Privacy Policy

1 Who controls your information

BE(YOU)FULL CIC is the data controller for personal information where it determines why and how that information is processed.

• Company name: BE(YOU)FULL CIC
• Company number: 16792853
• Registered office: 128 Cannon Street Road, London, England, E1 2LH
• Privacy contact: info@beyoufull.com

In some commissioned programmes or partnership activities, another organisation may act as a separate controller or joint controller. Where this applies, you should receive additional information explaining the respective responsibilities of each organisation.

2 Scope of this policy

This policy may apply to personal information relating to:

• visitors to the BE(YOU)FULL website;
• people who contact or correspond with us;
• newsletter and communication subscribers;
• programme, workshop, mentoring, event or research applicants and participants;
• parents, guardians and responsible adults;
• school, trust, local authority, public-sector, community and organisational contacts;
• mentors, coaches, facilitators and delivery partners;
• volunteers, contractors and prospective workers;
• funders, advisers, supporters and collaborators; and
• other individuals whose information is processed in connection with our legitimate activities.

A specific programme, service or activity may have its own privacy notice. That additional notice should be read alongside this policy.

3 Categories of personal information

The information collected depends on how you interact with BE(YOU)FULL. It may include:

• Identity information: name, title, age or date of birth where relevant.
• Contact information: email address, telephone number, postal address and communication preferences.
• Professional information: job title, organisation, school, trust, authority, sector, qualifications or professional interests.
• Enquiry and correspondence information: messages, questions, feedback, requests and records of communication.
• Programme information: applications, attendance, participation, objectives, evaluations, reflections and administrative records.
• Parent, guardian or responsible-adult information: where required for participation, consent, communication or safeguarding.
• Transaction information: payment, purchase, invoice or booking information where a paid product, event or service is provided.
• Technical and usage information: IP address, browser, device, operating system, referring page, website interactions, security logs and cookie preferences.
• Media and contribution information: photographs, audio, video, quotations, testimonials, creative submissions or event contributions where appropriately authorised.
• Recruitment and engagement information: CVs, work history, references, availability, eligibility and related records.

4 Sensitive and safeguarding information

Some activities may require information that receives additional legal protection, including information about health, disability, ethnicity, religion or belief, or other special category information.

Safeguarding, accessibility, equality, welfare or programme delivery requirements may also require proportionate information about support needs, risks, incidents or protective measures.

Please do not send sensitive personal information through a general contact form or ordinary email unless it has been requested and an appropriate process has been provided.

5 How information is collected

Personal information may be collected:

• directly from you;
• from a parent, guardian, responsible adult or authorised representative;
• from a school, trust, local authority, commissioning organisation or delivery partner;
• through website forms, email, telephone calls, meetings, events, surveys or applications;
• through participation in programmes, mentoring, workshops, research or evaluation;
• automatically through website security, server logs, cookies and similar technologies;
• from service providers acting on our behalf; or
• from lawful public or professional sources where relevant and proportionate.

6 Processing purposes

BE(YOU)FULL may process personal information to:

• respond to enquiries and requests;
• assess and administer programme, event, mentoring, partnership or research participation;
• deliver agreed products, services, resources or support;
• manage relationships with schools, trusts, local authorities, partners, funders and professional contacts;
• communicate operational information, updates and requested materials;
• provide newsletters or promotional communications where legally permitted;
• monitor participation, quality, learning, outcomes and organisational impact;
• meet safeguarding, welfare, accessibility and equality responsibilities;
• manage contracts, invoices, payments, accounts and organisational records;
• recruit, assess and support workers, contractors, facilitators or volunteers;
• maintain website security, performance and availability;
• prevent fraud, misuse, unauthorised access or unlawful activity;
• establish, exercise or defend legal rights; and
• comply with legal, regulatory, insurance, funding and governance obligations.

7 Lawful bases

UK data protection law requires an appropriate lawful basis for each processing activity. The basis used depends on the purpose, context and relationship involved.

8 New or different purposes

Personal information will not normally be used for an unrelated purpose without first assessing whether that use is lawful and compatible with the original purpose.

Where required, BE(YOU)FULL will provide additional privacy information and obtain consent before beginning a materially different use.

9 Information about children and young people

BE(YOU)FULL supports activities relating to youth development, education, mentoring and agency. Personal information about children and young people requires particular care.

Where information is collected directly from a child or young person, BE(YOU)FULL will aim to provide privacy information in clear, accessible and age-appropriate language.

Depending on the activity, information may also be provided to or collected through:

• a parent or guardian;
• a school, trust or educational institution;
• a local authority or commissioning organisation;
• a safeguarding lead or responsible professional; or
• another person authorised to act in relation to the young person.

10 Consent, authority and participation

The appropriate consent or authority depends on the young person’s age, understanding, the nature of the activity and the legal basis being used.

Some activities may require:

• parental or guardian consent;
• the young person’s informed agreement;
• authorisation from a school or commissioning body;
• specific media or publication consent; or
• separate safeguarding, accessibility or participation documentation.

Consent is not the only lawful basis that may apply. Where another basis is used, the relevant privacy information should explain it.

11 Safeguarding disclosures

Confidentiality cannot always be maintained where information indicates a risk of harm, abuse, exploitation, serious neglect or another safeguarding concern.

