fbpx

TAKE THE CHALLENGE, BE AT YOUR BEST

Privacy Policy

Policy Introduced:

January 2006

Policy reviewed annually, most recent review:

1st July 2020
Policy Reviewed by:
Dominic Taylor (Operations Director)
Key contact details:
Data Protection Compliance Lead
Dom Taylor – dom@we-activate.co.uk 0121 227 4385

What is in this policy

Legislation and relevant guidance:
Privacy Policy Statement
Additional information for Staff & Volunteers Special categories of personal information Where we collect your information

Where we store your personal data
Uses made of the information
Disclosure of your personal information
How long do we keep personal information for? Your rights

Our Legal basis for capturing and processing data Sharing Information
When and how to share information – Flowchart Central NCS Documentation

Legislation and relevant guidance:

Activate is committed to ensuring that policies and procedures remain up to date and are reflective of current legislation and guidance, currently including:

General Data Protection Regulation 2018

Updates:
Activate achieved Cyber Essentials on 15t h May 2020 – IASME-CE-000369

Privacy Policy Statement

Activate Management Limited consists of several divisions that offer a variety of different types of services and activities.

  • Activate Camps
  • Activate NCS
  • Activate Management
  • Proactive Reporting & Training
  • Activate ILS
  • Activate Recrutement

Activate Management Limited (we) are committed to protecting and respecting the privacy of our course/service participants, their parents/guardians/carers, all of our staff, and any other people from whom we collect data (collectively, you).
This policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it.

For the purpose of the General Data Protection Regulation 2018 (the Act), the data controller is Activate Management Limited. However in some instances (for example NCS), Activate may act as only a data processor, acting as a contractor for a designated data controller. In these instances Activate will ensure that those data controllers meet the requirements of GDPR, and we will adopt their processes and privacy policies for the term of our contract with them.

We have not appointed a Data Protection Officer to oversee our compliance with data protection laws as we are not required to do so, but our Data Protection Compliance Manager has overall responsibility for data protection compliance in our organisation.

Contact details are set out in the “Contacting us” section at the end of this privacy notice.

Information we may collect from you

We may collect and process the following data about you:

  • Information that you provide by filling in application forms and/or forms on our websites (our sites). This includes information provided at the time of applying for a place on any course, or registering to use our site, applying for roles at Activate, or requesting further services (e.g. purchase of goods). We may also ask you for information on the telephone or if you report a problem with our site;
  • We take photographs and videos of those participating in our courses, to which you have consented as part of the application and booking process, you have the right to opt out of these images at any point;
  • Records of your interactions with us such as telephone conversations, emails and other correspondence and your instructions to us;
  • We may also ask you to complete surveys that we use for research purposes, although you do not have to respond to them;
  • Any credit/debit card and other payment details you provide so that we can receive payments from you and details of the financial transactions with you. This may be through our websites, telephone or by post.
  • Details of your visits to our site including, but not limited to, traffic data, location data, weblogs and other communication data, whether this is required for our own billing purposes or otherwise and the resources that you access.

Personal information we may collect from you

When you sign up for services from us, you may provide us with or we may obtain personal information about you and potentially your siblings/dependents, such as information regarding your booking. This personal information may include:

  • Personal contact details that allows us to contact you directly such as name, title, email addresses and telephone numbers;
  • Date of birth of yourself or siblings for the purpose of booking courses;
  • Gender;
  • Use of and movements through our online portal/database, passwords, personal identification numbers, IP addresses, user names and other IT system identifying information;
  • Records of your attendance at any events hosted by us;
  • Your marketing preferences so that we know whether and how we should contact you.

Additional information for Staff & Volunteers

If you are a member of staff or volunteer who has registered his/her interest in working with us, you may also provide us with or we may obtain the following additional personal information from you:

  • Identification documents such as passport and identity cards;
  • Details of any club and/or county membership;
  • Details of next of kin, family members, coaches and emergency contacts;
  • Records and assessment of performance or coaching/activity leadership practice
  • Any disciplinary and grievance information;
  • Any coaching code or official number;
  • Coaching/teaching qualification and/or officiating history and any player rating;
  • Accreditation/qualification start and end date;

Special categories of personal information We may also collect, store and use the following “special categories” of more sensitive personal information regarding you:

  • Information about your health, including any medical condition, health and sickness records, medical records and health professional information.
  • Criminal records information from you. For criminal records history, we process it on the basis of legal obligations or based on your explicit consent.

