Who we are
At LMK, we educate young people about healthy and unhealthy relationships, giving them the tools to recognise and avoid abusive situations. In order to carry out our work, we work with and collect personal data about young people, parents/carers, youth workers, fundraisers, donors and all those who make what we do possible.
About this Policy
LMK is committed to protecting your privacy and takes your privacy seriously. At all times we aim to respect any information you share with us, or that we receive from other organisations, and keep it safe. We’d like to tell you about why we collect your data, how we use it, what we do to keep it safe as well as your rights about how we process your data. If you would like any further information, please contact us at dataprotection@justletmeknow.org. – we’d be delighted to help.
UNDER 18’s
As a youth organisation we embrace the fact that our supporters are of all ages. We are committed to safeguarding the welfare of all children and young people involved in our work.
If you are under 13, we will always ask for consent from a parent or guardian before we collect information about you or continue to contact you. We may also collect the name and contact details of your parent or guardian, where appropriate.
Where we do collect personal information from children and young people, we ensure that our privacy notices are ‘child friendly’ and written in clear and plain language.
What is personal data
Personal data, or personal information, means any information about an individual from which that person can be identified.
Contact data e.g. name, contact details (email, phone, address etc.)
Personal data e.g. date of birth, gender, ethnicity etc.
Financial e.g. account details, credit/debit card details, financial transactions
Social e.g. professional status (job title), social networking, relationships, communications
What personal data do we collect
(a) When you give it to us directly
For example, personal information that you submit to us through registering on our workshops, visiting our website, making a donation, signing up for our email newsletter or completing an application to volunteer with us; or personal information that you give to us when you communicate with us by email, phone or letter.
(b) When we obtain it indirectly
For example, your personal information may be shared with us by third parties such as schools, external fundraisers, reference providers or a search engine. To the extent we have not done so already, we will notify you when we receive personal information about you from them and tell you how and why we intend to use that personal information.
(c) When it is available publicly
Your personal information may be available to us from external publicly available sources. For example, depending on your privacy settings for social media services, we may access information from those accounts or services (such as Twitter, Facebook and Instagram).
(d) When you visit our website
When you visit our website, we automatically collect the following types of personal information:
technical information, including the internet protocol (IP) address used to connect your device to the internet, browser type and version, time zone setting, browser plug-in types and versions and operating systems and platforms.
Information about your visit to our website, including the uniform resource locator (URL) clickstream to, through and from the website (including date and time), services you viewed or searched for, page response times, download errors, length of visits to certain pages, referral sources, page interaction information (such as scrolling and clicks) and methods used to browse away from the page.
(e) When using media content (photo, video and audio content)
To help promote the value of our work LMK may take a range of photographic, video and audio content. Photos, videos and audio content may be used by LMK, or by our event partner(s) (including funders) on websites, social media, promotional materials, publications, press releases or other illustrations of our work.
We will ask for consent from individuals that will be used in photos where they may be identifiable. Where the individual is under the age of 18 or a vulnerable adult we will seek consent of the parent/guardian. Consent can be withdrawn at any time (see ‘Withdrawing your consent’ section). If consent is withdrawn we will stop using the photos/videos/audio content for future purposes but may not be able to retract publications already in the public domain.
We also collect and use your personal information by using cookies on our website – please see our Cookie Notice which can be found on our www.justletmeknow.org
When you register on our workshop we may collect information about you. This may include any of the examples above, why you are interested in LMK, interactions you have had with us and other information relating to you personally which you may choose to provide to us.
Data protection law recognises that certain types of personal information are more sensitive. This is known as ‘sensitive’ or ‘special category’ personal information and covers information revealing racial or ethnic origin, religious or philosophical beliefs and political opinions, genetic or biometric data, information concerning health or data concerning a person’s sex life or sexual orientation.
Sensitive information will only be collected where necessary, for example, we may need to collect disability monitoring information from you when you register for a workshop. We may need to understand more about your background to monitor the effectiveness of our programmes. Clear notices will be provided at the time we collect this information, stating what information is needed and why, as well as which parts are optional.
With your explicit consent, we may also collect sensitive personal information if you choose to tell us about your experiences for use in our research or a case study.
If you fail to provide personal data
Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with goods or services like a workshop). In this case, we may have to cancel a product or service like a workshop you have with us, but we will notify you if this is the case at the time.
