Privacy Policy (Full Version) – last reviewed 19 June 2024
Introduction
SMASH Youth Project (referred to as “SMASH,” “we, “our” or “us”) is committed to protecting the privacy and security of your personal information.
Under data protection law, an organisation that decides how the personal information it collects and holds is used is called a ‘data controller.’ This policy explains how SMASH collects your personal information, what we do with it, what we do to keep it secure and your rights in respect of it.
The Head of Operations is SMASH’s Data Protection Manager (DPM):
- Ben Franklin (ben@teamsmash.org.uk)
- Address: SMASH Youth Project, Pinetrees Community Centre, The Circle, Swindon, SN2 1RF
- Website: www.smashyouthproject.com
This notice is reviewed and updated to ensure it is accurate and reflects our data processing activities. We recommend that you check this policy regularly. It was last reviewed 19 June 2024 by Head of Operations.
The Information SMASH Collect and When
SMASH collect information about a child or young person (CYP) who has been referred to our programmes, a parent/carer or family member of someone who has been referred and donor/fundraiser for SMASH.
Under data protection law, we must only collect personal information that is necessary to conduct our mentoring programmes and operate the charity. The type of information we will collect may include:
- Personal information to identify and contact you e.g. name, contact details and date of birth.
- Information about your nationality, education and social and economic demographic background.
- Details of the services/mentoring schemes you have been referred to, completed with us and how you used them.
- Photographs and video recordings of you (when we have the appropriate consent in place).
- Information about when you contact us and about your interactions with SMASH either face-to-face, online or via telephone.
• Survey responses.
• IP address and other online identifiers when you interact with our online services.
- Details of payments made through donations and fundraising.
We may, in further dealings with you, extend this personal information to include your address, purchases, services used, records of conversations and agreements.
Some of this information may be sensitive to you e.g. criminal convictions, health, race, religion or sexual orientation. Data Protection Laws refer to this as special category information. More information is provided about this below.
You are under no statutory, contractual requirement or obligation to provide SMASH with your personal information. However, we require at least the information above in order for us to deal with you as a user of our services in an effective and beneficial manner.
How Do You Collect My Personal Information?
SMASH collects personal information about you which is provided directly through your interactions as:
- A donor.
- A CYP who has been referred to and attended one of our mentoring schemes.
- A parent/carer or family member of a child/young person who is referred to one of our mentoring schemes.
We also collect information about you from third parties. This could be a parent or one of our referral partners e.g. Swindon Borough Council, Police and Crime Commissioner. If a third party has provided information about you, we will record what’s been provided and who gave it to us.
How We Use Your Information
SMASH collect and use your personal information to:
Helping to manage and administer our wellbeing and mentoring programmes which includes:
- Understanding more about you as a service user so we can support you better.
- Contacting you, following your enquiry or a referral, reply to any questions, suggestions, issues or complaints you have contacted us about.
- Enrolling you on one of our mentoring programmes
- Personalising our service offering e.g. provide you with details of services that could match your needs or that you have enquired about previously.
We use your data in this way as we have a legitimate business interest to do so. This is so that we can offer and deliver our mentoring programmes in the best way possible and make sure your needs are at the core of our decisions. We’ll always make sure the way we process your information is safe and not unfair to you.
To meet our legal and regulatory obligations which includes:
- Ensuring we comply with our requirements set out by our regulator (e.g. charities commission).
- Auditing and administering our accounts.
- Ensuring we comply with requirements due to the nature of our work e.g. safeguarding.
- Adhere to other relevant legislation e.g. data protection legislation.
SMASH will use personal information in this way when required by law and only use what is necessary to fulfil our legal duties.
To share relevant news and updates about our work
We may send you relevant news about our service offerings in several ways including by email, but only if you have previously consented to receive such communication. If you wish to amend your preferences i.e. you wish us to cease making contact, you can do so through our website or by contacting the DPM (ben@teamsmash.org.uk).
To manage and administer the ways to support SMASH which includes:
- Providing ways for you to support SMASH and our activities e.g. donate & fundraising, including taking any payments.
- Processing any Gift Aid and/or direct debits.
- Keeping a record of your relationship with us as a donor or fundraiser.
- Processing applications for any funding or grants which may be available to support SMASH’s work.
We will use information in this way to fulfil a contract between us e.g. your donation.
To monitor and enhance the programmes and services that SMASH offers which includes:
- Powering our security measures and services so you can safely access the website.
- Understanding more about the effectiveness of our mentoring programmes.
- Generating reports and insights about our work and events we may hold.
