Privacy Notice
Privacy Notice
Young Manchester is committed to protecting and respecting the privacy of your personal data. This privacy notice explains how your data is collected, used, transferred and disclosed by us. It also applies to data collected when you use our website or interact with us through social media, email, post, text or phone. This notice explains:
- How we keep your data safe and secure
- The personal data we collect
- How we collect your data
- How we use your data
- Communication preferences
- Links to other websites and third parties
- Your rights
- Changes to this notice
- How to contact us
Who is Young Manchester?
Young Manchester is an incorporated charity that aims to provide children and young people in communities across the city of Manchester with increased opportunities in all aspects of their life by commissioning projects that respond to their ever-changing needs.
Young Manchester, of Centurion House, 129 Deansgate, Manchester M3 3WR (collectively referred to as “Young Manchester”, “we”, “us” and “our” in this privacy notice) is the controller and responsible for your personal data collected through the www.youngmanchester.org website (the “website”).
We welcome feedback and are happy to answer any questions you may have about your data. Please send any questions, comments or requests for more information to our Data Protection Officer at dpo@youngmanchester.org.
Our commitment to you
We take the protection of your personal data seriously and will always process your personal data fairly, lawfully and transparently. This privacy notice describes the personal data we are collecting about you and how it is used. In summary, we will only collect and use your personal data in order to:
- fulfil your requests
- keep you up-to-date with news and updates from Young Manchester
- help us improve our website
- help us to make our communications more relevant to you
- improve our services
- meet our legal responsibilities.
In addition, for job applicants, we will use your information to assess your suitability for work and your right to work in the UK; and for employees, ex-employees, volunteers and trustees, we will use your information to provide HR and financial administration.
How we keep your data safe and secure
We have appropriate organisational safeguards and security measures in place to protect your data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We also limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know it. They will only be permitted to process your personal data on our instructions and will always be subject to a duty of confidentiality.
We keep your data confidential and store it on a secure server which is password protected and hidden behind a firewall. We require any third party who is contracted to process your personal data on our behalf to have security measures in place to protect your data and to treat such data in accordance with the law. In the event of a personal data breach, we will notify you and any applicable regulator when we are legally required to do so.
The personal data we collect
Our Users
While our website is designed for a general audience, we will not knowingly collect any data from children under the age of 13. The following types of personal data are collected from our users:
- Identity data such as: first name, last name, title, date of birth, personal description, photo, gender and hyperlinks to data posted on social media platforms.
- Contact data such as: e-mail address, postal address, telephone number, and social media id.
- Profile data such as: your interest in specific events and opportunities, feedback, and survey responses.
- Communications data such as: your preferences in receiving communications from us and our third parties, your communication preferences and the technologies used.
Our Staff
In addition, the following types of data may also be collected from our staff (job applicants, employees, ex-employees, volunteers and trustees):
- Identity data: such as proof of your identity, for example a passport, valid driving licence or birth certificate, occupation.
- Contact data: emergency and next of kin data.
- Employment data: such as your previous work history, experience and details of your referees from previous employers; and information about your employment with us such as start date, performance records, leaving date.
- Education data: this includes information such as your education history, qualifications, training and skills development.
- Criminal record data: this includes information such as any previous criminal convictions declared by you during the job application process and DBS checks and security screening when you commence employment.
- Financial data: includes information such as your national insurance number, expense records, payroll data, benefits, bank details and tax related information.
- Health data: includes information such as information collected via health questionnaires, such as relevant medical history and disability information, workplace risk assessments, occupational health and accident records.
- Attendance data: includes information such as authorised and unauthorised absences, holidays, maternity, paternity and sickness records.
- Grievance and disciplinary data: includes records of disciplinary and grievance processes and outcomes.
How we use your data
The legal basis for processing your personal data
We will only collect and process your personal data where we have a legal basis to do so. This could occur when we need your personal data to perform a contract with you, or the processing is in our legitimate interests, or we have a legal obligation to comply with, or we have your consent to do so.
Uses made of your personal data
Your personal data is used by Young Manchester to support a range of different activities. These are listed in the table below together with the types of data used and the legal bases we rely on when processing them, including where appropriate, our legitimate interests. Please be aware that we may process your personal data using more than one lawful basis, depending on the specific activity involved. Please contact us if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table below.