In relation to the special category personal data that we do process we do so on the basis that:

  • The processing is necessary for reasons of substantial public interest, on a lawful basis;
  • It is necessary for the establishment, exercise or defence of legal claims;
  • It is necessary for the purposes of carrying out the obligations and exercising our or your rights in the field of employment and social security and social protection law; or
  • Based on your explicit consent.

In the table below (Uses of the information), we refer to these as the “special category reasons for processing of your personal data”.

Where we collect your information

  • We typically collect personal information about you when you create an account/make a booking on our site at www.activatecamps.co.uk or www.we-activate.co.uk
  • When you purchase any services or products we offer online.
  • When you purchase any services or products we offer via telephone to our staff or head office.
  • When you make a query and/or complaint or when you correspond with us by phone, e-mail or in some other way.
  • Face to face at events, recruitment fairs, NCS Presentations, during activities – using paper based or computer formats
  • During our events/activities in the form of photography or video (only with explicit consent from you, please see notes on photography use and storage periods)
  • When collecting feedback through face-to-face or computer-aided methods such as Survey Monkey, Google Forms.
  • When we take images for use in promotional pieces (newspaper/internet), or for current and future publications and/or marketing such as on Facebook, Twitter, Instagram, and on printed literature.
  • If you are providing us with details of referees, next of kin, beneficiaries, family members and emergency contacts they have a right to know and to be aware of how what personal information we hold about them, how we collect it and how we use andmaysharethatinformation. Pleasesharethisprivacynoticewiththoseofthem whom you feel are sufficiently mature to understand it. They also have the same rights as set out in the “Your rights in relation to personal information” section below.

Where we store your personal data

The data that we collect from you will be stored in the United Kingdom and processed by staffs that work for us or for one of our suppliers. Such staff may be engaged in, among other things, the fulfilment of your order, the processing of your payment details and the provision of support services.

By submitting your personal data, you agree to this, storing or processing. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this privacy policy.
All information you provide to us is stored on our secure servers. Any payment transactions will be encrypted using SSL technology.

Unfortunately, the transmission of information via the Internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.
Paper based information is stored in the following ways:

  • At our head office in lockable cabinets (and kept for an agreed period)
  • With our staff who have been DBS checked and have been trained on their responsibilities in relation to this information (e.g. Face to face forms completed atrecruitment fairs, registers and forms used for the operations of camps and events)
  • In a file in a secure room at venues where this has been agreed. In these instances Activate staff will ensure that data is locked away at all times during periods when they are not in attendance.

Once the paper based resources have been used for the purpose that they have designed and/or the information on them has been uploaded into a computer file or database, then we will destroy in a secure manner as much as is reasonably practicable and in order that it doesn’t effect either your or our rights in relation to legal basis.

Any photographs and/or videos of participation in our courses/events will be used solely for the production of promotional materials in printed or electronic form, including websites, multimedia productions, social media posts, course leaflets, prospectuses, advertisements and by our sponsors and partners for the same promotional and marketing purposes.

We will normally store the information we collect on the booking forms for no longer than 5 years. We will usually store photographs and video securely for no longer than 5 years, however such images may be selected for inclusion in our archive and be retained indefinitely.

Uses made of the information

The table below describes the main purposes for which we process your personal information, the categories of your information involved and our lawful basis for being able to do this.

Purpose Personal information Used Lawful basis
All Customers
To administer any membership account(s)/bookings you have with us and managing our relationship with you, [including arranging for any insurance] and dealing with payments and any support, service or product enquiries made by you All contact and membership details, transaction and payment information, records of your interactions with us, and marketing preferences. This is necessary to enable us to properly manage and administer your membership/purchase contract with us.
To arrange and manage any contracts for the provision of any merchandise, products and/or services. All contact and membership details.
Transaction and payment information.		 This is necessary to enable us to properly administer and perform any contract for the provision of merchandise/products/services.
To notify you of changes to our activities, courses or programmes which may affect you. All contact and membership details.
Transaction and payment information.		 This is necessary to enable us to properly administer and perform any contract for the provision of merchandise/products/services.
To send you information which is included within your membership/booking benefits, including details about discount offers, competitions and future events, partner offers and discounts and any updates onActivate and our activities All contact and membership details This is necessary to enable us to properly manage and administer your membership contract with us.
To send you other marketing information we think you might find useful or which you have requested from us, including our newsletters, information about Membership, events, participation products and information about our commercial partners All contact and membership details and marketing preferences Where you have given us your explicit consent to do so.
To answer your queries or complaints Contact details and records of your interactions with us We have a legitimate interest to provide complaint-handling services to you in case there are any issues with your membership.
Retention of records All the personal information we collect We have a legitimate interest in retaining records whilst they may be required in relation to complaints or claims. We need to retain records in order to properly administer and manage your membership/booking and in some cases, we may have legal or regulatory obligations to retain records.

