Privacy Notice

1 Data controller

BE(YOU)FULL CIC is the data controller where it determines why and how personal information is processed.

• Company name: BE(YOU)FULL CIC
• Company number: 16792853
• Registered office: 128 Cannon Street Road, London, England, E1 2LH
• Privacy contact: beyoufull@gmail.com
• Website: beyoufull.org

In some commissioned programmes, another organisation may act as a separate or joint controller. Where this applies, participants should receive additional information explaining the respective responsibilities.

2 Who this notice applies to

This notice may apply to:

• visitors to beyoufull.org;
• people who contact or correspond with us;
• newsletter subscribers and supporters;
• programme, mentoring, workshop, event and research applicants or participants;
• children, young people, parents and guardians;
• school, trust, university, local-authority and community contacts;
• mentors, facilitators and delivery partners;
• workers, contractors, volunteers and applicants;
• funders, advisers and collaborators; and
• individuals connected with governance, safeguarding or organisational administration.

3 Supplementary notices

A particular programme, partnership, form or activity may include its own privacy information. That information should be read alongside this notice and will explain any activity-specific processing.

4 Categories of information

Depending on the relationship or activity, we may process:

• Identity details: name, title, age or date of birth where relevant.
• Contact details: email, telephone number, address and communication preferences.
• Professional details: role, organisation, school, trust, authority, sector or qualifications.
• Enquiry information: messages, questions, feedback and correspondence.
• Programme information: applications, attendance, participation, objectives, reflections, assessments and evaluations.
• Parent or guardian information: where required for participation, communication or consent.
• Transaction information: bookings, invoices, payments and accounting records where applicable.
• Technical information: IP address, browser, device, website interactions, security records and consent preferences.
• Media information: photographs, audio, video, quotations or testimonials where appropriately authorised.
• Recruitment information: applications, CVs, references, eligibility and work history.

5 Sensitive information

Some programmes or organisational responsibilities may require information about health, disability, ethnicity, religion or belief, accessibility, welfare, safeguarding or support needs.

Where relevant to safeguarding, recruitment or regulated roles, limited criminal-offence, vetting or disclosure information may also be processed.

6 Sources of information

Information may be obtained:

• directly from you;
• from a parent, guardian or authorised representative;
• from a school, trust, university, local authority, commissioner or delivery partner;
• through forms, email, telephone calls, meetings, events, surveys or applications;
• through programme participation, mentoring, evaluation or research;
• automatically through website logs, cookies and security technologies;
• from service providers acting on our behalf; or
• from lawful public or professional sources where relevant and proportionate.

7 Processing purposes

We may use personal information to:

• respond to enquiries and requests;
• assess and administer programmes, mentoring, events, partnerships or research participation;
• deliver agreed services, resources or support;
• manage relationships with schools, universities, authorities, partners, funders and professional contacts;
• provide operational information and requested updates;
• monitor participation, quality, outcomes and impact;
• meet safeguarding, welfare, accessibility and equality responsibilities;
• administer contracts, accounts, invoices and payments;
• recruit and support workers, facilitators, contractors or volunteers;
• operate and protect the website;
• prevent fraud, misuse and unauthorised access;
• establish, exercise or defend legal rights; and
• comply with legal, regulatory, insurance, funding and governance requirements.

8 Lawful bases

9 Consent and legitimate interests

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.

Where we rely on legitimate interests, we consider the organisational purpose, the necessity of the processing and its potential effect on the individual.

Where a recognised legitimate interest applies under data protection law, we will still consider whether the processing is necessary and apply appropriate safeguards.

10 Children’s information

BE(YOU)FULL CIC delivers and supports activities relating to young people, mentoring, identity, confidence, agency, education and leadership development.

Where information is collected directly from a child or young person, we aim to explain its use in clear, accessible and age-appropriate language.

Where appropriate, a shorter participant privacy notice may also be provided during application, onboarding or programme delivery.

11 Consent and participation

The appropriate consent or authority depends on the young person’s age, understanding, the activity involved and the lawful basis being used.

Some activities may require:

• parental or guardian consent;
• the young person’s informed agreement;
• authorisation from a school or commissioning body;
• specific photography or media permission; or
• separate safeguarding, accessibility or participation documentation.

Consent is not the only lawful basis that may apply to children’s information.

12 Safeguarding disclosures

Confidentiality cannot be guaranteed where information indicates a risk of harm, abuse, exploitation, serious neglect or another safeguarding concern.