Information may be shared with an appropriate safeguarding lead, responsible organisation, local authority, police, emergency service or other authorised body where this is necessary and lawful to protect a child, young person or another individual.

12 Cookies and similar technologies

The website may use cookies, scripts, tags, local storage and similar technologies to operate securely, remember preferences, understand performance and provide embedded functionality.

Strictly necessary technologies may operate where they are required for the website or a service requested by the visitor and where an applicable legal exemption permits their use.

Where consent is legally required, optional analytics, preference, advertising or similar technologies should not be activated until the visitor has made an affirmative choice.

Further information about the categories, purposes, durations and providers used on the website is available in the Cookie Policy .

13 Embedded and third-party content

Pages may contain videos, maps, forms, booking tools, social media features, documents or other content supplied by third parties.

When you interact with an embedded service, the provider may receive information about your device, browser, IP address and interaction. Its own privacy notice and terms may also apply.

Where required, non-essential embedded content should remain blocked until the visitor provides consent.

14 Newsletters and direct communications

BE(YOU)FULL may send newsletters, invitations, updates or information about relevant work where:

• you have requested or consented to receive them;
• the communication is necessary for an existing programme, event, service or organisational relationship; or
• another lawful basis permits the communication and applicable electronic marketing rules are satisfied.

You may unsubscribe from optional marketing communications by using the unsubscribe facility provided or by contacting info@beyoufull.com .

A limited suppression record may be retained to ensure that a withdrawn marketing preference continues to be respected.

15 Automated decision-making

BE(YOU)FULL does not ordinarily make decisions about individuals using solely automated processing where the decision produces legal or similarly significant effects.

If this changes for a particular service or programme, separate information will explain the logic involved, the likely consequences and the rights available to the individual.

16 Who information may be shared with

Where necessary, proportionate and lawful, information may be shared with:

• website hosting, technical support, security and backup providers;
• email, communications, form, booking, event and document service providers;
• payment, accounting, banking and administrative providers;
• schools, trusts, local authorities, commissioners and programme partners;
• mentors, coaches, facilitators, researchers, evaluators or authorised delivery personnel;
• funders or reporting bodies, normally using aggregated or minimised information where appropriate;
• professional advisers, insurers, accountants and legal representatives;
• regulators, courts, government bodies or law-enforcement authorities where legally required; or
• safeguarding authorities and emergency services where necessary to protect an individual.

Service providers acting as processors should be required to use personal information only for authorised purposes, protect it appropriately and comply with relevant contractual obligations.

17 International data transfers

Some digital service providers may store or process information outside the United Kingdom.

Where personal information is transferred internationally, BE(YOU)FULL will seek to ensure that an appropriate lawful transfer mechanism applies. This may include:

• transfer to a country covered by UK adequacy regulations;
• use of an approved international data transfer agreement or UK addendum;
• application of another lawful transfer exception; and
• additional technical, contractual or organisational safeguards where required.

18 How long information is retained

Personal information is retained only for as long as reasonably necessary for the purpose for which it was collected and for any relevant legal, contractual, safeguarding, insurance, funding, accounting or claims requirements.

Retention decisions may consider:

• the nature and sensitivity of the information;
• the duration of the relationship or programme;
• legal limitation periods and statutory requirements;
• safeguarding and welfare responsibilities;
• funding, audit and reporting obligations;
• whether the information is still required to respond to a dispute, enquiry or rights request; and
• whether retention can be replaced by deletion, anonymisation or aggregation.

19 Information security

BE(YOU)FULL takes reasonable and proportionate measures to protect personal information against unauthorised access, alteration, disclosure, loss, destruction and misuse.

Measures may include:

• access controls and role-based permissions;
• strong authentication and password practices;
• secure hosting, updates, backups and monitoring;
• encryption where appropriate;
• confidentiality and data protection obligations;
• supplier due diligence and contractual safeguards;
• data minimisation and secure deletion; and
• incident assessment and response procedures.

No website, email system or online service can guarantee absolute security. Individuals should avoid sending unnecessary sensitive information through insecure channels.

20 Your data protection rights

Depending on the circumstances and the lawful basis being used, you may have the following rights:

These rights are not absolute. A request may be limited or refused where an exemption applies, information must be retained by law, another person’s rights would be affected or the request is manifestly unfounded or excessive.

21 Making a privacy request

To make a request, contact: info@beyoufull.com .

Please explain the right you wish to exercise and provide enough information to locate the relevant records.

BE(YOU)FULL may request proportionate evidence of identity or authority where this is necessary to protect personal information from unauthorised disclosure.

Requests will normally be addressed within the time required by applicable data protection law. More time may be permitted for complex or multiple requests, in which case the individual will be informed.

22 Complaints

Privacy concerns should first be raised with BE(YOU)FULL so that they can be reviewed and, where appropriate, resolved.

You also have the right to complain to the United Kingdom’s data protection regulator:

You may contact the regulator without first contacting BE(YOU)FULL, although raising the matter with us may allow it to be addressed more quickly.

23 Changes to this policy

This policy may be updated to reflect changes in BE(YOU)FULL’s activities, services, technologies, suppliers, organisational arrangements or legal obligations.

The current version will be published on this page with its revision date. Where a material change affects an existing processing activity, additional notice will be provided where reasonably practicable and legally required.

24 Contact information

Contact BE(YOU)FULL CIC with questions about this policy, personal information, a rights request or a privacy concern.