We process special category personal data on the basis of the “special category reasons for processing of your personal data” referred to in section above. Where required we will always seek consent to gather this data from you.

For criminal records history we process it on the basis of legal obligations or based on your explicit consent.
The security of our IT systems Your usage of our IT systems and online portals. We have a legitimate interest to ensure that our IT systems are secure.
To conduct data analytics studies to better understand event attendance and trends within Activate Records of your attendance at any events or competitions hosted by us. We have a legitimate interest in doing so to ensure that our membership/promotional material is targeted and relevant.
For the purposes of promoting Activate, our events/courses/activities and membership packages. Images in video and/or photographic form. Where you have given us your explicit consent to do so.
To provide statistical and background information to our contract providers such as Regional or Governmental bodies All the personal information we collect We have a legitimate interest in doing so to ensure that our membership/promotional material is targeted and relevant. We are also required within some contracts to supply this information.
To comply with health and safety requirements including safeguarding Records of attendance We have a legal obligation and a legitimate interest to provide you and other users of our organisation with a safe environment in which to participate in our activities
To report to governing bodies, government organisations, first aid/medical staff All the personal information we collect We have a legal obligation and a legitimate interest to provide this information with these bodies to maintain a compliant and safe environment in which to participate in our activities
Players/Participants
To make decisions about progression and development through our activities programme and to assist with the delivery of activities to suit all levels All performance and attendance data and information about your health.

Details of any affiliated club and/or county membership.

 This is necessary to enable us to properly manage and administer your development through our activities.

We process special category personal data on the basis of the “special category reasons for processing of your personal data” referred to in section above. We will gather consent if this is required.
To administer and monitor your attendance at events and competitions All non-medical performance and attendance data.

Details of any affiliated club and/or county membership.

 This is necessary to enable us to register you on to and properly manage and administer your time through our activities.
To arrange for any trip or transportation to and from an event Identification documents, details of next of kin, family members and emergency contacts, transaction and payment information, health and medical information. This is necessary to enable us to make the necessary arrangements for the trip and/or transportation to the event.

We process special category personal data on the basis of the “special category reasons for processing of your personal data” referred to in section above
To use information about your physical or mental health (including any injuries) or disability status, to ensure your health and safety and to assess your fitness to participate, to provide appropriate adjustments to our facilities and to monitor and manage sickness absence Health and medical information We process special category personal data on the basis of the “special category reasons for processing of your personal data” referred to in section above.
To gather evidence for possible grievance or disciplinary hearings All the personal information we collect including any disciplinary and grievance information. We have a legitimate interest in doing so to provide a safe and fair environment for all customers and to ensure the effective management of any disciplinary hearings, appeals and adjudications.

We process special category personal data on the basis of the “special category reasons for processing of your personal data” referred to in section 2 above.

For criminal records history we process it on the basis of legal obligations or based on your explicit consent.
For the purposes of equal opportunities monitoring Name, title, date of birth, gender, information about your race or ethnicity, health and medical information and

Performance data

 We have a legitimate interest to promote an environment that is inclusive, fair and accessible.

We process special category personal data on the basis of the “special category reasons for processing of your personal data” referred to in section 2 above.
Staff and Volunteers
To administer your attendance at any courses or programmes you sign up to All contact details, transaction and payment data.
Details of your current affiliated club or other, coaching/teaching qualifications and/or officiating history.		 This is necessary to enable us to register you on to and properly manage and administer your development through the course and/or programme.
To conduct performance reviews, managing performance and determining performance requirements All performance and attendance data and information about your health.

Details of your current affiliated club or other, coaching/teaching qualifications and/or officiating history.

 This is necessary to enable us to properly manage and administer your development through the course and/or programme.

We process special category personal data on the basis of the “special category reasons for processing of your personal data” referred to in section above.
Qualification start & end dates.
To make decisions about your progression and accreditation status As above. As above.
To comply with legal obligations, for example, regarding people working with children or vulnerable adults to comply with our safeguarding requirements Information about your criminal convictions and offences For criminal records history we process it on the basis of legal obligations or based on your explicit consent.
To arrange for any trip or transportation to and from an event Identification documents, details of next of kin, family members and emergency contacts, transaction and payment information, health and medical information. This is necessary to enable us to make the necessary arrangements for the trip and/or transportation to the event.

