The short version (for young people)

• We only collect the information we need to run sessions and keep you safe.
• We never sell your information.
• We only use photos or videos of you if you, or your parent or carer, say yes. You can change your mind at any time.
• You can ask to see the information we hold about you.
• If you have a question or a worry, talk to any Livity worker or email info@livityyouthedinburgh.com.

1. Who we are

Livity Youth Edinburgh (LYE) is a Scottish Charitable Incorporated Organisation, Scottish Charity No. SC054561, based at 61 Niddrie Mains Terrace, Edinburgh EH16 4NX. We are the “data controller” for the personal information described here. This means we decide how it is used and we are responsible for looking after it.

This policy explains how we collect, use, store and protect information about everyone we work with: young people, parents and carers, volunteers, staff, donors and partners. It follows the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. What information we collect

• Contact details: name, date of birth, address, phone number, email address and emergency contacts.
• Equality information: such as ethnicity and gender. Giving this is optional. We use it to understand who we reach and, without naming anyone, to report to our funders.
• Education information: the school a young person attends and which of our programmes they take part in.
• Health information: medical, allergy or dietary needs we need to know to keep someone safe at sessions, trips and events.
• Photos, videos and recordings: only with consent (see section 6).
• Volunteer information: what you tell us when you apply, including references and Protecting Vulnerable Groups (PVG) checks where the role requires one.
• Donor information: your name, contact details and any Gift Aid declaration. Card payments are processed by our payment provider; we never see or store your card details.
• Messages: anything you send us through our website contact form, by email or by phone.

3. How we use your information

We use personal information to:

• run our sessions, trips and programmes, and keep a register of who attends;
• keep young people safe, including contacting parents, carers or emergency services when needed;
• tell you about sessions, events and opportunities;
• recruit, support and manage our volunteers and staff;
• check and improve the difference our work makes, and report to funders (in anonymised form wherever possible);
• manage donations and keep financial records;
• meet our legal duties, including safeguarding and charity law.

The law says we need a lawful reason for each use:

• Consent: for example, for photos and videos and for optional equality information. You can withdraw consent at any time.
• Legitimate interests: running our programmes and keeping in touch with members in ways you would reasonably expect.
• Legal obligation: for example, safeguarding duties, PVG checks and keeping financial records.
• Vital interests: in an emergency, when someone’s life or health is at risk.

Health and ethnicity information is “special category” data and gets extra protection. We only use it with explicit consent, or where it is needed to protect a child or someone at risk.

4. Young people, parents and carers

When a young person joins Livity, we ask a parent or carer to complete or agree to the registration, including emergency contacts and consents. In Scotland, young people aged 12 and over can usually make their own requests about their data, such as asking to see it. We will always explain things to young people in a way they can understand.

5. Who we share information with

We never sell personal information. We only share it when we need to, with:

• Service providers who store information for us under contract, such as our membership and attendance system (Upshot), our accounting software (Xero), and our email and website providers.
• Schools and partner organisations we run programmes with, only where it is needed to deliver that programme.
• Funders, who normally receive only figures that do not identify anyone.
• Social work, the police, health services or other agencies, if we are worried about someone’s safety or the law requires it.

Some of our service providers may store information outside the UK. When this happens, we make sure it is protected by the safeguards UK law requires.

6. Photos, videos and Livity YE TV

We always ask for explicit consent before we use photos, videos or recordings of young people on our website, on social media, on Livity YE TV or in publicity. You can withdraw consent at any time by telling a Livity worker or emailing us. We will then stop using the material and remove it from our website and social media where we can. We may not be able to recall material that has already been printed or shared by others.

7. How we protect your information

We take data security seriously. Personal information is stored securely and protected by:

• encryption of sensitive data;
• access restricted to authorised staff and volunteers;
• regular security reviews and updates.

8. How long we keep information

We keep personal information only for as long as we need it:

• Membership and attendance records: while a young person takes part, and for 3 years after they last attend.
• Safeguarding records: longer, in line with national child protection guidance.
• Financial and Gift Aid records: 6 years, as the law requires.
• Photos and videos: for as long as consent is in place.
• Messages and enquiries: for as long as we need to deal with them.

After that, we delete it securely.

9. Our website and cookies

Our website does not use advertising or analytics cookies, and we do not track you across other websites. Some pages load content from other companies:

• Our fonts come from Google Fonts, which receives your device’s IP address.
• Our Contact page shows a Google Map, which may set Google cookies.
• Some pages show videos from our YouTube channel. We use YouTube’s privacy-enhanced mode, which YouTube says means it does not store information about visitors unless they play a video. Once you press play, YouTube’s own privacy policy applies.
• Some pages also show videos from our TikTok account. When these load, TikTok may receive information such as your device’s IP address and may set its own cookies. TikTok’s own privacy policy applies.
• Links to our Instagram, TikTok, YouTube and Facebook pages, and to our sign-up forms on Upshot, take you to services with their own privacy policies.

You can block or delete cookies in your browser settings.

10. Your rights

You have the right to:

• ask for a copy of the information we hold about you;
• ask us to correct anything that is wrong or incomplete;
• ask us to delete your information, where this applies;
• ask us to limit or stop using your information, or object to how we use it;
• withdraw your consent at any time, where we rely on consent;
• ask us to transfer your information to another organisation.

To use any of these rights, email info@livityyouthedinburgh.com. We will reply within one month.

11. Making a complaint

If you are unhappy with how we have handled your information, please tell us first, by email, by phone or by speaking to any Livity worker. We will acknowledge your complaint within 30 days, look into it and tell you the outcome.

You also have the right to complain to the UK data protection regulator, the Information Commission (ICO), at ico.org.uk.

12. Contact us

Livity Youth Edinburgh
Email: info@livityyouthedinburgh.com
Phone: 07934 880813
Address: 61 Niddrie Mains Terrace, Edinburgh EH16 4NX
Scottish Charity No. SC054561

13. Changes to this policy

We review this policy regularly. Any changes will be posted on this page with the date it was last updated.