Why we collect personal data and how we use it
LMK offers a range of opportunities to young people through our programmes (e.g. peer leader programme, the youth board etc.). In addition to opportunities for young people, we work with young people and youth workers to influence policy makers by ensuring that young people are given a voice and appropriate channels to be heard. We also provide support to individuals and organisations that support young people.
We collect data in order to administer, deliver and monitor our workshops and support to young people and youth organisations, to fundraise and generate funds to support our work, to support our campaigns, respond to enquiries, and to meet our contractual and legal obligations.
LMK has strict safety and safeguarding policies in place which mean that in addition to collecting data about our employees and volunteers for the purpose of their role with us, we capture other data in relation to criminal records.
In order to make what we do happen and to improve our workshops, we use personal data in the following ways:
To work with the membership of youth organisations and provide and promote a range of support, opportunities and benefits to youth organisations
To administer young people’s participation on our programmes and monitor the impact and outcomes for young people
To undertake research and analysis to develop and promote policy and practice
To promote opportunities to young people
To promote, administer, run and facilitate participation in peer-leader programme
To involve people in policy and advocacy work including research, events and responding to media opportunities
To promote the work of LMK (using media content) through websites, social media, promotional materials, publications, press releases or other illustrations of our work
To engage current and potential funders and fundraisers with opportunities to support our work and make what we do possible
To process financial payments, donations and claim Gift Aid
To ensure that all those working for LMK have had relevant checks to work with children, young people and vulnerable adults
To employ and manage staff and volunteers and process applications.
To respond to enquiries and complaints
To undertake due diligence to manage risks
How we collect personal data
Direct from the individual
LMK collects data directly from individuals (e.g. young people, youth workers, teaching staff, fundraisers, funders, donors, current and potential employees, trustees etc.) and those with parental/guardian responsibility for a young person.
When information is collected, we will explain what it is for and be clear about elements that are optional.
Third parties and external sources
We may also receive data from schools. This data is only used to administer a workshop. We also receive data from third party platforms in relation to our donors that have been entered by the individuals themselves (e.g. those making donations to fundraisers via JustGiving etc. who have opted in that their information be shared with LMK).
Where data is collected from an external source (i.e. not directly from the individual) and is to be held or use beyond the specific activity or event, we will notify the individual that we have obtained their data, how we intend to use it, and if required, capture consent to market membership, funding opportunities and our services in the future.
How you can withdraw your consent
LMK captures consent for a number of its activities (identified above ‘How we use personal data’).
Consent can be withdrawn at any point by:
Unsubscribing from an email or newsletter
By contacting us on dataprotection@justletmeknow.org
Young people and members participating in a programme can withdraw their consent at any point by contacting us; however this may impact their ability to fully participate in the programme.
How we store and secure data
Securing personal data
LMK takes its responsibility to protect personal data seriously. We ensure that our data is held securely within our main database and on our network. We use a range of tools and technologies to capture, process and store data securely. Only authorised employees and partners (schools), and those who process data on our behalf (e.g. software suppliers) have access to data. LMK have a strict Data Protection Policy and data sharing agreements in place to ensure that appropriate processes, procedures and best practice is in place to protect personal data. Only the data that is necessary to perform the task is accessed and processed.
Transferring data overseas
LMK uses a range of methods to capture data (e.g. paper, online etc.). Online methods used to capture data may be carried out using data capture forms from a third party platform. When looking at potential tools and software, LMK ensure that as far as feasibly possible, data is stored within the European Economic Area (EEA). The GDPR requires special measures to be put in place where data is transferred outside of the EEA. Where the provider has multiple data servers (inside and outside of the EEA), and where there may be potential for the data to be transferred between locations, we ensure that sufficient measures are in place to protect the data and ensure that the provider is compliant with the GDPR and that appropriate security measures are in place. One way that we do this is by ensuring that the provider is signed up to the EU-US Privacy Shield.