We process special category personal data on the basis of the “special category reasons for processing of your personal data” referred to in section above.

For some of your personal information you will have a legal, contractual or other requirement or obligation for you to provide us with your personal information. If you do not provide us with the requested personal information we may not be able to admit you as a member or we may not be able to properly perform our contract with you or comply with legal obligations and we may have to terminate your position as a member/customer. For other personal information you may not be under an obligation to provide it to us, but if you do not provide it then we may not be able to properly perform our contract with you.

Where you have given us your consent to use your personal information in a particular manner, you have the right to withdraw this consent at any time, which you may do by contacting us as described in the “Contacting us” section below.

Please note however that the withdrawal of your consent will not affect any use of the data made before you withdrew your consent and we may still be entitled to hold and process the relevant personal information to the extent that we are entitled to do so on bases other than your consent. Withdrawing consent may also have the same effects as not providing the information in the first place, for example we may no longer be able to provide certain member benefits to you.

Direct Marketing

Email, post and SMS marketing: we may contact you by email, post or SMS with

information about products and services we believe you may be interested in.

We will only send marketing messages to you in accordance with the marketing preferences you set. You can then let us know at any time that you do not wish to receive marketing messages by emailing us at info@activatecamps.co.uk. You can also

unsubscribe from our marketing by clicking on the unsubscribe link in the marketing messages we send to you.

Disclosure of your personal information

We share personal information with the following parties and for the following reasons:

  • Any party approved by you.
  • To any governing bodies or regional bodies for the activities covered by Activate: to allow them to properly administer the activities on a local, regional and national level.
  • Other service providers: for example, email marketing specialists, payment processors, data analysis CCTV contractors, promotional advisors, contractors or suppliers and IT services (including CRM, website, video- and teleconference services);
  • Our supply chain partners & sub-contractors, such as couriers, import/export agents, shippers,
  • Our Commercial Partners: for the purposes of providing you with information on any tickets, special offers, opportunities, products and services and other commercial benefits provided by our commercial partners as part of your membership/customer package] and where required in instances where you have given your express for us to do so.
  • The Government or our regulators: where we are required to do so by law or to assist with their investigations or initiatives.
  • Police, law enforcement and security services: to assist with the investigation and prevention of crime and the protection of national security.
  • In the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets;
  • If Activate Management Limited or substantially all of its assets are acquired by a third party, in which case personal data held by it about its customers will be one of the transferred assets;
  • In order to enforce or apply our terms and conditions, or to protect the rights, property, or safety of Activate Management Limited, our customers, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

Transferring your personal information internationally

The personal information we collect is not transferred to and stored in countries outside of the UK and the European Union.

How long do we keep personal information for?

The duration for which we retain your personal information will differ depending on the type of information and the reason why we collected it from you. However, in some cases personal information may be retained on a long-term basis: for example, personal information that we need to retain for legal purposes will normally be retained in accordance with usual commercial practice and regulatory requirements. Generally, where there is no legal requirement we retain all physical and electronic records for a period of 5 years after your last contact with us. Exceptions to this rule are:

  • Information that may be relevant to personal injury claims, or discrimination claims may be retained until the limitation period for those types of claims has expired. For personal injury or discrimination claims this can be an extended period as the limitation period might not start to run until a long time after you have worked for us.
  • We will normally only market future courses and programmes to those who have booked within the last 3 years, although previously submitted information may be kept on our database for the above stated period.

It is important to ensure that the personal information we hold about you is accurate and up-to-date, and you should let us know if anything changes, for example if you change your phone number or email address.

You are able to update some of the personal information we hold about you by contacting us by using the details set out in the “Contacting us” section below.

Your rights

Your rights in relation to personal information

You have the following rights in relation to your personal information:

  • The right to be informed about how your personal information is being used;
  • The right to access the personal information we hold about you;
  • The right to request the correction of inaccurate personal information we hold about you;
  • The right to request the erasure of your personal information in certain limited circumstances;
  • The right to restrict processing of your personal information where certain requirements are met;
  • The right to object to the processing of your personal information;
  • The right to request that we transfer elements of your data either to you or another service provider; and
  • The right to object to certain automated decision-making processes using your personal information.

You have the right to ask us not to process your personal data or the personal data of your children for marketing purposes. We will usually inform you (before collecting such data) if we intend to use your data for such purposes or if we intend to disclose your information to any third party for such purposes. You can exercise your right to prevent such processing by checking certain boxes on the forms we use to collect your data.

Whilst this privacy notice sets out a general summary of your legal rights in respect of personal information, this is a very complex area of law. More information about your legal rights can be found on the Information Commissioner’s website at https://ico.org.uk/for-the-public/.

