Privacy Policy

Policy Statement

1. What This Policy Covers

This policy explains how we collect, use, store, and share personal data in compliance with:

• UK General Data Protection Regulation (UK GDPR)
• Data Protection Act 2018
• Data Use and Access Act 2025 (DUAA)
• ICO guidance on privacy notices

2. The Personal Data We Collect

We collect personal identifiers and characteristics, including:

• General: Name, address/location, affiliation to a KEY+ delivery partner
• Facilitators: Email, phone (optional), DBS confirmation, training records
• Community Panel Members: Email, phone (optional), two referees’ details, training records, date of birth (optional)
• Young People: Date of birth, email (login only), skills self-assessment, project participation, optional demographic data (ethnicity, sex/gender, disability), photos/videos (optional)

3. How We Collect Data

• Directly from you (e.g., registration, training, project participation)
• Indirectly from KEY+ delivery partners acting on your behalf

4. Why We Use Your Data

• Deliver training and support for facilitators and panel members
• Enable KEY+ project delivery and software access
• Facilitate communication within the KEY+ community (never sharing under-18 contact details)
• Share stories, photos, and videos only with explicit consent
• Provide newsletters and updates only with consent
• Report aggregated, anonymised statistics to funders

5. Lawful Bases for Processing

Under UK GDPR and DUAA, we rely on:

• Consent – for stories, photos, videos, newsletters
• Legitimate Interests – to deliver KEY+ programme and reporting obligations
• Recognised Legitimate Interests (DUAA) – for fraud prevention, safeguarding, and IT security where applicable

You can withdraw consent anytime by emailing theteam@thekeyuk.org or updating your KEY+ profile.

6. Who We Share Data With

• Facilitators and panel members (with consent; never under-18 details)
• Service providers for legal, training, or IT support
• Zoho (KEY+ platform provider) – limited to login email addresses
  We never sell your data or share for marketing purposes.

7. How Long We Keep Your Data

• Personal data: 3 years after your last project or panel involvement
• Then securely deleted from Zoho and SharePoint
• Aggregated, anonymised data retained for longitudinal reporting

8. Your Rights

You have rights under UK GDPR, including:

• Access, rectification, erasure
• Restriction or objection to processing
• Data portability
  We respond within one month. Contact: theteam@thekeyuk.org

9. Complaints

If you have concerns, contact us at theteam@thekeyuk.org

You can also complain to the ICO:
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: www.ico.org.uk