Index
- General information
- Personal data that we collect on adults
- Storage and retention of information
- How to access the personal information we hold on you
- Sharing of data
- Cold Calling
- Communications and social media
- Information held about children and young people
- Recruitment processes
- Data Protection Officer
General Information
We at Direct Education Business Partnership (DEBP) CIO love our jobs, working with business volunteers, young people, teachers, and young people. To do that effectively, we need to know a little bit about you.
However, your privacy is important to us. This privacy statement explains what personal data DEBP CIO collects from you, through our interactions with you and how we use that data.
DEBP offers a wide range of volunteering opportunities, some of which are against specific needs, others which are more general.
Our website is www.debp.org
All staff use Microsoft Office 365, a secure cloud-based system.
Under the UK General Data Protection Regulation (UK GDPR), the lawful bases we rely on for processing information are:
- Your consent. You are able to remove your consent at any time. You can do this by contacting our Data Protection Officer by emailing business.manager@debp.org
- We have a contractual obligation
Please read the specific details in this privacy statement, which provide additional information about some of DEBP’s activities.
Personal Data that we collect on adults
For all the business people we deal with, we collect the information you would normally find on a business card:
Name / Organisation / Organisation address / Job role / Telephone number(s) / Email address / website / social media.
In addition, particularly useful information to us might include your areas of interest, including your business sector or curriculum subject. This enables us to match you to the most appropriate opportunities to inspire and support young people.
Much of our funding comes from contracts. Consequently, some contractors require us to collect additional information.
If you participate in a contract that requires extra data, we will clearly explain what information we need to collect and why. Furthermore, we will outline how we handle, store and protect your data.
Storage and retention of Information
We store all the personal information we gather on secure cloud based systems.
At any time, you can ask us to return or remove all the data we hold on you. Please do this in writing and present your ID documents to our Chesterfield Office. We will do this within 30 days of seeing your identification.
Every August, we delete personal data that no one has updated during the previous three full years. We complete this work during a quieter period, which allows us to manage the process effectively.
However, some contracts require us to keep information for longer periods. In these cases, we retain the data so contractors can carry out audits and meet their compliance requirements.This can be 7 or even 10 years. We will only keep your data if required to by our funders.
How to access the personal information we hold on you
You can make a request at any time for us to gather the personal information we hold on you. To do this, we will ask you to bring two things to our Chesterfield Office:
- Your passport or UK driving licence (or suitable ID documents from another country)
- An official proof of address sent through the post during the last 3 months
We will pull together all the data we hold within a period of 30 days from the date we receive the identification documents.
Sharing of data
When you participate in an activity, we share basic information with the people and organisations involved. This may include your name, school, year group, contact details and, in some cases, information about your interests.
We may share this information in an Excel spreadsheet. If we send the file by email, our staff encrypt or password-protect it before sending it.
We would never sell or transfer your information to 3rd parties.
Cold Calling
Sometimes, we work in new locations, explore new business sectors or offer opportunities in specific areas. As a result, we may search for updated telephone numbers and email addresses so we can contact you.
We record all contact attempts on our database. If you ask us not to contact you again, we will record your preference and stop contacting you.
However, if you consent to future contact, we will record your consent on our database. Furthermore, if the current opportunity does not suit your needs, we will contact you when we identify another opportunity that may interest you.
Communications and social media
We like to tell people about the great work that volunteers are doing with young people, and what schools are doing to prepare their students for the world of work. We have active X (formerly known as Twitter) feeds and may post on LinkedIn, Instagram, or Facebook. If you do not want us to mention you on these feeds, simply let us know and we will respect your wishes.
To celebrate achievements on our website, we write case studies about the work that is happening. Before we include you in a case study, we will ask for your permission to use your information and any photographs. This gives you a chance to redact anything you do not want us to say.
We sometimes communicate via e-newsletters etc using outlook or via software which carry an unsubscribe option. This is to tell you of the opportunities for either volunteering or enrichment activities and to thank you for the work you are doing.
Information held about Children and Young People
(Definition: Children up to the age of 13; Young People from the age of 14 up to the age of 19 and up to the age of 25 for young people with special needs and disabilities)
We work closely with lots of fantastic children and young people. It helps then if we at least know their name, school and year group and have it on a register for monitoring attendance and celebrations. The staff member supporting the young person usually keeps a record of activities, contact and any issues they face. Other staff members can access this information when they need it to provide support.
We store all information securely when staff are not using it.
As part of our one-to-one support, schools, parents or carers may share information about medical conditions or family circumstances. We only share this information with staff who need it to provide appropriate support.
For young people on our Project SEARCH programmes, we share relevant personal information with the Department for Work and Pensions for Access to Work claims. In addition, we share information with host employers and education providers when needed to support the programme.Under the UK GDPR, the lawful basis we rely on for processing this information is consent.
Where we are looking at distance travelled during our programmes we may hold:
- Self-evaluations
- CV’s and application forms
- Likes and dislikes
We will use this information to give them bespoke support.
When we have finished working with the young person, we will shred paper copies and ensure we delete anything sent to us electronically which contains personal information.
We will only store information on young people if our contract asks us to do so. Where it can be anonymised, we will do so.
Irrespective of the age of the young person, if they are in compulsory education phases then DEBP seek consent from a parent/carer as well as the young person directly. We ensure that young people are aware they have the same rights as adults over their personal data and explain why we require the data and how it will be used. This explanation is delivered clearly and is accessible by the young person. When there is not capacity to understand this, DEBP ensure that the information is communicated effectively with parents/carers.
For intensive support programmes, where a long-term relationship is in place between DEBP and the young person, parent/carer consent is sought, and their personal contact details are retained by DEBP. These are not shared with anyone external to DEBP and will be destroyed in line with the end of any contracts and our document retention policy.
When DEBP are contracted by another organisation to work with the young people, DEBP are contractually obliged to share information with the funders. This information can include name; date of birth, home postcode, school attending, year group, ethnicity and learning support needs. A student or their parent/carer can decline to share this. Where consent is provided, this data is transferred to the third party securely.
Directions service was launched in April 2020. Staff involved in this delivery undertake support via remote methods including video conferencing. The recording of interventions may sometimes be required for training and monitoring purposes, but we will only do this if we have your consent. Any recordings will be saved onto a confidential area of our system and will be deleted after 10 working days. Information that will be stored on an Excel spreadsheet will only include Name/School/Year Group.
Insight+
DEBP sometimes undertake research and evaluation under our Insight+ arm of the organisation. DEBP’s work with the Youth Futures Foundation means that we collect information about young people and their parents/carers through one-to-one interviews, online surveys and group discussions. Personal information collected includes name, address, contact details, date of birth, gender, ethnicity, employment details, school and year group, /Health diagnoses – either Autistic Spectrum Conditions (ASC) and/or Learning Disability (LD)
We securely store all information on our Microsoft 365 platforms, including interview recordings.
We keep all personal data within DEBP and will delete personal information when the contract ends in July 2025.
Recruitment Processes
When we recruit, we will ask candidates to fill out an application form which may be online or on paper. Some candidates choose to send us their Curriculum Vitae. We will keep these documents in our systems until we fill the post, then we will delete or shred them. We may wish to keep some information on file to contact candidates for future posts. If we wish to do that, we will ask for email consent from the candidate. Candidates are also welcome to ask us to keep their details on file by contacting us on email.
Data Protection Officer
If you have any questions about our work, please contact our Data Protection Officer using the email address: business.manager@debp.org