We’re Khulisa (which means ‘to nurture’ in Zulu), a national youth and rehabilitation charity dedicated to helping young people and adults with complex needs to live healthier, crime-free lives. Khulisa is a registered charity (no. 1120562) and company limited by guarantee (no. 6210432). We deliver emotional and social wellbeing programmes, therapeutic support and mentoring to young people and adults with complex needs in schools, prisons and the community. We also deliver training on the effects of trauma to professionals working with these young people and adults, such as teachers, prison officers and social workers.
At Khulisa, we are committed to protecting and respecting the privacy of the people we work with.
- when and why we collect personal data and other information about the young person in your care;
- how we use that information;
- the conditions under which we may disclose this to others;
- how we keep the information secure; and
- the rights you have over the personal data we collect.
This privacy notice is made under Articles 13 and/or 14 of the General Data Protection Regulation (GDPR).
Your letter should be addressed to our registered office address:
The Data Protection Officer
32 Cubitt Street
Why and how do we collect information about the young person in your care?
We collect information about the young person in your care for the purpose of taking part in our adapted offer for online support for young people during the coronavirus pandemic. We either collect this information directly from the young person when they interact with us, such as during one to one sessions or webinars, or we may also receive information about them from their school or pupil referral unit before and after they receive support from us.
What information do we collect?
Before a programme, we collect the following personal data about the young people we work with from their school or pupil referral unit:
- name, unique pupil number, date of birth, year group and gender;
- English as Additional Language status;
- whether the pupil qualifies for the pupil premium or receives free school meals;
- information about attendance, punctuality and the number of times excluded or secluded within a given period;
- whether the young person has difficulty interacting in a group;
- disability (including any physical accessibility requirements, mental health needs, Special Educational Needs or learning disabilities);
- whether the pupil is a looked after child or is on the Child Protection Register;
- whether the pupil receives counselling;
- whether the pupil is currently involved with police and Young Offender Institutions;
- whether the pupil is currently self-harming;
- whether the pupil has involvement with social services;
- whether the pupil uses drugs or alcohol;
- whether the pupil is verbally abusive or aggressive, or physically violent or aggressive;
- whether the pupil is a victim of violence and abuse; and
- whether the pupil is affiliated with a gang.
After a programme, we collect the following personal data about the young people we work with from their school or pupil referral unit:
- perceived change in behaviour by staff at the school or pupil referral unit;
- where the young person has left the school or pupil referral unit since completing the programme, any destination information held by the school or pupil referral unit i.e. education, employment, training;
- where the school is a pupil referral unit, whether the pupil has returned to mainstream school within 3 to 6 months of participating;
- information about attendance, punctuality and the number of times excluded or secluded within a given period; and
We collect the following personal data about the young people we work with directly from them:
- their responses to our interview and evaluation processes, including their name, date of birth and school or pupil referral unit they attend.
We also collect the following personal data from you as the holder of parental responsibility when you provide consent for us to keep the above data for the young person in your care:
- your name and relationship to the young person in your care; and
- your contact details.
The data is collected by us and stored in our secure data processing system as explained below.
How do we use the information we collect?
We may use the information collected about the young person to:
- measure the impact of our programmes;
- track the number of young people we have worked with over a given period and in a given location;
- report to the organisations which host our programmes, fund our work or work with us in other ways on our progress in delivering programmes;
- help us learn more about the characteristics and needs of the young people we work with and our impact, sometimes sharing with external researchers for data analysis and summary reporting; and
- give a progress report and recommendations to the young person’s school or pupil referral unit.
However, we will always treat the data of the young person in your care confidentially and will not disclose their identity in our reporting or sharing with third parties other than their school or pupil referral unit, other organisations identified to you in the communication you received inviting the young person in your care to take part on our Face It programme, or where third parties are providing a service to Khulisa. These third parties providing a service may be able to access the information we collect about the young person in your care under certain circumstances, detailed below.
Your personal data is collected only for the purpose of fulfilling and overseeing consent. If you opt to keep up to date with Khulisa news, your contact details will also be included in relevant circulation lists for Khulisa’s newsletter, events and volunteering opportunities as you select in the consent form.
We take steps to ensure that all personal information we collect is treated securely. All personal data is encrypted and password protected on all of our databases.
Who has access to the information we collect?
Third parties providing a service to Khulisa may be able to access the information we collect about the young person in your care e.g. the company we use to provide our secure data processing system, Salesforce. This includes our suppliers, subcontractors, agents and other associated organisations we use to complete tasks and provide services to you on our behalf.
However, no information will be shared unless there is a contract in place that requires the third party to keep the information secure and prevents use for any other purpose than delivering the service. We only disclose the personal information that is necessary to deliver the service.
We will not sell or rent the information about the young people we work with to third parties, nor will we share this information with third parties for marketing purposes.
Please be reassured that we will not share the personal information with third parties beyond this network, unless:
- this was identified to you in the communication you received inviting the young person in your care to take part on our Face It programme, or in the consent form;
- you have requested us to do so;
- we are required to do so to protect the rights, property or safety of our supporters and customers; or
- we are required to do so by law, for example, by a court order or for the purposes of prevention of fraud or other crime.
In the event of a sale, business restructure or reorganisation of some or all of our business and assets to any third party, we will take steps with the aim of ensuring that the privacy rights of the young person in your care continue to be protected.
How long will we keep the information?
We review our retention periods for personal information on a regular basis. We are legally required to hold some types of information to fulfil our statutory obligations. We will hold the personal information we collect for the young person in your care on our systems for as long as is necessary for the relevant activity. We keep data for 5 years and then anonymise this data.
Some of the personal information we collect may be transferred and stored securely outside of the UK and European Union by the suppliers of our online surveys and email, document management and storage services. Where that is the case, safeguards are in place to ensure legal protection under the GDPR. This includes supplier certification under the Privacy Shield Scheme if based in the United States of America, or reliance on Model Contract Clauses.
Legal basis of processing
From the point the young person in your care is invited to take part in our programme, we obtain explicit consent from you to process their data.
You have the right to withdraw your consent at any time, as does the young person in your care once they reach 13 years old.
You have the right to ask for a copy of the information Khulisa hold about the young person in your care. If you wish to view this information, please make a request in writing (via our contact form on our website, by email or by post) to the Data Protection Officer and we will provide a response within 30 days.
Your rights under the GDPR also include the following:
- Right to rectification: This means you may ask us to rectify any of the personal data we hold about the young person in your care.
- Right to erasure (sometimes known as the right to be forgotten): If you withdraw consent, you have the right to request us to delete the personal data we hold for the young person in your care.
- Right to restrict processing: You have the right in certain circumstances (for example, where accuracy is contested) to request that the processing of the personal data we hold about the young person in your care is restricted.
- Right to data portability: You have the right to request a copy of the personal data we hold for the young person in your care in an accessible electronic format. You may also have the right for us to transmit this to another organisation of your choice in certain circumstances.
If you consider that the personal data we hold for the young person in your care has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator.
Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.
The Information Commissioner can be contacted at:
By email: firstname.lastname@example.org
By phone: 0303 123 1113
By post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow. Cheshire. SK9 5AF