Depending on your relationship with YCDT, we may collect and process:

Personal information

• Name, address, email address, telephone number
• Date of birth and age
• Emergency contact details

Special category data (where necessary)

• Health, disability or mental health information
• Information about caring responsibilities
• Information about family members
• Safeguarding and child protection information
• Ethnicity, religion, gender, sexual preference where disclosed

Other information

• Education, employment or training information
• Notes from mentoring sessions or support activities or meetings
• DBS and safer recruitment information (for staff and volunteers)
• Donation and Gift Aid information
• Communication preferences
• Family income information
• Website usage data (via cookies)

We only collect special category data where it is necessary, proportionate and lawful.

We collect personal data in the following ways:

• Directly from you (e.g. application forms, referrals, sign-up forms, emails)
• From parents or carers (for young carers)
• From partner organisations, schools or referrers (with appropriate consent or lawful basis)
• Through our website forms
• Via third-party fundraising platforms
• Through mentoring, safeguarding or support interactions

We use personal data to:

• Deliver mentoring and support services
• Safeguard children, young people and adults at risk
• Assess eligibility and tailor support
• Recruit, train and support staff, volunteers and mentors
• Manage donations, Gift Aid and fundraising
• Communicate with supporters and stakeholders
• Share the impact of YCDT with funders and community
• Monitor, evaluate and improve our services
• Meet legal, regulatory and funding requirements

Under UK GDPR, YCDT relies on the following lawful bases:

• Consent – where you have given clear permission
• Contract – where processing is necessary to deliver services or volunteering
• Legal obligation – e.g. safeguarding, Gift Aid, employment law
• Vital interests – to protect someone from serious harm
• Public task – where processing supports safeguarding or welfare
• Legitimate interests – for charity administration, fundraising and evaluation

Special category data is processed under additional lawful conditions, including safeguarding of children and individuals at risk.

YCDT works primarily with children and young people who may be vulnerable. We take data protection and safeguarding extremely seriously.

• Safeguarding information is recorded, stored and shared strictly on a need-to-know basis
• We may share information with statutory agencies (such as schools, children’s social care or the police) with the consent of the family where there is a safeguarding concern, unless the safeguarding concern prevented that
• We cannot promise absolute confidentiality where safeguarding concerns arise

Our handling of safeguarding information aligns with our Safeguarding and Child Protection Policy.

If you donate to or fundraise for YCDT, we may process:

• Contact details
• Donation amounts and dates
• Gift Aid declarations
• Communication preferences

We use this information to:

• Process donations and Gift Aid
• Thank you and provide updates
• Meet legal and accounting requirements

We will not sell your data or share it with third parties for marketing purposes.

For volunteers, mentors, staff and trustees we may process:

• Contact and recruitment information
• References and DBS checks
• Training and supervision records
• Safeguarding and conduct information

This data is used to ensure safe recruitment, supervision and compliance with safeguarding obligations. YCDT does not use automated decision-making or profiling to make decisions that have legal or similarly significant effects on individuals. 

YCDT uses trusted third-party systems to manage data securely, including:

• Salesforce – case management, contacts, monitoring and evaluation
• Mailchimp – email communications
• Online platforms such as: JustGiving, Xero, Ticket Tailor, PayPal, Facebook Donations, Stripe, Google Workspace, WordPress, WhatsApp, Canva and Enthuse 
• uCheck – DBS and safer recruitment checks

All processors are required to meet UK GDPR standards and only process data on YCDT’s instructions.

International transfers

Some of the third-party systems we use may store or process personal data outside the UK. Where this happens, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement, UK Addendum to the EU Standard Contractual Clauses, or adequacy regulations, to ensure your personal data remains protected.

We may share personal data with:

• Local authorities, schools and statutory agencies (for safeguarding)
• Professional partners involved in support
• Funders (in anonymised or aggregated form wherever possible)
• Our professional advisers (e.g. auditors)

We only share information where lawful, necessary and proportionate.

We keep personal data only for as long as necessary, in line with legal, safeguarding and funding requirements.

Safeguarding records are retained securely in accordance with statutory guidance. Financial records are retained in line with HMRC requirements.

You have the right to:

• Access your personal data
• Request correction of inaccurate data
• Request erasure (in certain circumstances)
• Request a copy of your data in a portable electronic format (where applicable) 
• Restrict or object to processing
• Withdraw consent (where applicable)
• Lodge a complaint with the Information Commissioner’s Office (ICO)

Requests can be made by contacting us using the details above.

YCDT takes appropriate technical and organisational measures to protect personal data, including:

• Secure cloud-based systems
• Access controls and staff training
• Confidential handling of safeguarding information

We may use website analytics to understand how visitors use our website and improve its performance. 

Our website uses cookies to improve user experience. Please see our Cookie Policy for further information.

We may update this Privacy Policy from time to time. The latest version will always be available on our website.

If you would like this policy in a child-friendly or accessible format, please contact us.