Privacy Notice for Face It Participants over 13

About us

We’re Khulisa (which means ‘to nurture’ in Zulu), a national youth and rehabilitation charity dedicated to helping young people and adults with complex needs to live healthier, crime-free lives. Khulisa is a registered charity (no. 1120562) and company limited by guarantee (no. 6210432). We deliver emotional and social wellbeing programmes, therapeutic support and mentoring to young people and adults with complex needs in schools, prisons and the community. We also deliver  training on the effects of trauma to professionals working with these young people and adults, such as teachers, prison officers and social workers.

At Khulisa, we are committed to protecting and respecting the privacy of the people we work with.

This privacy policy sets out:

  • When and why we collect personal data and other information about you;
  • How we use that information;
  • The conditions under which we may disclose this to others;
  • How we keep the information secure; and
  • The rights you have over the personal data we collect.

This privacy notice is made under Articles 13 and/or 14 of the General Data Protection Regulation (GDPR).

Contacting us

If you have any questions regarding this privacy policy, these can be sent to our Data Protection Officer via our contact form on our website, by email with ‘privacy policy’ in the subject to or by post.

Your letter should be addressed to our registered office address:
The Data Protection Officer

30A Acre Lane


Why and how do we collect information about you?

We collect information about you for the purpose of taking part in our emotional and social wellbeing programme called Face It.  We either collect this information directly from you when you interact with us, such as during programme interviews, or we may also receive information about you from your school or pupil referral unit before and after a programme.

What information do we collect?

Before a programme, we collect the following personal data about the young people we work with from their school or pupil referral unit:

  • Name, unique pupil number, date of birth, year group, gender and ethnicity;
  • Experiences of relational or social adversity to help us better understand their needs and experiences;
  • Information about the pupil’s behaviour;


  • Whether the pupil speaks functional English and whether they speak English as an an additional language;
  • Whether the pupil qualifies for the pupil premium or receives free school meals;
  • Whether the pupil has Special Educational Needs;
  • Whether the pupil is a Looked After Child/Careleaver 
  • Whether the pupil has received support from other services;
  • Whether the pupil is on an educational healthcare plan;
  • Whether the pupil has any known triggers;

We collect the following personal data about the young people we work with from their school:

  • Information about school attendance;
  • Information about school exclusions;
  • Information about attainment;
  • Whether the pupil finishes school in a mainstream setting

We use this information to help us assess the effectiveness of our programme in helping to improve pupil outcomes.

We collect the following personal data directly from you:

  • Your responses to our interview and evaluation processes, including your name, date of birth and school;
  • Your contact details.

The data is collected by us and stored in our secure data processing system as explained below.

How do we use the information we collect?

We may use the information collected about you to:

  • Measure the impact of our programmes;
  • Track the number of young people we have worked with over a given period and in a given location;
  • Report to the organisations which host our programmes, fund our work or work with us in other ways on our progress in delivering programmes;
  • Help us learn more about the characteristics and needs of the young people we work with and our impact, sometimes sharing with external researchers for data analysis and summary reporting; and
  • Give a progress report and recommendations to your school or pupil referral unit.

However, we will always treat your data confidentially and will not disclose your identity in our reporting or sharing with third parties other than your school or pupil referral unit, other organisations identified to you in the consent form itself or where third parties are providing a service to Khulisa. These third parties providing a service may be able to access the information we collect about you under certain circumstances, detailed below.

If you opt to keep up to date with Khulisa news, your contact details will also be included in relevant circulation lists for Khulisa’s newsletter, events and volunteering opportunities as you select in the consent form.

We take steps to ensure that all personal information we collect is treated securely. All personal data is encrypted and password protected on all of our databases.

Who has access to the information we collect?

Third parties providing a service to Khulisa may be able to access the information we collect about you e.g. the companies we use to provide our secure data processing systems like Salesforce and ImpactEd. This includes our suppliers, subcontractors, agents and other associated organisations we use to complete tasks and provide services to you on our behalf.

However, no information will be shared unless there is a contract in place that requires the third party to keep the information secure and prevents use for any other purpose than delivering the service. We only disclose the personal information that is necessary to deliver the service.