Relevant information may be shared with a safeguarding lead, school, commissioning organisation, local authority, police, emergency service or another authorised body where this is necessary and lawful.

Read the Safeguarding and Participant Safety page for further information.

13 Who information may be shared with

Where necessary, proportionate and lawful, information may be shared with:

• website hosting, security, technical-support and backup providers;
• email, communications, booking, form and document service providers;
• payment, banking, accounting and administrative providers;
• schools, trusts, universities, local authorities, commissioners and delivery partners;
• authorised mentors, facilitators, researchers or evaluators;
• funders or reporting organisations, normally using aggregated or minimised information where appropriate;
• professional advisers, accountants, insurers and legal representatives;
• regulators, courts, government bodies or law-enforcement authorities where required; or
• safeguarding authorities and emergency services where necessary to protect an individual.

We do not sell personal information.

14 Service providers

Providers processing information on our behalf should be contractually required to follow our instructions, protect the information and use it only for authorised purposes.

Some partners may act as independent or joint controllers where they decide their own processing purposes.

15 International transfers

Some digital providers may store or process information outside the United Kingdom.

Where personal information is transferred internationally, an appropriate transfer mechanism and safeguards will be used where required. These may include:

• UK adequacy regulations;
• an approved international data transfer agreement or UK addendum;
• another lawful transfer provision; and
• supplementary contractual, organisational or technical safeguards where appropriate.

16 Retention

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected and for relevant legal, contractual, safeguarding, insurance, funding, accounting or claims requirements.

Retention decisions consider:

• the nature and sensitivity of the information;
• the duration of the relationship or programme;
• statutory and contractual requirements;
• safeguarding and welfare responsibilities;
• funding, audit and reporting requirements;
• legal limitation periods; and
• whether deletion, anonymisation or aggregation can replace continued retention.

17 Information security

We apply reasonable and proportionate measures to protect personal information against unauthorised access, alteration, disclosure, loss, destruction or misuse.

Measures may include:

• access controls and role-based permissions;
• authentication and password controls;
• secure hosting, updates, backups and monitoring;
• encryption where appropriate;
• supplier due diligence and contractual controls;
• confidentiality requirements;
• data minimisation and secure deletion; and
• incident-assessment and response procedures.

No email system, website or online service can guarantee absolute security.

18 Cookies and website technologies

The website may use cookies, scripts, local storage and similar technologies for security, consent preferences, functionality, analytics and embedded content.

Optional technologies are managed through the website’s consent controls where consent is required.

Read the Cookie Policy for information about current categories, providers and retention periods.

19 Newsletters and direct communications

We may send newsletters, event information, programme updates or relevant organisational communications where:

• you have requested or consented to receive them;
• they are necessary for an existing relationship, programme or service; or
• another lawful basis permits the communication and applicable electronic marketing requirements are met.

You may unsubscribe from optional marketing communications using the unsubscribe link provided or by contacting us.

A limited suppression record may be retained so that an unsubscribe request continues to be respected.

20 Automated decision-making

BE(YOU)FULL CIC does not ordinarily make decisions about individuals using solely automated processing where the decision produces legal or similarly significant effects.

If significant automated decision-making is introduced for a particular activity, separate information will explain the lawful basis, logic, likely consequences and available safeguards.

21 Your rights

Depending on the circumstances and lawful basis, you may have the following rights:

These rights are not absolute. A request may be restricted where an exemption applies, information must be retained by law, or another person’s rights would be affected.

22 Making a request

To exercise a right, email: beyoufull@gmail.com .

Explain the right you wish to exercise and provide enough information for us to identify the relevant records.

We may request proportionate proof of identity or authority where necessary to prevent unauthorised disclosure.

Rights requests will normally be addressed within the period required by applicable data-protection law.

23 Data-protection complaints

You may complain directly to BE(YOU)FULL CIC if you believe that we have not handled your personal information in accordance with data-protection law.

We will:

• provide an accessible way to raise the complaint;
• acknowledge it within 30 days;
• investigate it appropriately;
• respond without undue delay;
• explain the outcome; and
• tell you about your right to contact the Information Commissioner’s Office.

Complaints may be sent to: beyoufull@gmail.com .

24 Changes to this notice

We may update this notice to reflect changes in our activities, programmes, technologies, suppliers, legal obligations or organisational arrangements.

The current version and revision date will be published on this page.

25 Contact

Contact BE(YOU)FULL CIC with questions about this notice, a rights request or a data-protection concern.