For Children & Young People
Privacy Notice – Public
For Children & Young People (4YP) believes confidentiality should be taken seriously and is committed to the security of your data and protecting your privacy.
The Role of 4YP
4YP is a Data Controller. This means 4YP is responsible for determining how we gather and store data of individuals (or Data Subjects), and the purposes for, and manner in, which that personal data is processed.
We define personal information as any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data) such as collated statistics from survey responses.
Our Promise to You
Any personal information we hold about you will be:
- Collected and used only for valid purposes, which you will be informed about
- Kept securely and up to date (including data stored digitally and in manual filing systems)
- Retained and used only for as long as necessary for the purposes we tell you about.
What Data We Collect
4YP may collect, store, and use the following categories of personal information:
- Contact details, such as name, title, addresses (or approximate location), telephone numbers and email addresses.
- Emergency contact information – this will be provided by you and stored/used by 4YP on the understanding that you have informed the individual(s) to whom this data belongs.
- Date of birth, age
- Voice recordings (e.g. radio appearances)
- Social media handles
- Website and IP addresses
- Job title, employer/organisation, registered business/charity number
We may also collect, store, and use the following “special categories” of more sensitive personal data which require a higher level of protection:
- Race, ethnicity, sexual orientation
- Information about your health, including medical conditions, NHS number
- Criminal convictions and offences
How We Collect Personal Information
You may provide personal data to 4YP when you:
- Complete a consent form
- Submit a referral form
- Email, write to, or text 4YP
- Telephone 4YP, and leave a message
- Sign up for the C-Card
- Take part in a media (radio, newspaper) appearance
- Are in a photograph
- Fill in an evaluation form
- Interact with 4YP via social media
- Subscribe to the 4YP (newsletter) mailing list
- Write a case study or piece for the 4YP newsletter
- Complete a 4YP survey or poll
- Submit an application form for employment or to volunteer
- Provide a testimonial or online review (e.g. on Google)
- Provide a business card
- Fund a 4YP service or activity
- Enter into a partnership agreement with 4YP as an organisation, business or charity
To fulfill our obligation to funders, we may need to obtain data via observations.
We may also collect data, including the ‘special categories’, with your written consent.
Sometimes, we collect data because of our obligation to do so by law, for an individual’s safety (to protect your vital interests), or for our role as an employer.
Where appropriate, we will seek the consent of the holder of parental responsibility for any young person below the age of 16 years old. However, if deemed necessary (e.g. for sake of safeguarding) we may not as per Recital 38 of the UK GDPR, which states “The consent of the holder of parental responsibility should not be necessary in the context of preventive or counselling services offered directly to a child.”
How 4YP Uses Data About You
We will only use your personal information for the purposes that we collect it for.
4YP uses data to carry out our objective of providing young people with an appropriate and supportive service or to help them access one.
Your personal information may be disclosed to any 4YP employee or volunteer as reasonably necessary for the purposes identified in this policy.
4YP also uses data to:
- Make and confirm appointments
- Provide support to other people, e.g., advice to parents/carers and professionals
- Respond to enquiries and complaints
- Promote 4YP services and activities
- Contact you with relevant information, such as news, events and activities
- Process payments, including funding and donations
- Thank supporters
- Collate information about health and wellbeing, issues, and the impact of 4YP’s services
- Carry out equal opportunities monitoring
On rare occasions, we may need to use your data for other reasons. In this case, we will notify you, explain why we are doing this, and tell you the legal basis which allows us to do so. We may need to use your data to:
- Fulfill a legal obligation
- Complete activities of legitimate interests of 4YP or a third party, where your interests and fundamental rights do not override those interests
- Protect your, someone else’s, or public interests
Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, GDPR, and where this is required and permitted by law.
We may anonymise some personal data, for example survey results. In this case, it can no longer be associated with, or used to identify, an individual.
4YP uses some third-party services to assist in our operations.
4YP will act as a Data Controller for the personal data third-party services share with us.
These third-party services include:
- Virgin Money Giving
- Survey Monkey
- Disclosure & Barring Service
4YP may on occasion need to share your data with third parties, including trusted service providers with whom we work. This will only be done where necessary, and you will be notified.
As with 4YP, third parties are required to respect the security of your data. We only permit them to process your data for specified purposes and treat it in accordance with GDPR, the law, and 4YP policies.
Examples of third parties 4YP works with in partnership or hold contracts with include:
- Norfolk and Suffolk Foundation Trust (NSFT)
- National Health Service (NHS)
- Suffolk County Council
- Home Start Suffolk
- Outreach Youth
- Strident Technology (4YP IT network)
4YP may share statistical data with third parties, but no information from which individuals can be identified.
