Privacy - Oxfordshire Youth

Privacy Notice

Oxfordshire Youth is committed to protecting and respecting your privacy. This notice explains when and why we collect personal data, how we use it, when we may share it, and how we keep it secure.

Who are we?

Oxfordshire Youth — Charity no. 1151723

Address: 5000 John Smith Drive, Oxford Business Park, OX4 2BH.

Phone: 01865 767899

Email: [email protected]

Data Protection Lead: Emma Coles, Compliance Manager

Oxfordshire Youth is a boundary-breaking, youth development charity, passionate about creating a future for and with young people aged 11–25 that gives them the best possible opportunity to realise their potential.

Oxfordshire Youth’s commitment

We are committed to protecting and respecting your privacy. This privacy notice explains when and why we collect personal data about you, how the information is used, the conditions under which it may be disclosed to others and how it’s kept secure.

We may review and update this privacy notice and will update you when any amendments are made. If you have any questions regarding this privacy notice and our privacy practices, you can contact [email protected].

We are committed to these principles of data protection:

Lawfulness, fairness and transparency — we process data lawfully, fairly and in a transparent manner
Purpose limitation — we use personal data for specific, explicit and legitimate purposes
Data minimisation — we only process data that is adequate, relevant and limited to what is necessary
Accuracy — personal data is kept accurate and up-to-date
Storage limitation — we store personal data for no longer than necessary
Integrity and confidentiality — we ensure appropriate security against unlawful processing, accidental loss, destruction or damage
Secure handling — we ensure technical and physical security measures prevent unauthorised access
Accountability — we maintain records of processing activities
Data retention — we retain data only for the period necessary for the stated purpose

The type of information we collect

Oxfordshire Youth may collect personal information from different groups of data subjects, including:

young people
freelancers
volunteers
donors
job applicants
web and social media data subjects
attendees of Oxfordshire Youth events
employees
trustees

Personal information may include:

records of correspondence
identifiers such as ethnicity, sexual history, behavioural records, demographics, medical and health history
knowledge and beliefs, authenticating, preference
historical (life history)
financial (account records, transactions)
social (professional, criminal, public life, family, communication)
special categories of data (e.g. race, ethnicity, data concerning health, sexual orientation)

Examples of data we may collect

Young people on our programmes: name, date of birth, contacts, emergency contacts and special category data
Employees: bank accounts, professional and educational background, special category data
Trustees / volunteers: contacts, emergency contact, DBS information
Donors: identifiers and contacts
Event attendees: email address, postcode, interests

Website analytics (Google Analytics)

If you are visiting our website we use a third party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to various parts of the website. The information is only processed in a way which does not identify anyone.

Opt out of Google Analytics →

How do we collect information about you?

Most of the personal information we process is provided to us directly by you, via completed transactions, completion of forms, letters, emails or verbally.

However, if you are a young person involved in one of our programmes, we may collect information from third parties such as local authorities, professionals, schools and other charities. This may happen through referral forms or outcome evaluation updates.

Why do we collect information about you?

We need to collect information to fulfil the following needs:

to carry out our work, meet our objectives and comply with contractual obligations placed on us by funders
to help fulfil requests you make (e.g. job application, donation, event/programme participation)
to keep track of the impact of our work
to record the services that you’ve used
to record contact we might have with you
to send you information that we think will interest you
to carry out evaluation, monitoring and analysis to improve our services (ourselves or via a third party)
to process sales transactions, donations or payments and verify financial transactions
to detect or prevent fraud or abuse on our digital platforms
to communicate with beneficiaries, donors and commissioners

Lawful basis

Oxfordshire Youth processes personal data by identifying a lawful basis, including:

Consent — minors aged 13+ can consent directly under the Data Protection Act (2018); under 13s may require parent/carer consent
Contract — processing necessary for a contract involving the data subject
Legal obligation
Vital interests — to protect personal vital interests
Legitimate interests — provided your interests are respected

Data sharing

We may share personal information with external organisations. This may be based on legitimate interest, contractual obligation or legal obligation. For example, information may be shared with delivery partners, HMRC, insurance providers or pension services as required.

If there is no legitimate interest, contractual or legal obligation, we will only share personal data where we identify the need and have your written and explicit consent.

How long we hold your information for and how we keep it safe

We will keep your information only for as long as needed to provide you with services or information, administer our relationship with you, inform research, comply with legal/contractual requirements, or ensure we do not communicate with people who have opted out.

When we no longer need your data we dispose of it securely, and may use specialist external companies to do this.

How we protect your information

Paper records are stored securely in locked cabinets in head offices
Electronic data is stored on a secure server and accessed via password-protected computers used only by staff
Personal information shared with third parties is communicated via secure email systems
We assess international data transfers in line with the UK data transfer regime and apply appropriate safeguards

Whilst we make every effort to protect your personal information, we cannot guarantee the security of information you transmit to third parties, and you do this at your own risk.

Data breaches

In case of a data breach, we take immediate steps to stop it and reduce impact. If the breach is likely to result in a high risk to your rights and freedoms, we will inform you without undue delay and explain how you can complain to the ICO.

Cookies

Cookies are small text files placed on your computer by websites you visit. They help websites work properly and help site owners understand usage.

To learn more about cookies, including how to manage or delete them, visit aboutcookies.org or allaboutcookies.org.

Data subject’s rights

You are not required to pay any charge for exercising your rights. If you make a request, we may have one month to respond. Contact [email protected].

Update your information: contact us if your details change or you believe information is inaccurate
Access your information: you can request access to your personal data we hold
Right to erasure (“right to be forgotten”): you can request deletion where there is no ongoing reason to process it
Right to object: you can object to processing (including where based on legitimate interests)
Withdraw consent: where consent is the lawful basis, you can withdraw at any time
Restrict processing: you can ask to restrict processing in certain circumstances
Data portability: you can request transfer of the data you provided
Direct marketing: you have the right not to receive direct marketing

Complaint procedure

You have the right to complain about how Oxfordshire Youth processes your personal data. For ICO guidance visit: ico.org.uk/make-a-complaint.

If you wish to make a complaint directly to Oxfordshire Youth, please email: [email protected] (accessed only by the Chair of Trustees). You will receive a response within five working days and complaints should be resolved within 28 days. You can remain anonymous if you wish.

Young people and privacy notices

Across our services we are committed to ensuring that young people are informed about how we process, use and store their personal data in an accessible way, project specific privacy notice and easy ready guides. These are made available to YP via email, paper copies and the website. We may do this via young-people-friendly notices, project-specific notices and easy read guides, shared by email, paper copies and via the website.Young people and privacy notices
when young people engage / consent with a project they are made aware of where to access these materials.

Privacy notice review This privacy notice is kept under regular review. This privacy notice was last updated in May 2025.