Yusuf Youth Initiative (YYI) is committed to protecting the privacy of your personal information. YYI acts as a ‘data controller’ and complies with the Data Protection Act 2018 which includes the General Data Protection Regulation (GDPR). This privacy notice tells you what you can to expect us to do with your personal information when you make contact with us or use one of our services.

In order to carry out our work, it is necessary for YYI to collect and use certain types of information about individuals who come into contact with YYI. This information includes names, addresses, emails, phone numbers, volunteering interests and any relevant health information. The information we collect from you, varies according to the service you are involved in.
To enable us to provide you with a service we may require certain “necessary information” from you and if you do not provide that information we may not be able to provide you with the service.

YYI will process personal data for the reasons listed below:
• To provide you with a range of services
• For statistical information required by external agencies, government bodies, prospective and existing funders. Where relevant, personal data will be anonymised to prevent individuals from being identified.

YYI can process personal data on the lawful basis of ‘legitimate interests’. We will only hold this information where it is necessary in enabling us to provide you with a service or where we have gained explicit consent from you.

We will gain explicit consent prior to sharing your health information. We will inform you of the organisation it is being shared with and the purpose it is being shared for. YYI may share data with other agencies such as the local authority, Health organisations, funding bodies and other voluntary agencies. You will be made aware how and with whom your information will be shared with.

There are circumstances where the law allows YYI to disclose data (including sensitive data) without the data subject’s consent.

These are:
• Carrying out a legal duty or as authorised by the Secretary of State
• Protecting vital interests of an Individual/Service User or other person
• The Individual/Service User has already made the information public
• Conducting any legal proceedings, obtaining legal advice or defending any legal rights
• Monitoring for equal opportunities purposes – i.e. race, disability or religion
• Providing a confidential service where the Individual/Service User’s consent cannot be obtained or where it is reasonable to proceed without consent: e.g. where we would wish to avoid forcing stressed or ill Service Users to provide consent signatures.

What we do with your data

Information and records will be stored securely and will only be accessible to authorised staff and volunteers. Information will be stored for only as long as it is needed or required statute and will be disposed of appropriately. Your personal details will not be given to anyone outside YYI without your consent unless it is necessary for us to do so, i.e. in order to comply with the law, with police investigations or it is determined that there is risk of significant harm to either yourself or another person. Information about your postcode, gender, ethnicity, status, age, may be disclosed to our funders, or in our Annual Report, but only in the form of statistics and not in any way that identifies you.

How long do we keep your data?

Information will be stored for only as long as it is needed or required statute and will be disposed of appropriately. Your data will be retained while you are still within our services. We will retain your information for no more than two years after you leave the service.

What are your rights?

You have the right to access the information YYI holds about you. Individuals may exercise the right by making a written ‘subject access request’ (SAR). However, subject access goes further than this and an individual is entitled to be:
• told whether any personal data is being processed
• given a description of the personal data, the reasons it is being processed, and whether it will be given to any other organisations or people
• given a copy of the personal data
• given details of the source of the data (where this is available). You have the right to receive a copy of the personal information that YYI holds about you, and to demand that any inaccurate data be corrected or removed.

You have the right to withdraw consent at any time. You can do so by contacting the data controller. If you wish to access a copy of any personal data being held about you, you must make a written request for this. Please send your request to our Admin. If a SAR is received, YYI will respond within one month. If you wish to raise a complaint on how we have handled your personal data, you can contact us to have the matter investigated by the CEO. If you are not satisfied with our response or you believe we are not processing your data in accordance with the law, you can complain to the Information Commissioner’s Office.