To exercise any of the above rights, or if you have any questions relating to your rights, please contact us by using the details set out in the “Contacting us” section below.

If you are unhappy with the way we are using your personal information, you can also complain to the UK Information Commissioner’s Office or your local data protection regulator. We are here to help and encourage you to contact us to resolve your complaint first.

Changes to our privacy policy

We may update this privacy notice from time to time. When we change this notice in a material way, we will update the version date at the start of this notice. For significant changes to this notice we will try to give you reasonable notice unless we are prevented from doing so. Where required by law we will seek your consent to changes in the way we use your personal information.

Access to information

To access your information please contact us directly at info@activatecamps.co.uk or by calling 01785 711572 and we will advise on the best way for us to process your request. Contact
Questions, comments and requests regarding this privacy policy are welcomed and should be addressed to Dom Taylor (Data Protection Compliance Manager), Activate Management Limited, The Fox’s Den, Dunston Business Village, Dunston, Staffordshire, ST18 9AB or info@activatecamps.co.uk

Special Notes:

IP addresses and cookies
We may collect information about your computer, including where available your IP address, operating system and browser type, for system administration and to report aggregate information to our advertisers. This is statistical data about our users’ browsing actions and patterns, and does not identify any individual.
For the same reason, we may obtain information about your general Internet usage by using a cookie file, which is stored on the hard drive of your computer. Cookies contain information that is transferred to your computer’s hard drive. They help us to improve our site and to deliver a better and more personalised service. They enable us:

  • To estimate our audience size and usage pattern.
  • To store information about your preferences, and so allow us to customise our site according to your individual interests.
  • To speed up your searches.
  • To recognise you when you return to our site.
    You may refuse to accept cookies by activating the setting on your browser, which allows you to refuse the setting of cookies. However, if you select this setting you may be unable

to access certain parts of our site. Unless you have adjusted your browser setting so that it will refuse cookies, our system will issue cookies when you log on to our site.
Please note that our sponsors and/or advertisers may also use cookies, over which we have no control.

Our site may, from time to time, contain links to and from the websites of our partner networks, advertisers, sponsors and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites.

Our Legal basis for capturing and processing data

In addition to managing information correctly, Activate Management must, to be compliant with EU GDPR, we also have a legal basis for capturing and processing data. The six legal bases are shown below.

Contractual necessity: the processing is necessary for a contract with the other party or individual, or because they have asked you to take specific steps before entering into a contract e.g. the contract taken out between Activate and a delivery partner.

Legal obligation: the processing is necessary to comply with the law (not including contractual obligations) e.g. being compliant with EU GDPR.

Vital interests: the processing is necessary to protect the life of an individual e.g. a young person’s medical data.

Public interest: the processing is necessary to perform a task in the public interest or for official functions, and the task or function has a clear basis in law e.g. matters pertaining to national security.

Legitimate interests: the processing is justified as part of the core business, or necessary to be able to carry out the stated aims of the organization.

Consent: the individual has given clear consent for us to process their personal data for a specific purpose e.g. a customer allowing Activate to market to them or collect feedback data.

NOTE: under the U.K. implementation of the EU GDPR, the age of consent, i.e. the age at which an individual can agree to share PII or sign up to programme, is 13 years of age.

Sharing Information

Guidance taken from “Information Sharing: Advice for practitioners” in reference to sharing information regarding safeguarding:

The GDPR and Data Protection Act 2018 do not prevent, or limit, the sharing of information for the purposes of keeping children and young people safe.

To effectively share information:

  • All practitioners should be confident of the processing conditions, which allow them to store, and share, the information that they need to carry out their safeguarding role. Information which is relevant to safeguarding will often be data which is considered ‘special category personal data’ meaning it is sensitive and personal
  • Where practitioners need to share special category personal data, they should be aware that the Data Protection Act 2018 includes ‘safeguarding of children and individuals at risk’ as a condition that allows practitioners to share information without consent
  • Information can be shared legally without consent, if a practitioner is unable to, cannot be reasonably expected to gain consent from the individual, or if to gain consent could place a child at risk.
  • Relevant personal information can be shared lawfully if it is to keep a child or individual at risk safe from neglect or physical, emotional or mental harm, or if it is protecting their physical, mental, or emotional well-being.

The principles

The principles set out below are intended to help practitioners working with children, young people, parents and carers share information between organisations. Practitioners should use their judgement when making decisions about what information to share, and should follow organisation procedures or consult with their manager if in doubt.

