Privacy Notice
How we use personal information provided through the website and first-contact routes.
1. What this notice covers
This notice covers website enquiries, young-person participation enquiries, initial referrals, partnership contact and related technical records. A separate, more specific notice may apply when somebody becomes a participant, worker, volunteer, contractor or partner.
2. Information we collect
- contact and identity details such as name, email, telephone, organisation and role;
- limited participation information such as first name, age band, area, interests, experience level and a brief non-sensitive goal;
- limited referral information needed to identify the right follow-up route;
- the content, time and source of an enquiry and our response;
- basic technical and security information generated when the website, forms or fonts are requested, such as IP address, device/browser information, time and request logs.
Do not submit highly sensitive information through a public form. Do not include detailed safeguarding reports, medical history, case files, DBS or criminal-record information, identity documents or bank information. We will provide an approved secure route if additional information is needed.
3. Why we use it and our lawful bases
- Responding and taking steps at your request: to handle an enquiry, explore participation, referrals or a potential agreement.
- Legitimate interests: to operate and improve our community service, manage relationships, keep appropriate records, prevent abuse and protect the website—balanced against people’s rights.
- Legal obligation: where we must keep records or act to meet company, safeguarding, employment, equality or other legal duties.
- Consent: where we ask for a genuine optional choice, such as particular communications, images or publicity. Consent can be withdrawn.
- Vital interests or substantial public interest: only where the law permits and circumstances require this, supported by the appropriate policy and restricted handling.
We do not use public website forms to collect special-category or criminal-offence data as a normal route.
4. Children and young people
We use clear, limited first-step forms and age bands. Where appropriate, a parent, carer or authorised professional should provide the contact route. We consider the young person’s age, understanding and best interests, explain the next stage in an age-appropriate way and seek the necessary consent or authority before collecting more detailed information.
5. Who receives information
Access is limited to authorised people who need it for the stated purpose. Netlify provides website hosting and processes initial form submissions on our behalf. Google Fonts supplies the typefaces used by the website and receives routine technical request information when the fonts load. We may use email, security and IT providers under appropriate controls. We may share information with an authorised partner or statutory body where you expect this, where it is needed to deliver an agreed service, or where the law requires or permits it. Safeguarding records are not shared with project managers or the wider team.
6. International transfers
Netlify, Google and other technology providers may process limited information outside the UK. Where UK data protection law requires a transfer safeguard, we use the contractual or recognised transfer mechanism made available for that service and review providers in proportion to the risk.
7. How long we keep information
We keep information only for as long as needed for the purpose, legal duties, safeguarding and complaint handling. We periodically review public form submissions and delete them when they are no longer required. If an enquiry becomes a participant, worker, volunteer, contractor or partner relationship, relevant information is moved into the appropriate controlled record and kept under the applicable retention schedule. Safeguarding information follows a separate restricted process.
8. Security
We use access controls, least-privilege permissions, secure configuration, updates, monitoring, backup and incident procedures appropriate to the risk. Email and public website forms are not suitable for detailed sensitive records. No internet service can promise absolute security.
9. Your rights
Depending on the circumstances, you may have rights to be informed, access your data, correct it, have it erased, restrict or object to processing, receive portable data and challenge a decision made solely by automated means. You may withdraw consent where consent is the basis. These rights can have legal exceptions.
Contact info@sypccic.org. We may need to verify your identity. You may also complain to the Information Commissioner’s Office.
10. Automated decisions, marketing and changes
We do not use website form information to make solely automated decisions with legal or similarly significant effects. We do not sell personal information. Direct marketing will use the lawful basis and opt-out required for the channel. We will update this notice when our activities, providers or legal duties materially change.