will never share your personal data with third parties for their own marketing without your express permission.

6. Cookies

We use cookies to make our website work and improve your experience. You can change your cookie preferences at any time in your browser settings. See our Cookie Policy for more info.

7. Sharing Your Information

We may share your data with:

• Our team and trusted partners (e.g., donation platforms, IT providers, therapy partners (for therapy referrals))
• Regulators or law enforcement (if required)
• A successor organisation if we merge or restructure

All our partners are required to handle your data lawfully and securely.

7.1. Sharing Data Collected About Children (Therapy Referral Form) 

When sharing data collected about children via the Therapy Referral Form, we do so only with trusted therapy partners who are engaged by Little Troopers to provide the therapy services. This sharing is done strictly for the purpose of delivering the therapy, and under strict data processing agreements that ensure compliance with UK GDPR and the Children’s Code. We perform due diligence on all therapy partners to ensure they meet our high standards for data protection and child safeguarding. Data about children is only shared with these partners after verifiable parental consent has been obtained for the therapy referral.

8. International Transfers

We don’t usually transfer your data outside the UK. If we ever need to, we’ll make sure it’s properly protected using approved safeguards like standard contractual clauses.

9. How We Keep Your Data Safe

We have strong technical and organisational security measures in place to prevent your data from being lost, accessed without permission, or misused. Access is limited to those who genuinely need it, and they are bound by confidentiality obligations.

In line with the Age Appropriate Design Code (Standard 7), we implement specific measures to protect data collected about children, including:

• Encryption of sensitive data, especially that collected via the Therapy Referral Form.
• Access controls to ensure only authorised personnel involved in the therapy referral process can access data about children.
• Regular security audits and staff training on data protection, with specific emphasis on handling children’s personal data.
• All systems used for processing data about children are designed with high privacy settings by default.

10. How Long We Keep Your Data

We only keep your data as long as necessary for the purpose it was collected. For example, we might retain supporter data for up to 6 years for tax purposes.

If you unsubscribe or ask us to delete your data, we will do so unless we have a legal reason to retain it.

10.1. Retention of Data Collected About Children

Personal data collected about children via the Therapy Referral Form will be retained only for as long as necessary to facilitate the therapy referral process and for a reasonable period thereafter for administrative and accountability purposes (e.g., to demonstrate compliance with parental consent and data sharing agreements). Once the data is no longer needed, it will be securely deleted.

11. Your Rights

You have the right to:

• Request access to your personal data
• Ask us to correct inaccurate data
• Ask us to delete your data
• Object to or restrict how we use your data
• Withdraw consent at any time
• Ask us to transfer your data to another provider

To exercise any of these rights, please contact us (see Section 1). We may ask you to confirm your identity for security reasons.

11.1. Parental/Carer/School Rights Regarding Data Collected About Children 

As a parent, carer, or school representative who has provided data about a child and/or provided consent for your child’s data to be collected via the Therapy Referral Form, you have the right to:

• Withdraw Consent:You can withdraw your consent for the collection and processing of data about your child at any time. This will not affect the lawfulness of processing based on consent before its withdrawal.
• Access Data About Your Child:Request access to the personal data we hold about your child.
• Request Deletion:Ask us to delete personal data about your child.
• Object to or Restrict Processing:Object to or request the restriction of how we use data about your child.

To exercise any of these parental/carer/school rights, please contact us using the details in Section 1.

12. Complaints

You can contact us with any concerns using the details in Section 1. If you’re not satisfied, you also have the right to complain to the UK Information Commissioner’s Office (ICO): www.ico.org.uk

13. Changes to This Policy

We keep this policy under regular review and will update it when necessary. Please check back from time to time to stay informed.

14. Links to Other Websites

Our site may contain links to other websites. We are not responsible for their privacy practices. We recommend you read their policies too.