How we share personal data
LMK does not sell any personal data that we hold. LMK shares personal data with the following parties:
Partners delivering our programmes (for the purposes of networking and access to opportunities)
Funders will receive aggregated and anonymised statistics only. These are shared with funders to demonstrate the impact of participation in our programmes
HMRC and other organisations for the performance of employee contracts and processing Gift Aid payments
Social Services, emergency services, the Health and Safety executive, local authorities and the police in the event of an emergency or in the event of a safeguarding issue (e.g. there is a risk to the safety of a young person or any other party) or to law enforcement agencies for the prevention and detection of crime
Where we have a legal or regulatory obligation we will share data/information with the police, law enforcement agencies, the Government and statutory agencies or any other necessary parties
The Disclosure and Barring Service (DBS) for the purposes of verifying suitability of those working with children and young people
Third party suppliers: We may need to share your information with data hosting providers or service providers who help us to deliver our services, projects, or fundraising activities and appeals. These providers will only act under our instruction and are subject to pre-contract scrutiny and contractual obligations containing strict data protection clauses. We also may need to share your names with partners and venues hosting events for the purpose of registration.
How long do we keep personal data?
LMK will only store your data for as long as necessary and in line with the original purpose(s) that it was collected. LMK collects, stores and processes personal data in line with our Data Protection Policy and has strict retention schedules outlined and adhered to in our Data Retention Policy. LMK also complies with its legal obligations to keep certain data for a period of time (e.g. Gift Aid declarations and financial transactions).
How we use cookies
What is a cookie?
Cookies are small text files that are placed on to your device (computer, smart phone etc.) when you first visit a website which monitors interactions with the site.
How does LMK use cookies?
LMK uses cookies – technology to monitor interactions with our website (e.g. what pages you visit, services you interact with etc.). We use this information to continually improve our website and to keep our content relevant.
How to reject cookies
LMK’s website allows uses to reject cookies on their first visit to our website. LMK has a legal obligation to enable users to accept (e.g. consent) to LMK using cookies to monitor their interactions with the site or reject them.
You can block our cookies altogether by selecting the appropriate settings in your browser. However, it is important to remember that this may impact your use of the full functionality on our website. For further information on blocking cookies visit www.aboutcookies.org.
Third party cookies on LMK’s website
When visiting a page that has content embedded within it (e.g. YouTube etc.), you may be presented with cookies from those sites. You are advised to check the third party websites for more information about how they use cookies and/or your data.
Your rights
Individuals who we collect, process and store personal data about have a number of rights under the GDPR (General Data Protection Regulations) which include:
The right to request a copy of the data that LMK hold about them
The right to prevent processing for the purpose of direct marketing and profiling
The right to be forgotten
The right to have data rectified/updated
Accessing your data
You are entitled to make a request to gain access to a copy of the data we hold and to find out how we use your data.
You may make a request at any time by contacting us at dataprotection@justletmeknow.org. Your request will be processed free of charge. In the event of repeated/excessive requests, LMK reserves the right to charge a fee.
When making a request, we will verify that you are, who you say you are, by checking appropriate forms of identification.
Personalisation and profiling
In order to make our communications relevant, LMK may capture the preferences and interest of individuals to personalise what we send to you.
We may target particular opportunities based on information provided, for example where relevant, geographically. Data provided by fundraisers is also used as part of the selection process to participate in external challenge events on behalf of LMK.
You have the right to object to LMK using your data for the purposes of direct marketing and profiling. Where prior consent has been given, you have the right to withdraw your consent (See withdrawing your consent section)
The right to be forgotten
If you no longer wish for LMK to store and process your data, you have the right to request that it be deleted. You can request this verbally or in writing and we will respond within one month of receiving the request.
Under GDPR guidelines, LMK must respond to a request to have your data erased, however there are circumstances where we will be unable to erase data due to other obligations. For example:
Where there are financial transactions on your record (where part of the data must be kept for a set period of time). In this instance, we will keep the data that must be held for financial and audit purposes and will erase all data not required for this purpose
Where there has been a disciplinary/safeguarding issue etc.
Full details and an explanation of our decision will be communicated to you.
The right to rectification
Individuals about whom we collect, process and store data have the right to have inaccurate data rectified or incomplete data completed.
If your data is inaccurate or incomplete, you have the right to request that we rectify it. LMK will respond to a request within one month of receipt. However, in certain circumstances we reserve the right to refuse a request (e.g. where there has been a disciplinary or safeguarding issue and the recorded information is a record of findings of an investigation).
Complaints
If you have any concerns or questions about your data, the information contained within this notice or our Data Protection Policy, or you wish to make a complaint please contact: dataprotection@justletmeknow.org.
If you are dissatisfied, or if you believe your data has been processed in a way that is not compliant with the GDPR, you have the right to complain to the Information Commissioners Office (ICO) by visiting their website or by calling 0303 123 1113.