The most important consideration is whether sharing information is likely to support the safeguarding and protection of a child.

Necessary and proportionate

When taking decisions about what information to share, you should consider how much information you need to release. Not sharing more data than is necessary to be of use is a key element of the GDPR and Data Protection Act 2018, and you should consider the impact of disclosing information on the information subject and any third parties. Information must be proportionate to the need and level of risk.

Relevant

Only information that is relevant to the purposes should be shared with those who need it. This allows others to do their job effectively and make informed decisions.

Adequate

Information should be adequate for its purpose. Information should be of the right quality to ensure that it can be understood and relied upon.

Accurate

Information should be accurate and up to date and should clearly distinguish between fact and opinion. If the information is historical then this should be explained.

Timely

Information should be shared in a timely fashion to reduce the risk of missed opportunities to offer support and protection to a child. Timeliness is key in emergency situations and it may not be appropriate to seek consent for information sharing if it could cause delays and therefore place a child or young person at increased risk of harm.

Practitioners should ensure that sufficient information is shared, as well as consider the urgency with which to share it.

Secure

Wherever possible, information should be shared in an appropriate, secure way. Practitioners must always follow their organisation’s policy on security for handling personal information.

Record

Information sharing decisions should be recorded, whether or not the decision is taken to share. If the decision is to share, reasons should be cited including what information has been shared and with whom, in line with organisational procedures. If the decision is not to share, it is good practice to record the reasons for this decision and discuss them with the requester. In line with each organisation’s own retention policy, the information should not be kept any longer than is necessary. In some rare circumstances, this may be indefinitely, but if this is the case, there should be a review process scheduled at regular intervals to ensure data is not retained where it is unnecessary to do so.

When and how to share information – Flowchart

Central NCS Documentation

In addition Activate will adhere to the guidelines within the central NCS Privacy Policy, details are below which are taken directly from the NCS Home Page www.wearencs.com.
How we collect and use (process) your personal data

NCS collects personal data about young people and delivery staff, amongst others. We need this information to manage the programme and ensure it is carried out in a safe manner. To do this, NCS collects two types of personal data:

Personally identifiable information (PII) – data which can be used to identify and contact a ‘living individual’ connected to programme e.g. name, address and email address. Special category information – personal data that pertains to, but is not limited to, medical, racial or sexual and political life detail, and biometric data such as facial images and voice recordings. This enables us to keep young people safe and healthy, and allows us to support our mission in respect of social cohesion and mobility.

We do not sell personal information to any organisations. We only share data with third parties who are facilitating or enabling the delivery of NCS services.

Purposes for processing your data

NCS processes your data legitimately to provide you with the goods or services you have requested or purchased from us. We also use this information to refine our goods and services to better tailor them to your needs and to communicate with you about other services NCS offer e.g. post-programme opportunities.

Personal data you give to us:

Programme

When young people express an interest in, or sign up for programme, NCS collect information including (but not limited to) name, address email address, personal mailing address, and mobile phone number. We process personal data to deliver programme benefits to young people, and to inform them of NCS events and other benefits or opportunities associated with the NCS experience. NCS may also use this information to help understand those attending programme’s needs and interests to better tailor products and services to the individual.

When delivery staff sign up to deliver a programme, NCS will collect information including (but not limited to) name, employer’s name, your work address, your email address, a personal mailing address, and a mobile phone number. Due to working with young people, NCS will also ask delivery staff if:

  • they have a current Disclosure and Barring Service (DBS) certificate;
  • if not, are willing to undergo a DBS check;
  • if they have previously worked on NCS programme;
  • if yes, for what delivery partner.

Live events

NCS runs many programme and post-programme events (for example, graduate extension opportunities and regional youth boards) throughout the year. If you express an interest in attending one of these events, NCS will access the information in your contact details to provide you with information and services associated with the event.

If you are an external participant at these events, NCS will collect information about you including your name, employer’s name, contact information, and your photograph. We may also collect information provided by event attendees who evaluated your performance as an external participant.

Publications

NCS conduct surveys with young people to produce original research on the effects of the programme on attendees, and society in general. Participation in surveys is voluntary, if you have not been asked, you have not taken part. Although responses to the surveys have names removed, it is anonymous, we still keep this data secure as all other information.

NCS also publish case studies of young people with a particularly interesting story through, or as a consequence of, attending programme. Participation in case studies is voluntary and consent is sought at the start of any of these conversations and before publication. Young people have the ability to withdraw from this activity at any time.