Uses made of your personal data
Purpose | Data Types | Lawful basis for processing |
---|---|---|
To enable you to take part in a competition, event or opportunity; including the delivery of event updates and instructions; provide feedback or complete a survey; inform you of related competitions. | • Identity • Contact • Profile • Communications | • Necessary for our legitimate interests (to understand how you use our services, to develop them and grow our organisation) • Performance of a contract with you: where you have decided to enter into a competition or event |
To manage our relationship with you, including: providing you with any information that you request from us; notifying you about changes to our privacy notice; asking you to leave a review or take a survey | • Identity • Contact • Profile • Communications | • Necessary for our legitimate interests (to keep our records updated and to study how you use our services) (where the relationship does not specifically cover participation in an event) |
To register you for Young Manchester email updates and newsletters | • Identity • Contact • Profile • Communications | • Consent (Where you have signed up for our email updates or provided us with your contact details when you registered for a competition or event) |
Provision of central support systems and services such as IT, travel, security, and HR | • Identity • Contact • Employment • Heath • Attendance • Grievance and disciplinary | • Necessary for the performance of a contract or to enter into a contract • Necessary for compliance with a legal obligation • Necessary for the legitimate interests of the organisation |
To administer, protect and improve our business and our website/App, including: maintenance, support, data analysis, reporting and hosting of data. | • Identity • Contact • Technical | • Necessary for our legitimate interests (for running our organisation, provision of admin and IT services, and to detect and prevent fraud) • Necessary to comply with a legal obligation * For applicants, employees, ex-employees, volunteers and Trustees only |
Recruitment, including: the verification of identity, provision of references and criminal records checks (to prevent fraud and unlawful acts) and the management of new starters and leavers. | • Identity • Contact • Employment • Education • Financial • Criminal record | • Necessary for the performance of a contract or to enter into a contract • Necessary for compliance with a legal obligation • Necessary for the legitimate interests of the organisation • Consent |
Capturing relevant health and medical information from new starters so that reasonable adjustments can be made in the work environment if needed. | • Identity • Contact • Health | • Necessary for the performance of a contract or to enter into a contract • Necessary for compliance with a legal obligation • Necessary for the legitimate interests of the organisation • Consent |
Management and monitoring of time and attendance including absence records and the return to work process | • Identity • Contact • Employment • Attendance | • Necessary for the performance of a contract or to enter into a contract • Necessary for compliance with a legal obligation • Necessary for the legitimate interests of the organisation |
Payment of salaries, expenses, rewards and benefits (including healthcare, pension provision) and the management of deductions | • Identity • Contact • Employment • Financial and tax | • Necessary for the performance of a contract or to enter into a contract • Necessary for compliance with a legal obligation • Necessary for the legitimate interests of the organisation |
Provision of training and development activities | • Identity • Contact • Education and skills | • Necessary for the performance of a contract or to enter into a contract • Necessary for compliance with a legal obligation • Necessary for the legitimate interests of the organisation |
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we wish to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. We may process personal data without your consent, in compliance with the above rules, where this is required or permitted by law.
DBS checks may be carried out on job applicants, staff, volunteers, trustees or employees employed for specific roles, with their consent, to guard against the risk of fraud or other unlawful acts being inflicted upon our customers, partners or staff. We would encourage staff and candidates to discuss any concerns they have regarding DBS checks with us.
If you have any questions about how Young Manchester use any of your personal data, please contact our Data Protection Officer by email at dpo@youngmanchester.org.
How long we keep your data for
We will keep your personal data for no longer than is necessary for the purpose(s) it was provided for and to meet our legal obligations. Further details of the periods for which we retain data are available on request.
Communications preferences
We may send you information about our activities and forthcoming events:
• by email if you have signed up for email newsletters,
• in accordance with your communication preferences if you have provided us with your details when you entered a competition and you have consented to receiving such communications.
We will ask you for your preferences in relation to receiving communications by e-mail, post, SMS and other communication channels.
