We’re Khulisa (which means ‘to nurture’ in Zulu), a national youth and rehabilitation charity dedicated to helping young people and adults with complex needs to live healthier, crime-free lives. Khulisa is a registered charity (no. 1120562) and company limited by guarantee (no. 6210432). We deliver emotional and social wellbeing programmes, therapeutic support and mentoring to young people and adults with complex needs in schools, prisons and the community. We also deliver training on the effects of trauma to professionals working with these young people and adults, such as teachers, prison officers and social workers.
At Khulisa, we are committed to protecting and respecting the privacy of the people we work with.
- when and why we collect personal data and other information about you;
- how we use that information;
- the conditions under which we may disclose this to others;
- how we keep the information secure; and
- the rights you have over the personal data we collect.
This privacy notice is made under Articles 13 and/or 14 of the General Data Protection Regulation (GDPR).
Your letter should be addressed to our registered office address:
The Data Protection Officer
32 Cubitt Street
Why and how do we collect information about you?
We collect information about you for the purpose of taking part in our emotional and social wellbeing programme called Silence the Violence. We either collect this information directly from you when you interact with us, such as during programme interviews, or we may also receive information about you from your prison or Young Offender institution before and after a programme.
What information do we collect?
Before a programme, we collect the following personal data about the prisoners we work with from their prison or Young Offender institution:
- Name, date of birth and gender;
- Prison number and wing location;
- Total length of sentence and release date;
- Offence classification and details of offence;
- Type of sentence;
- Previous offence classification and details;
- Pattern of offending;
- Offender Group Reconviction (OGR) score;
- Information about number of negative warnings, violent incidents, adjudications and number of times on either basic regime or in the Care and Separation Unit (CSU) within a given period;
- Whether the prisoner has difficulty interacting in a group;
- Whether the prisoner has a good relationship with family and has ever been a child in care;
- Disability (including any physical accessibility requirements, mental health needs, Special Educational Needs or learning disabilities);
- whether the prisoner is currently self-harming;
- whether the prisoner receives counselling;
- whether the prisoner has involvement with social services or other agencies;
- whether the prisoner uses drugs or alcohol;
- whether the prisoner is verbally abusive or aggressive, or physically violent or aggressive;
- whether the prisoner is a victim of violence and abuse; and
- whether the prisoner is affiliated with a gang.
After a programme, we collect the following personal data about the prisoners we work with from their school or Young Offender institution:
- Perceived change in behaviour by staff at the prison or Young Offender institution;
- Where the prisoner has left the prison or Young Offender institution since completing the programme, any destination information held by the prison or Young Offender Institution; and
- Information about number of negative warnings, violent incidents, adjudications and number of times on either basic regime or in the Care and Separation Unit (CSU) within a given period.
We collect the following personal data directly from you:
- Your responses to our interview and evaluation processes, including your name, date of birth and prison or Young Offender Institution; and
- Your contact details.
The data is collected by us and stored in our secure data processing system as explained below.
How do we use the information we collect?
We may use the information collected about you to:
- Measure the impact of our programmes;
- Track the number of individuals we have worked with over a given period and in a given location;
- Report to the organisations which host our programmes, fund our work or work with us in other ways on our progress in delivering programmes;
- Help us learn more about the characteristics and needs of the individuals we work with and our impact, sometimes sharing with external researchers for data analysis and summary reporting; and
- Give a progress report and recommendations to your prison or Young Offender Institution.
However, we will always treat your data confidentially and will not disclose your identity in our reporting or sharing with third parties other prison or Young Offender Institution, other organisations identified to you in the consent form itself or where third parties are providing a service to Khulisa. These third parties providing a service may be able to access the information we collect about you under certain circumstances, detailed below.
We take steps to ensure that all personal information we collect is treated securely. All personal data is encrypted and password protected on all of our databases.
Who has access to the information we collect?
Third parties providing a service to Khulisa may be able to access the information we collect about you e.g. the company we use to provide our secure data processing system, Salesforce. This includes our suppliers, subcontractors, agents and other associated organisations we use to complete tasks and provide services to you on our behalf.
However, no information will be shared unless there is a contract in place that requires the third party to keep the information secure and prevents use for any other purpose than delivering the service. We only disclose the personal information that is necessary to deliver the service.
We will not sell or rent the information about you to third parties, nor will we share this information with third parties for marketing purposes.
Please be reassured that we will not share your information with third parties beyond this network, unless:
- this is identified to you in the consent form for your specific programme;
- you have requested us to do so;
- we are required to do so to protect the rights, property or safety of our supporters and customers; or
- we are required to do so by law, for example, by a court order or for the purposes of prevention of fraud or other crime.
In the event of a sale, business restructure or reorganisation of some or all of our business and assets to any third party, we will take steps with the aim of ensuring that your privacy rights continue to be protected.
How long will we keep the information?
We review our retention periods for personal information on a regular basis. We are legally required to hold some types of information to fulfil our statutory obligations. We will hold your personal information on our systems for as long as is necessary for the relevant activity. We keep data for 5 years and then anonymise this data.
Some of the personal information we collect may be transferred and stored securely outside of the UK and European Union by the suppliers of our online surveys and email, document management and storage services. Where that is the case, safeguards are in place to ensure legal protection under the GDPR. This includes supplier certification under the Privacy Shield Scheme if based in the United States of America, or reliance on Model Contract Clauses.
Legal basis of processing
From the point you are invited to take part in our programme, we obtain explicit consent from you to process your data.
You have the right to withdraw your consent at any time, and you have the right to ask for a copy of the information Khulisa hold about you. To do this, please make a request in writing (via our contact form on our website, by email or by post) to the Data Protection Officer and we will provide a response within 30 days.
Your rights under the GDPR also include the following:
- Right to rectification: This means you may ask us to rectify any of the personal data we hold about you.
- Right to erasure (sometimes known as the right to be forgotten): If you withdraw consent, you have the right to request us to delete the personal data we hold for you.
- Right to restrict processing: You have the right in certain circumstances (for example, where accuracy is contested) to request that the processing of the personal data we hold about you is restricted.
- Right to data portability: You have the right to request a copy of the personal data we hold for you in an accessible electronic format. You may also have the right for us to transmit this to another organisation of your choice in certain circumstances.
If you consider that the personal data we hold for you has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator.
Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.
The Information Commissioner can be contacted at:
By email: firstname.lastname@example.org
By phone: 0303 123 1113
By post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow. Cheshire. SK9 5AF