We will not sell or rent the information about you to third parties, nor will we share this information with third parties for marketing purposes.

Please be reassured that we will not share your information with third parties beyond this network, unless:

  • This is identified to you in the consent form for your specific programme;
  • You have requested us to do so;
  • We are required to do so to protect the rights, property or safety of our supporters and customers; or
  • We are required to do so by law, for example, by a court order or for the purposes of prevention of fraud or other crime.

In the event of a sale, business restructure or reorganisation of some or all of our business and assets to any third party, we will take steps with the aim of ensuring that your privacy rights continue to be protected.

How long will we keep the information?

We review our retention periods for personal information on a regular basis. We are legally required to hold some types of information to fulfil our statutory obligations. We will hold your personal information on our systems for as long as is necessary for the relevant activity. We keep data for 5 years and then anonymise this data.

International transfers

Some of the personal information we collect may be transferred and stored securely outside of the UK and European Union by the suppliers of our online surveys and email, document management and storage services. Where that is the case, safeguards are in place to ensure legal protection under the GDPR. This includes supplier certification under the Privacy Shield Scheme if based in the United States of America, or reliance on Model Contract Clauses.

Legal basis of processing

From the point you are invited to take part in our programme, we obtain explicit consent from you to process your data.

Your rights

You have the right to withdraw your consent at any time.

You have the right to ask for a copy of the information Khulisa hold about you. If you wish to view this information, please make a request in writing (via our contact form on our website, by email or by post) to the Data Protection Officer and we will provide a response within 30 days. 

Your rights under the GDPR also include the following:

  1. Right to rectification: This means you may ask us to rectify any of the personal data we hold about you.
  2. Right to erasure (sometimes known as the right to be forgotten): If you withdraw consent, you have the right to request us to delete the personal data we hold for you.
  3. Right to restrict processing: You have the right in certain circumstances (for example, where accuracy is contested) to request that the processing of the personal data we hold about you is restricted.
  4. Right to data portability: You have the right to request a copy of the personal data we hold for you in an accessible electronic format. You may also have the right for us to transmit this to another organisation of your choice in certain circumstances.



If you consider that the personal data we hold for you has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator. 

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts. 

The Information Commissioner can be contacted at:

By email:

By phone: 0303 123 1113

By post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow. Cheshire. SK9 5AF


What information do we collect?

  • “Experiences of relational or social adversity to help us better.”

Relational adversity’ is about adverse childhood experiences that occur in the home. We collect data about whether the pupil: has experience of physical, emotional, or sexual abuse, has experience of physical or emotional neglect, has a parent with a mental illness, has a family member in prison, has domestic violence in the home, lives in a household in which there are adults experiencing alcohol and drug use problems, has experience of parental abandonment through separation or divorce, has experience of bereavement, or has adult responsibilities (e.g. a young carer). 

Social adversity’ relates to issues with relationships outside the home. We collect data about whether the pupil: is a perpetrator or victim of bullying, is at risk of or a victim of child  criminal exploitation, is known to be involved in criminal activity or is at risk of being involved in criminal activity, is a Child In Need, has a Child Protection Plan in place, is a recent migrant, asylum seeker, or struggling with ending relationships.

  • “Information about the pupil’s behaviour”

Specifically whether they display responsive or withdrawn behaviours:

‘Responsive behaviour’ is any repeated pattern of behaviour that interferes with or is at risk of interfering with the child’s optimal learning or engagement in positive interactions with peers and adults. We collect data about whether the pupil: displays disruptive or antisocial behaviour, displays unpredictable outbursts of anger, is verbally abusive or displays threatening behaviour. 

‘Withdrawn behaviour’ is where someone is socially detached and unresponsive. We collect data about whether the pupil: is isolated in lessons or from their peer group, is anxious and withdrawn, is unmotivated in school and in lessons, has a historic experience of self-harm or has a historic eating disorder. 

  • “Whether the pupil has received support from other services”

Including counselling support, social services, pastoral staff support, support from another community provider, or other services

* indicates required