This privacy policy explains the types of personal information we collect from you, why we collect it, how we will use it, who we may disclose it to and the choices available to you about that information.
This notice applies to current and former participants. This notice does not form a fixed part of your HeadStart application or any other contract so we may update this notice at any time.
It is important that you read this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.
HeadStart is a programme run by the Challenge Network, Mezz Floor, Elizabeth House, 39 York Road, London, SE1 7NQ, registered company in England and Wales no. 6845451.
The Challenge is a "Data Controller". This means that we are responsible for deciding how we hold and use personal information about you. We are required under data protection legislation to notify you of the information contained in this privacy notice.
Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
There are "special categories" of more sensitive personal data which requires a higher level of protection.
We may collect, store, and use the following categories of personal information and ‘special categories’ of personal information about you, including:
We collect personal information about you through the application process, directly from you, your parents/guardians or other key workers.
We will also collect additional personal information through your participation of HeadStart.
Some parents, legal guardians or care workers apply on behalf of young people. If you are doing this, you must obtain the young person’s consent for us to use their personal information in the way set out in this privacy policy. We will draw the young person’s attention to how we are using their personal information as soon as we contact them and they will be entitled to withdraw the consent you gave.
However, as a parent, legal guardian or care worker, you may also be asked to give consent to our use of your personal information for the purposes explained below.
We will only use your personal information when the law allows us to. Most commonly, we will use your personal information in the following circumstances:
We need all the categories of information in the list above primarily to allow us to perform our contract with you and to enable us to comply with legal obligations. In some cases we may use your personal information to pursue legitimate interests of our own or those of third parties, provided your interests and fundamental rights do not override those interests.
The situations in which we will process your information are listed below.
If you fail to provide personal information when requested, we may not be able to perform the contract we have entered into with you (such as assigning you a place on the HeadStart programme), or you may be unable to continue with the programme e.g. if we are prevented from complying with our legal obligations (such as ensuring the health and safety of the young people).
We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis that allows us to do so.
Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
"Special categories" of particularly sensitive personal information require higher levels of protection. We have in place an appropriate policy document and safeguards, which we are required by law to maintain when processing such data. We may process special categories of personal information in the following circumstances:
We may also process this type of information where it is needed in relation to legal claims or where it is needed to protect your interests (or someone else's interests) and you are not capable of giving your consent, or where you have already made the information public. We may also process such information about members or former members in the course of legitimate business activities with the appropriate safeguards.
We will use your particularly sensitive personal information in the following ways:
We do not need your consent if we use special categories of your personal information in accordance with our written policy to carry out our legal obligations, act in the public interest, protection of your health or to reasonably exercise our rights. In limited circumstances, we may approach you for your written consent to allow us to process certain particularly sensitive data. If we do so, we will provide you with full details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent. You should be aware that it is not a condition of your contract with us that you agree to any request for consent from us.
We will use the information about criminal convictions, or contact with the criminal justice system, to ensure the safety of yourself and others during the programme. We will collect information about criminal convictions as part of the application process directly from you or from other key workers such as social workers, teachers and probation officers.
We may have to share your data with third parties including third-party service providers who are involved in the delivery of the programme. We require third parties to respect the security of your data and to treat it in accordance with the law. In limited circumstances, we may transfer your personal information outside the EEA. If we do, you can expect a similar degree of protection in respect of your personal information.
All our third-party service providers are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes, except that we may allow the use of photos for publicity, funding reports and programme updates. We only permit them to process your personal data for specified purposes and in accordance with our instructions.
"Third parties" includes IT service providers, and other organisations that provide products or services to The Challenge and need the personal information to carry out the service or deliver the product.
Unless there is a compelling safeguarding, health and safety, dispute or other legal reason to retain information for a longer period, we will normally delete:
|
Subsection |
Record type |
Retention Period and Deletion or Disposal Deadline |
|
i |
Personally Identifiable Information – Young People or their Parental Guardian from the NCS Programme, subject to iv to v |
3 years from the last contact with the individual e.g. if all contact with a young person has not instigated a response from them or they have not taken part in any activities. |
|
ii |
Personally Identifiable Information – Young People or their Parental Guardian that came from a route other than NCS Programme, subject to iv to v |
2 years from the first EOI or application by the individual or subsequent opt in confirmation they still want to have contact. |
|
iii |
Use of Young People or their Parental Guardian’s contact details for email or text marketing of opportunities after completion of HeadStart |
2 years from the date the individual last opted into to receive such email or text marketing. |
|
iv |
Use of Business Partners contact details, subject to iv to v |
3 years from the last contact with the individual e.g. if all contact has not instigated a response from them or they have not taken part in any activities. |
|
v |
Photos, video, voice recordings for marketing (not for programme logistics), subject to vi |
5 years from the date of creation. |
|
vi |
Incident Information and any Personal Identifiable Information or Special Category Data related to that Incident |
20 years from the date of the Incident or alleged Incident (whichever is the later). Incident levels are defined in our Major Incident Procedures and Crisis Comms Plan. |
Personally Identifiable Information means any information relating to a living individual (a “Data Subject”) where that Data Subject can be identified directly or indirectly, for example, by reference to an identifier such as a name, an identification number or address. It includes “Special Category Information”. Information which can be used to identify a ‘living individual’ e.g. name, address, email, address, date of birth, home address, phone number, identification number, location data, online data and include a Special Category Information.
We may from time to time need to use the services of an IT provider that stores or accesses your personal information outside the European Economic Area (EEA). However, we will only do so if there are appropriate safeguards to protect the information. For example, we will put in place European Commission model contractual clauses, ensure the supplier has binding corporate rules in place regarding data security and/or ensure the relevant country is recognise as having adequate data security by the European Commision.
You are entitled to:
No fee is usually required.
You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.
In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact the Data Protection Officer at [email protected]. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.
We have appointed a Data Protection Officer (DPO) to oversee compliance with this privacy notice. If you have any questions about this privacy notice or how we handle your personal information or if you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party please contact the DPO. You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues.
Like many websites, we use “cookies”. “Cookies” are small pieces of information sent to and stored on your computer, phone or tablet to allow the website to recognise you when you visit. They collect statistical data about your browsing actions and patterns to improve the website, but do not identify you as an individual. It is possible to switch off cookies by setting your browser preferences. For more information, please visit our cookies policy on this website. Turning cookies off may result in loss of certain functions on this website.
Our website may contain links to other websites run by other organisations. Equally, other websites may have linked you here to this website. This privacy policy applies only to our website‚ so we encourage you to read the privacy statements on the other websites you visit or came from as we cannot be responsible for the privacy policies and practices of other sites.
These include the NCS with the Challenge Booking privacy statement (https://www.ncsyes.co.uk/privacy-policy) and the HeadStart privacy statement (https://www.headstart-thechallenge.org/privacy-policy/)
We reserve the right to change our privacy policy without prior notice however we will endeavour to update this page as regularly as feasibly possible. We therefore urge you to review this statement from time to time to ensure you are up-to-date with how we are using and protecting your information.
If you have a query or concern about this privacy policy or our use of personal information or want to exercise any of the above rights regarding your personal information please contact [email protected].
If you are not happy with our observance of data protection legislation, you have the right to lodge a complaint with the Information Commissioner’s Office by visiting: https://ico.org.uk/concerns/