TD1 Youth Hub – Data Protection & Privacy Policy (Reviewed September 2025)

1. Introduction
TD1 Youth Hub is committed to protecting the personal information of the young people, parents/carers, staff, volunteers, and partners we work with. We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other relevant laws.
This policy explains:
  • What data we collect.
  • Why we collect it.
  • How we use and store it.
  • Your rights over your data.

2. Who We Are
TD1 Youth Hub (Eildon West Youth Hub Ltd, SC207926) is a registered Scottish Charity (SC022005). Our registered address is 47 Ladhope Vale, Galashiels, TD1 1BW.
Contact for data protection queries: [email protected]

3. What Information We Collect
Depending on your relationship with us, we may collect:
  • Contact details (name, address, phone, email).
  • Date of birth and school year.
  • Parent/carer/emergency contact details (for under-18s).
  • Medical and support needs (to keep young people safe).
  • Attendance and participation records.
  • Photographs or video (only with consent).
  • Staff/volunteer employment or PVG information.

4. Why We Collect Data (Lawful Bases)
We process personal data under different lawful bases:
  • Legitimate interests – to deliver safe and effective youth work (e.g. holding contact details, logging attendance).
  • Legal obligation – for safeguarding, child protection, and employment law.
  • Consent – for optional activities such as publicity photos/videos or marketing updates.
We never sell or rent your data.

5. Children’s Data
Because we work directly with young people, we take extra care. For those under 16, parental consent is required where we rely on consent (e.g. publicity). For safeguarding and safety, we may collect necessary information directly from children and young people, always with transparency and in line with our safeguarding policy.

6. How We Use Data
We use your information to:
  • Run safe, inclusive youth programmes.
  • Contact you (or parents/carers) about sessions, events, or emergencies.
  • Monitor participation and evaluate impact (often anonymised).
  • Meet safeguarding and legal duties.
  • Share anonymised evidence with funders and partners.
  • Use photos/videos in publicity materials (if you’ve consented).

7. Sharing Data
We will only share personal information where it is:
  • Required by law (e.g. safeguarding concerns).
  • Necessary to work with trusted partners such as schools, health services, or funders.
  • With providers who process data for us (e.g. Google Forms/Drive, evaluation systems). These providers meet UK GDPR requirements.
We do not transfer personal data outside the UK without appropriate safeguards.

8. Retention & Deletion
We keep personal data only as long as necessary:
Young person contact details While active in services + 2 years
Safeguarding/child protection Until age 25 (or longer if required by law)
Staff/volunteer records Employment + 6 years
Photos/videos (with consent)3 years or until consent withdrawn
​
At the end of the retention period, data is securely deleted or anonymised.

9. Your Rights
You have the right to:
  • Access a copy of your data.
  • Ask us to correct mistakes.
  • Request erasure (“right to be forgotten”) where appropriate.
  • Restrict or object to processing in certain cases.
  • Withdraw consent at any time (where consent is the lawful basis).
  • Request portability of electronic records.
To exercise these rights, contact us at [email protected].

10. Security
We take practical steps to protect data:
  • Password-protected and encrypted systems.
  • Access limited by staff role.
  • Secure handling of paper records.
  • Regular review of systems and procedures.

11. Complaints
If you have concerns about how we handle your data, please contact us first at [email protected]
You also have the right to complain to the Information Commissioner’s Office (ICO): www.ico.org.uk / 0303 123 1113.

12. Review
​This policy is reviewed annually, or sooner if law or guidance changes.