Payment card information

The purchase of goods or services from NCS using a payment card is typically carried out with the parents or guardians of those attending programme. Payment card information is provided directly by users, via the NCS website or over the phone to our customer contact agent. NCS does not, itself, process or store the card information, it is entered into the appropriate system as instructed and then deleted or destroyed.

We strongly encourage all NCS contacts not to submit payment information by email.

Contacting You

NCS will contact you directly if you have expressed an interest in attending programme, or any of our other post-programme events. This can be via telephone, text, email or social media.

From time to time, NCS may also contact you directly with news and opportunities on continuing your NCS journey, and benefits that may become available through our partners. To view a full list of NCS Partners, visit this link. If you have any questions around this list, please contact us at dataprotectionofficer@ncstrust.co.uk.

At all times, you have the right to not receive any of these communications from NCS.

If this is the case please phone our contact centre (0800 197 8010) who will help you select which communications you do not want – email, telephone, text or social media.

Contacting NCS

When you contact NCS, we will use the information you give us within the communication only for the purposes you describe. That can be:

  • to respond to questions or inquiries;
  • to notify you of NCS conferences, publications, or other services;
  • or to keep a record of any complaints, data protection requests and similar matters.

We will treat this data in the most secure and safe manner we can. For the specific requests below, please email NCS at dataprotectionofficer@ncstrust.co.uk:

  • for NCS to stop communicating with you completely;
  • to stop processing your data or;
  • to “erase” your personal information.

Note: if you ask NCS not to contact you by email at a certain email address, NCS will retain a copy of that email address on record only in order to comply with your no-contact request.

Use of the NCS website

The NCS website collects, and stores safely, certain information automatically. The information may include your internet protocol (IP) address, the region or general location where your computer or device is accessing the internet, and other usage information about the use of the NCS website, including a history of the pages you view. We use this information to help us design our site to better suit our users’ needs. NCS also uses cookies on our website. It does not track users when they cross to third party websites and does not provide targeted advertising from those third parties.

Cookies Policy

A cookie is a small file and holds a certain amount of data, which our website can send to your browser. It may then be stored on your computer’s hard drive and can be accessed by our web server. This cookie data can then be retrieved and can allow us to customise our web pages and services accordingly. It’s important to clarify that cookies do not collect any personal data stored on your hard drive or computer.

To find out more about cookies, visit this site.

Our cookies fall into five main types:

Strictly Necessary Cookies

These cookies are essential in order to enable you to move around the website and use its features, and ensuring the security of your experience. Without these cookies services you have asked for, such as applying for products and managing your accounts, cannot be provided. These cookies don’t gather information about you for the purposes of marketing.

Performance Cookies

These cookies are used to improve our website experience and evaluate & optimise performance of our media and advertising. By using our website you agree that we can place these types of cookies on your device, however you can block these cookies using your browser settings.

Functionality Cookies

These cookies are used to enable the website to remember choices you make (such as your username). The information these cookies collect is anonymised (i.e. it does not contain your name, address etc.) and they do not track your browsing activity across other websites. By using our websites you agree that we can place these types of cookies on your device, however you can block these cookies using your browser settings.

Targeting Cookies

These cookies collect several pieces of information about your browsing habits. They remember that you have visited a website and this information is shared with other organisations such as media publishers. These organisations do this in order to provide you with targeted adverts more relevant to you and your interests.

Third Party Cookies

These cookies are used where we have content embedded from third-party sites (such as Facebook and Youtube). The contents and lifespan of these cookies are not under our control. Please visit these sites for further information on their privacy and cookie policies.

How to disable cookies

If you would prefer not to receive any cookies from us, you can configure your browser to reject them. Where your browser is configured to accept cookies we shall take this as consent to use cookies as outlined on this page. Please note that blocking cookies may result in parts of our website no longer functioning properly for you.

When and how we share information with others

We will only share data with those organisations we absolutely have to, i.e. those that enable the services we offer – NCS programme, post-programme opportunities etc. This may include NCS contractors and their subcontractors, government bodies, fraud detection organisations, strategic partners of NCS (including any organisation running or supporting all or part of NCS in the future).

The personal information collected from you is stored appropriately in one or more databases hosted by third parties (databases) located in the European Economic Area (EEA), or in locations, and with companies, where a formal agreement of ‘adequacy’ is in place – i.e. a supervising authority has judged controls to be sufficiently strong to protect personal data. These third parties do not use or have access to your personal information for any purpose other than enabling NCS to achieve the goals of social cohesion, mobility and engagement, and to make the NCS programme as efficient as possible.

