Young Peoples Education Community (YPEC) is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, store, and protect your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
We are committed to being transparent about how we collect and use your data, and to meeting our data protection obligations.
1. Who We Are
YPEC is a Community Interest Company registered in the United Kingdom. We are the data controller for the personal information you provide to us.
If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:
- Email: info@ypec.co.uk
- Phone: 07792429553
- Address: United Kingdom
2. Information We Collect
We may collect and process the following types of personal data about you:
Information You Provide to Us:
- Name and contact details (email address, phone number, postal address)
- Organisation or school name and your role
- Information submitted through contact forms or email enquiries
- Service booking and registration information
- Feedback, survey responses, and testimonials
- Correspondence and communications with us
Information We Collect Automatically:
- Technical information including IP address, browser type, and version
- Information about your visit, including pages viewed and navigation paths
- Time and date of visits and length of visit
- Referring website addresses
Sensitive Personal Data:
In the course of delivering our services, we may collect sensitive personal data about children and young people, including information about their health, wellbeing, and safeguarding. We only collect this information where necessary for service delivery and with appropriate consent and safeguarding measures in place.
3. How We Use Your Information
We use your personal data for the following purposes:
- To provide and deliver our RSHE training, workshops, and engagement services
- To respond to your enquiries and communicate with you
- To process service bookings and manage our relationship with you
- To send you information about our services that may be of interest to you
- To improve our website and services
- To comply with legal and regulatory obligations
- For safeguarding purposes where necessary to protect children and young people
- To conduct research and evaluation of our programmes
4. Legal Basis for Processing
Under UK GDPR, we must have a lawful basis for processing your personal data. We rely on the following legal bases:
- Consent: Where you have given clear consent for us to process your personal data for specific purposes.
- Contractual necessity: Where processing is necessary for the performance of a contract with you or to take steps at your request before entering into a contract.
- Legal obligation: Where we need to process your data to comply with the law, including safeguarding obligations.
- Legitimate interests: Where processing is necessary for our legitimate interests or those of a third party, provided your interests and fundamental rights do not override those interests.
- Vital interests: Where processing is necessary to protect someone's life or in situations of medical emergency.
For sensitive personal data relating to children and young people, we ensure we have explicit consent from appropriate individuals or rely on other applicable legal bases such as safeguarding obligations.
5. Sharing Your Information
We will not sell or rent your personal data to third parties. We may share your personal data with:
- Service providers: Trusted third parties who provide services on our behalf, such as IT support, email services, and website hosting.
- Partner organisations: Where necessary to deliver our services, we may share information with schools, local authorities, and other organisations working with young people.
- Research partners: Our affiliated research company Insight Now, for consultation and research purposes, subject to appropriate data sharing agreements.
- Legal and regulatory authorities: Where required by law or to protect the rights, property, or safety of YPEC, our service users, or others.
- Safeguarding bodies: Where we have concerns about the safety or wellbeing of a child or young person.
All third parties are required to maintain appropriate security measures to protect your personal data and may only use your data for the purposes we specify.
6. Data Retention
We will retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, or reporting requirements.
- Contact enquiries: Up to 2 years from last contact
- Service delivery records: Up to 7 years for contractual and legal compliance
- Safeguarding records: In accordance with statutory safeguarding guidance
- Marketing communications: Until you unsubscribe or request removal
When we no longer need your personal data, we will securely delete or anonymise it.
7. Your Rights Under GDPR
Under UK GDPR, you have the following rights regarding your personal data:
- Right of access: You have the right to request a copy of the personal data we hold about you.
- Right to rectification: You can ask us to correct inaccurate or incomplete personal data.
- Right to erasure: You can request that we delete your personal data in certain circumstances.
- Right to restrict processing: You can ask us to restrict how we use your personal data in certain situations.
- Right to data portability: You can request to receive your personal data in a structured, commonly used, machine-readable format.
- Right to object: You can object to processing based on legitimate interests or for direct marketing purposes.
- Rights related to automated decision-making: We do not use automated decision-making or profiling.
- Right to withdraw consent: Where we rely on consent, you can withdraw it at any time.
To exercise any of these rights, please contact us at info@ypec.co.uk. We will respond to your request within one month.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues, at www.ico.org.uk.
8. Data Security
We take the security of your personal data seriously and have implemented appropriate technical and organisational measures to protect it against unauthorised or unlawful processing, accidental loss, destruction, or damage.
Security measures include:
- Secure servers and encrypted data transmission (SSL/TLS)
- Access controls limiting who can view and use personal data
- Regular security assessments and updates
- Staff training on data protection and security
- Secure backup and disaster recovery procedures
While we strive to protect your personal data, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security.
9. Cookies and Tracking Technologies
Our website uses cookies to improve your browsing experience and help us analyse how our website is used.
What Are Cookies?
Cookies are small text files placed on your device when you visit a website. They help the website recognise your device on future visits.
Types of Cookies We Use:
- Essential cookies: Necessary for the website to function properly.
- Analytical cookies: Help us understand how visitors use our website so we can improve it.
- Functional cookies: Remember your preferences and settings.
Most web browsers allow you to control cookies through their settings. You can choose to block or delete cookies, but this may affect your experience of our website.
10. Third-Party Services
Our website may contain links to third-party websites and services. We are not responsible for the privacy practices of these third parties, and we encourage you to read their privacy policies.
We may use the following third-party services:
- Website hosting and technical infrastructure providers
- Email delivery services
- Analytics services to understand website usage
All third-party service providers are carefully selected and required to comply with GDPR and maintain appropriate security standards.
11. International Data Transfers
We primarily store and process your personal data within the United Kingdom. If we need to transfer your data outside the UK or European Economic Area (EEA), we will ensure appropriate safeguards are in place, such as:
- Standard contractual clauses approved by the UK authorities
- Transfers to countries with an adequacy decision
- Other legally approved transfer mechanisms
12. Children's Privacy
Our services are focused on supporting children and young people. We take additional care when processing personal data relating to children and ensure:
- Appropriate consent is obtained from parents, guardians, or those with parental responsibility
- Information is provided in a clear and age-appropriate manner
- Enhanced security measures are in place for children's data
- Strict compliance with safeguarding obligations
- Regular review of data processing activities involving children
We do not knowingly collect personal data from children through our website without appropriate consent.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make changes, we will update this page.
We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data.
14. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us:
- Email: info@ypec.co.uk
- Phone: 07792429553
- Address: United Kingdom
We are committed to working with you to obtain a fair resolution of any complaint or concern about privacy.