We will not, without your consent, supply your personal information to third parties for the purpose of direct marketing.
4YP uses a range of measures to protect the security of your information and prevent unauthorised access, loss, misuse or inappropriate alteration of your data.
We have put in place reasonable physical, electronic, and managerial procedures to safeguard and secure personal information. For example, we use:
- Encryption – including portable devices and encrypted emails
- Locked cabinets
- Strong passwords
- Password protected servers, accounts/logins, databases, documents, and programs (e.g., Microsoft Outlook)
- Restricted areas of server accessible only by authorised personnel
- Up-to-date virus protection, firewalls, and malware software
4YP limits access to your personal information to only the necessary employees and volunteers who need to know.
We have procedures to deal with a suspected data security breach, which may include notifying you and the Information Commissioner’s Office where we are legally required to do so.
We will retain your personal information (including printed and electronic documents) for only as long as necessary to fulfil the purposes for which we collected it, and to fulfill legal, accounting, employment, and reporting requirements.
Different types of data may be retained for different periods, as outlined in the 4YP Retention Policy.
Your personal data stored by 4YP will be destroyed or deleted at the point retention expires.
4YP has a duty to keep all the information we hold about you up to date in line with any amendments you tell us of.
As such, please keep us informed of any changes to your personal information by contacting us in one of the ways described under Your Rights, below.
The GDPR gives you greater control over your data held by a Data Processor like 4YP.
You may express your rights, in writing or verbally, by addressing your request to the Data Protection Officer, by:
- Emailing email@example.com
- Writing to, or visiting, 14 Lower Brook Street, Ipswich, IP4 1AP
- Calling 01473 252607
Providing an additional, appropriate security measure, we may need identification or other information to confirm who you are. This will clarify your right to access the data and exercise your rights and avoid incorrect disclosures.
Valid forms of identification may include a passport, driving licence or birth certificate.
4YP will respond to your request within one calendar month. Normally, no fee will be charged unless the request is excessive.
If we are unable to fulfill your request (for example, a legal obligation), or need to take longer to process your request, we will explain why.
- Privacy Information
4YP will always inform you about the collection and use of your personal information, outlining the purpose for which we obtain and use your data, the retention periods and who it will be shared with.
- Subject Access
You have the right to request access to your personal information. If you do this, 4YP will provide you with a copy of the personal information we hold about you to check that:
- we are processing it lawfully
- it is up to date
If you consider the personal information we hold about you to be inaccurate or incomplete, you can request us to correct it.
If you have any concerns about the way 4YP may be using your data, you may request us to suspend its use while these are investigated. This is known as ‘restriction’. Concerns you may have could include:
- Inaccuracies in the data
- Our reason(s) for processing the data
- Preventing erasure of your information, so that it may be available beyond the time frame established in the 4YP Retention Policy (available upon request)
You should note that restricted data remains stored (but not erased) and may be restricted only for a limited time.
You have the right to prevent 4YP using your personal data where your particular situation means you object to it being processed. In this case, we may require specific reasons.
We cannot request reasons for your objection to direct marketing. This includes contacting you about fundraising.
This data may still be stored, and not erased.
As part of your ‘right to be forgotten’, you may ask 4YP to delete or remove your personal information where:
- there is no acceptable reason for us to continue processing or to store it
- you have exercised your right to object (see above).
- Transfer (or Data Portability)
This right allows you to request us to move, copy, or transfer your personal data easily from the 4YP IT network to yourself or another network, service, business, etc. We will do so without compromising security or the data usability.
This excludes information stored on paper-based files.
Right to Withdraw Consent
Occasionally, we may obtain your consent to collect and process your personal data for a specific purpose.
You have the right to withdraw your consent at any time by contacting the Data Protection Officer (see Changes to the Notice, below).
After 4YP receives notification that you have withdrawn consent, we will no longer process your information for the stated purpose(s). There may be exceptions where we have another legitimate, lawful basis for doing so, which we will inform you of.
Report a Concern
If you have a concern about the way your personal information has been handled, complaints can be reported directly to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues, at:
- Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
- 0303 123 1113
Further information, including live chat help, is available online at https://ico.org.uk/concerns
Changes to this Notice
For Children & Young People reserves the right to update and amend this privacy notice at any time.
The correct version will be accessible on the 4YP website at any time. Copies may also be requested from the Data Protection Officer at:
- 01473 252607
- 14 Lower Brook Street, Ipswich, IP4 1AP