This includes our distribution partners who are responsible for running programme and delivering the NCS service to young people. They will not share your data outside of the agreement made with NCS, or without first seeking the approval of NCS (e.g. the young person decides to change the geographic location, and therefore third party (partner) providing NCS programme).

We do not otherwise reveal your personal data to third parties for their independent use unless:

You request or authorise it; the information is provided to comply with the law (for example, to comply with a search warrant or court order), enforce an agreement we have with you, or to protect our rights, property or safety, or the rights, property or safety of our employees or others; the information is provided to our agents, vendors or service providers who perform functions on our behalf; to address emergencies or acts of God; or to address disputes, claims, or to persons demonstrating legal authority to act on your behalf.

NCS may also gather aggregated data about young people and web site visitors and disclose the results of such aggregated (but not personally identifiable) information to our partners, service providers, and/or other third parties for marketing or promotional purposes.

The NCS website uses interfaces with social media sites such as Facebook, LinkedIn, Twitter and others. If you choose to “like” or share information from the NCS website through these services, you should review the privacy policy of that service. If you are a member of a social media site, the interfaces may allow the social media site to connect your site visit to your personal data.

Data Subject Rights

The European Union’s General Data Protection Regulation and other countries’ privacy laws provide certain rights for data subjects. A good explanation of the rules for the UK is available on the website of the Information Commissioner’s Office.

This Privacy Policy is intended to provide you with information about what personal data NCS collects about you and how it is used. If you have any questions, please contact us at dataprotectionofficer@ncstrust.co.uk

If you wish to confirm that NCS is processing your personal data, or to have access to the personal data NCS may have about you, please contact us
at dataprotectionofficer@ncstrust.co.uk

You may also request the following information about your personal data and NCS:

Why we process your personal data; the categories of personal data concerned; who else outside NCS might have received your personal data from the us; what was the source of your personal data was if you didn’t provide it directly to NCS; and how long it will be stored.

Additional rights you have as the data subject or owner of your personal data:

You have a right to correct (rectify) the record of your personal data maintained by NCS if it is inaccurate; you may request that NCS erase that data or cease processing it, subject to certain exceptions; you may also request that NCS cease using your data for direct

marketing purposes; when technically feasible, NCS will – at your request – provide your personal data to you or transmit it directly to another controller. If access cannot be provided within a reasonable time frame, NCS will provide you with a date when the information will be provided. If for some reason access is denied, NCS will provide an explanation as to why access has been denied.

Security of your information

To help protect the privacy of data and PII you transmit through use of this site, we maintain physical, technical and administrative safeguards. We update and test our security technology on an ongoing basis. We restrict access to your personal data to only those employees who need to know that information to provide services to you. In addition, we train our employees about the importance of confidentiality and maintaining the privacy and security of your information. We commit to taking appropriate disciplinary measures to enforce our employees’ responsibilities towards your privacy.

Data storage and retention

Your personal data is stored by NCS on the servers of organisations engaged specifically for that purpose, i.e. secure cloud-based storage of data; these are located in the EEA. NCS retains data for the duration of the young person’s, or other stakeholders, relationship with NCS.

For more information on where and how long your personal data is stored, or for any of the other rights you have, please contact the NCS data protection officer
at dataprotectionofficer@ncstrust.co.uk

Changes and updates to the Privacy Policy

As our organisation changes over time, this Privacy Policy and Conditions of Use are expected to change as well. We reserve the right to amend the Privacy Policy at any time, for any reason, without notice to you, other than the posting of the amended Privacy Policy at this Site. We may email periodic notices of interest, including notification of these changes, but you should check our website frequently to see the current Privacy Policy that is in effect and any changes that may have been made to it.

By using this website, you agree to the terms and conditions contained in this Privacy Notice and Conditions of Use and/or any other agreement that we might have with you. If you do not agree to any of these terms and conditions, you should not use this website or any NCS services. You agree that any dispute over privacy or the terms contained in this Privacy Notice and Conditions of Use, or any other agreement we have with you, will be governed by the laws of the United Kingdom (UK). You also agree to arbitrate such disputes in the UK, and to abide by any limitation on damages contained in any agreement we may have with you.

Data Protection Officer

NCS is headquartered in London, in the United Kingdom (UK). NCS has appointed an internal data protection officer for you to contact if you have any questions or concerns about NCS personal data policies or practices. Their name and contact information are as follows:

Martin Fell
NCS Trust
The Pembroke Building
Kensington Village
Avonmore Road
London W14 8DG
Email: dataprotectionofficer@ncstrust.co.uk

Phone: +44(0)7757 682679