Privacy Policy (Full Version)

Privacy, Cookies, Terms and Conditions

SMASH Youth Project Registered Charity 1107900 (referred to as “SMASH,” “we, “our” or “us”) is committed to protecting the privacy and security of your personal information.

Under data protection law, an organisation that decides how the personal information it collects and holds is used is called a ‘data controller’. This policy explains how we collect your personal information, what we do with it and your rights in respect of it.

This privacy notice is here to inform you of the data we collect, what we do with your information, what we do to keep it secure as well as the rights and choices you have over your personal information.

Our Data Protection Manager is:

This notice is regularly reviewed (last review 28 Mar 23) and updated to ensure these are accurate and reflect our data processing activities. We recommend that you check this policy regularly.

The information we collect and when

We collect information about you as a child or young person who has been referred to one of our programmes, as a parent/carer or family member of someone who has been referred and as a donor or fundraiser for SMASH.

Under data protection law, we must only collect personal information that is necessary for us to conduct our mentoring programmes and operate our charity.  The type of personal information that we will collect about you may include some or the following:

We may, in further dealings with you, extend this personal information to include your address, purchases, services used, records of conversations and agreements.

Some of this information may be information which is sensitive to you, such as information about criminal convictions, health information, information about your race, religion or sexual orientation.  Data Protection Laws refer to this as special category information and more information is provided about this below. 

You are under no statutory or contractual requirement or obligation to provide us with your personal information; however, we require at least the information above in order for us to deal with you as a user of our services in an effective and beneficial manner.

How do you collect my personal information?

SMASH collects personal information about you which is provided directly through your interactions with SMASH either as:

We also collect information about you from third parties.  This could be a parent or one of our referral partners such as Swindon Borough Council, Wiltshire Community Foundation or Masonic.  If a third party has provided information about you, we’ll record what’s been provided and who gave it to us.

How we use your information

SMASH collect and use your personal information to offer and manage our mentoring programmes for children and young people and to operate and fund our charity.  This includes:

Helping to manage and administer our wellbeing and mentoring programmes which includes:

We use your data in this way as we have a legitimate business interest to do so.  This is so that we can offer and deliver our mentoring programmes in the best way possible and make sure your needs are at the core of our decisions, so you get the most out of being involved.  We’ll always make sure the way we process your information is safe and not unfair to you.

To meet our legal and regulatory obligations which includes:

We will use personal information in this way when required by law and only use what is necessary to fulfil our legal duties. 

To share relevant news and updates about our work

We will send you relevant news about our service offerings in several ways including by email, but only if you have previously consented to receive such communication. If you wish to amend your preferences i.e. you wish us to cease making contact, you can do so through our website or by contacting the DPM (

To manage and administer the ways to support SMASH which includes:

We will use information in this way to fulfil a contract between us (e.g. your donation).

To monitor and enhance the programmes and services that SMASH offers which includes:

We use your data in this way as we have a legitimate business interest to do so and where possible will only use anonymised data to do so.  We do this so that we can understand the ever-changing needs of the people we mentor and who interact with SMASH. It means we can put those changes at the core of any changes we make to our mentoring programmes and work. By doing this, we can keep evolving what we offer and growing as charity.

Special Category Information

From time to time, due to the nature of our work we may collect information that might seen sensitive.  For example, details about health and disability or whether there is any police involvement with you or your family.   This type of information is known as special category data and covers things like your health, race, religion, political opinions, sexual orientation, trade union membership and biometric details.

We only ever collect and use this sensitive information when we absolutely need to and make sure it is kept as minimal as possible. It will be used to understand and personalise our mentoring services and make sure we can support you fully.  This could be from making sure you get the most from our mentoring programmes to ensuring you have any additional support you may need when attending.

A lot of this information will be provided by you, your parents/carers or whoever referred you to SMASH and we will assume you are happy for us to keep a record of this and that you have been told when someone acting on your behalf has shared this type information with us.   We’ll use it as there is a public interest for us to do so.  This is where it is not only in your best interests that we can, but also in everyone’s best interest to support our mentors fulfil our charity’s mission; to ensure young people get the support they need when they need it, no matter what. 

In some rare cases, this information provided about you, or your family may as there is a public interest for us to use it to meet our regulatory obligations (e.g. our safeguarding obligations towards children and young people).

Who we might share your information with

We share your personal data with:

We will not share your information with any third parties for the purposes of marketing.

Your rights over your information

You have certain rights when it comes to your personal information. and there are a number of requests you can make:

Not all of these rights are absolute, which means that they may only apply in certain situations and may be subject to legal exceptions and exemptions.  When you submit a request, we’ll review it and get back to you as soon as possible – always within a month. 

You can raise your request at any time, but the If you would like to exercise any of these rights, please contact our Head of Operations

The Information Commissioner’s Office (ICO) regulates data protection and privacy matters in the UK. They make a lot of information accessible to consumers on their website at

You can make a complaint to the ICO at any time about the way we use your information. However, the ICO recommend you contact us first to attempt to resolve any concerns prior to raising your complaint with them.  

How long we keep your information for

SMASH retain a record of your personal information in order to provide you with a high quality and consistent service offering.  We will always retain your personal information in accordance with Data Protection Legislation and never retain your information for longer than is necessary.  Our current retention periods are below:

Your relationship with SMASHRetention period
You are a donor or fundraiser who is currently or previously supported SMASH6 years after your last donation.
You are a child, young person (YP) or family member of a child or YP who has been referred to SMASHFor the time you are referred to SMASH plus 6 years.   In the event of a safeguarding issue, this time period is increased until the CYP reaching the age of 25.
You have emailed SMASH or been in touch.Files held on Sharepoint will be removed 12 months after your application/last contact with SMASH.

If SMASH either ceases to exist as a charity any personal data that you have provided will be deleted or shredded unless specifically required under safeguarding regulation or there is a requirement to be retained by a Funder/Commissioner in which case it will be transferred to them and, under the terms of this Privacy Policy, they will be permitted to use that data only for the purposes for which it was originally collected by us.

Giving your reviews and sharing your thoughts

When using our website or media applications, you may be able to share information through social networks e.g. Twitter. For example, when you ‘like,’ ‘share’ or review our services. When doing this, your personal information may be visible to the providers of those social networks and/or their other users. Please remember it is your responsibility to set appropriate privacy settings on your social network accounts so you are comfortable with how your information is used and shared on them.

Changes to our privacy policy

We may change this Privacy Policy from time to time (for example, if the law changes). We recommend that you check this policy regularly.

How to contact SMASH

If you would like to exercise one of your rights as set out above, or you have a question or a complaint about this policy, the way your personal information is processed, please contact us by one of the following means:

Thank you for taking the time to read our Privacy Policy.