You will always have full control of your communication preferences. If you do not wish to continue receiving information from us (or any third party, if applicable) at any time you can ‘opt-out’ by using the “Unsubscribe” link included in the footer of an email sent by us or by contacting us directly at dpo@youngmanchester.org.
We will process all opt-out requests as soon as possible, but please note that due to the nature of our IT systems it may take a few days for any opt-out request to be implemented.
Links to other websites and third parties
Our website may include links to and from the websites of our partners, sponsors, or support organisations or to social media platforms. If you follow a link to any of these websites, please note that these websites will have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to their websites.
How we share your data
We may disclose and share your personal data with the parties set out below:
- where you have consented for us to do so. For example, if you have consented to share your data with a third party in respect of an event or opportunity, we may pass your data on to the relevant third party for the purpose of administering such an event.
- to business partners, suppliers, sub-contractors and other third parties that we use in connection with the operation of our business for the purposes set out in the table above in the section ‘How we use your data’, such as:
- third party service providers that we engage to provide IT systems and software, and to host our website;
- third party service providers that we engage to organise events or provide marketing and advertising services.
- if we are under a duty to disclose or share your personal data in order to comply with any legal obligation; or
- to our professional advisers including lawyers, bankers, auditors and insurers who provide consultancy, banking, legal, insurance and accounting services.
Your data and countries outside of Europe
The personal data we collect from you may be transferred outside of the UK and the European Economic Area using legally-provided mechanisms to lawfully transfer data across borders. We will take all steps necessary to ensure that your data is treated securely and in accordance with this Privacy Notice. We will also ensure a similar degree of protection is afforded to it by ensuring appropriate safeguards, as required by law, are in place. This may include using specific contractual clauses approved by the European Commission which give personal data the same protection as it has in Europe.
Your Rights
You have several rights under the data privacy legislation. This includes, under certain circumstances, the right to:
- request access your personal data
- request correction of your personal data
- request erasure of your personal data
- request restriction of processing of your personal data
- request the transfer of your personal data
- object to processing of your personal data
- object to automated decision making
Brief details of each of these rights are set out below. If you wish to exercise any of these rights, please email our Data Protection Officer at dpo@youngmanchester.org
Request access to your personal data: You have the right to obtain a copy of the personal data we hold about you and certain information relating to our processing of your personal data.
Request correction of your personal data: You are entitled to have your personal data corrected if it is inaccurate or incomplete.
Request erasure of your personal data: You can request that Young Manchester delete your personal data, where there is no good reason for us continuing to process it.
Request restriction of processing of your personal data: You have a right to ask Young Manchester to restrict the processing of your personal data.
Request the transfer of your personal data: You have the right to obtain a digital copy of your personal data or request the transfer of your personal data to another organisation. Please note: This right only applies to digital data which you initially provided consent for us to use or where we used the data to perform a contract with you.
Object to processing of your personal data: You have the right to object to the processing of your personal data where we believe we have a legitimate interest in processing it (as explained above). You also have the right to object to our processing of your personal data for communications purposes.
Object to automated decision making and profiling: You have the right to object to the automated processing of your personal data without human intervention.
Right to lodge a complaint: If you have any concerns or complaints regarding the way in which we process your data, please email us directly. While, you also have the right to make a complaint to the ICO, we would appreciate the chance to deal with your concerns directly wherever possible.
We will try to respond to any legitimate request within one month. Occasionally, it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated. In addition, we may need to request specific information from you to help us confirm your identity and ensure your right to exercise any of the above rights. This is an additional security measure to ensure you’re your personal data is not disclosed to any person who has no right to receive it.
Changes to this notice
From time to time we may change this privacy notice. If there are any significant changes we will post updates on our website, applications or let you know by e-mail.
How to contact us
We welcome feedback and are happy to answer any questions you may have about your data. Please send any questions, comments or requests for more information to our Data Protection Officer at dpo@youngmanchester.org
This Privacy Notice was last updated on 24th July 2023 (Version 1.1*). Young Manchester, St James' Tower, 7 Charlotte Street, M3 3WR. Registered Company Number: CE006569 Charity no. 1166873
* Version 1.1 Changes: Removed dead link and updated email address for Data Protection Officer