We use your data in this way as we have a legitimate business interest to do so and where possible will only use anonymised data to do so. We do this so that we can understand the ever-changing needs of the people we mentor and those who interact with SMASH. It means we can put those changes at the core of any changes we make to our mentoring programmes and work.
Special Category Information
From time to time, due to the nature of our work, we may collect information that might seem sensitive
e.g. details about health and disability or whether there is any police involvement with you or your family. This type of information is known as special category data and covers your health, race, religion, political opinions, sexual orientation, trade union membership and biometric details.
We only ever collect and use this sensitive information when we absolutely need to and will make sure it is kept as minimal as possible. It will be used to understand and personalise our mentoring services and make sure we can support you fully. This could be from making sure you get the most from our mentoring programmes, to ensuring you have any additional support you may need.
A lot of this information will be provided by you, your parents/carers or whoever referred you to SMASH. We will assume you are happy for us to keep a record of this and that you have been told when someone acting on your behalf has shared this type information with us. We will use it as there is a public interest for us to do so. This is where it is not only in your best interests but also in everyone’s best interest to support our mentor fulfil our charity’s mission “to ensure young people get the support they need when they need it, no matter what.“
In some rare cases, this information provided about you, or your family may be shared as there is a public interest for us to use it to meet our regulatory obligations. This is most likely to be in support of our safeguarding obligations towards CYP.
Who We Might Share Your Information With
We share your personal data with:
- Partners and suppliers that support the operation of our business.
- Specific third parties that you’ve authorised us to deal with and disclose information to e.g. those who have referred you to us, your family members and other people who are supporting you.
- Law enforcement agencies and government bodies & agencies when we are required to do so to meet our legal & regulatory obligations or in exceptional circumstances e.g. safeguarding.
- Payment processors and The Direct Debit Scheme.
- The Charity Commission.
- If we need to share personal data to establish, exercise or defend our legal rights.
We will not share your information with any third parties for the purposes of marketing.
Your Rights Over Your Information
You have certain rights when it comes to your personal information and there are a number of requests you can make:
- The right to access the personal information we hold about you.
- The right to withdraw your consent, when we have obtained your consent to use your information.
- The right to object to the use of your information, including for marketing purposes.
- The right to restrict the use of your information.
- The right to port your information to another organisation.
- The right to rectify any inaccurate or incomplete information we hold about you.
- The right to human intervention if we have made an automated decision about you.
Not all these rights are absolute, which means that they may only apply in certain situations and may be subject to legal exceptions and exemptions. When you submit a request, we will review it and get back to you as soon as possible – always within a month.
You can raise your request at any time either through a mentor or preferably to our Head of Operations, ben@teamsmash.org.uk.
The Information Commissioner’s Office (ICO) regulates data protection and privacy matters in the UK. There is a wealth of information on their website.
You can make a complaint to the ICO at any time about the way we use your information. However, the ICO recommend you contact us first to attempt to resolve any concerns prior to contacting them.
How Long We Keep Your Information For
SMASH retain a record of your personal information to provide you with a high quality and consistent service offering. We will retain your personal information in accordance with Data Protection Legislation and will not retain your information for longer than is necessary. Our current maximum retention periods are:
| Your relationship with SMASH | Retention period |
| You are a donor or fundraiser who is currently or previously supported SMASH | 6 years after your last donation. |
| You are a CYP or family member of a child or YP who has been referred to SMASH | For the time you are referred to SMASH plus 6 years. In the event of a safeguarding issue, this time period is increased until the CYP reaching the age of 25. |
| You have emailed SMASH or been in touch. | Files held on Sharepoint will be removed 12 months after your application/last contact with SMASH. |
If SMASH ceases to exist, any personal data will be deleted/shredded unless specifically required under safeguarding regulation or there is a requirement to be retained by a Funder/Commissioner. In which case, it will be transferred to them and, under the terms of this Privacy Policy, they will be permitted to use that data only for the purposes for which it was originally collected for by SMASH.
Giving Your Views and Sharing Your Thoughts
When using our website or media applications, you may be able to share information through social networks e.g. when you ‘like,’ ‘share’ or review our services. When doing this, your personal information may be visible to the providers of those social networks and/or other users. Please remember it is your responsibility to set appropriate privacy settings on your social network accounts so you are comfortable with how your information is being used and shared.
We may change this Privacy Policy from time to time e.g. if the law changes. We recommend that you check this policy regularly.
If you would like to exercise one of your rights, you have a question/complaint about this policy or the way your personal information is processed, please contact SMASH by:
- Email: ben@teamsmash.org.uk or media@ teamsmash.org.uk
- Post: SMASH Youth Project, Pinetrees Community Centre, the Circle, Swindon, SN2 1RF.