Last updated 06/02/2023
At NCS Trust we care about keeping personal data safe. This includes the way in which we collect and process personal data legally and compliantly, and safeguard privacy. By personal data we mean any data which identifies you as an individual.
We are committed to complying with data protection and privacy laws and we ensure that all the organisations we work with are too, including our partners. Our Privacy Policy explains how we use and look after your personal data and sets out your privacy rights.
We recognise that data protection and privacy is an ongoing responsibility, and so we will, from time to time, update this Privacy Policy to keep up to date with changes in the law or NCS Trust processing of personal data. We encourage you to review this policy every now and again to ensure that you are aware of any changes to it.
Where there are significant changes to the Privacy Policy which may affect how we process your personal data, we may contact you to make you aware of the changes.
NCS Trust is the Data Controller for all personal data we collect. This means we decide what personal data we need you to provide and are responsible for communicating to you why we have collected your personal data.
We might collect your personal data via the following channels:
- When you provide it directly to the NCS Trust, by calling, texting, emailing, writing or via our social media channelsWhen you provide it to us when you express an interest in or sign up for the NCS experience, for example, at a school assembly
- When you provide it directly to one of our Delivery Partners
- When you have given Third Parties consent to share it with us
- When you visit our website
You may be sharing your personal data with us at various stages of your NCS journey: from visiting our website to find out more about us, to expressing an interest in the experiences we offer, to signing up to our experiences and staying engaged with NCS.
Your personal data is any information which can be used to identify you. Depending on where you are in your journey with us we might collect:
- your name
- your contact details i.e. telephone number, email address, postal address
- your date of birth
- your gender
- IP address
- information about your financial circumstances
- information to allow us to process any payment (e.g. bank card details)
- a photograph or audio/video recording of you
In some circumstances we may also collect special category information about you, for example, to ensure participants’ health and safety when taking part in an NCS experience. This is information that is considered sensitive and may include:
- your medical information
- your racial or ethnic origin
- your religious beliefs
- your sexual orientation
Where we collect special category data about you we will be clear as to why we need it and will only process it with a specific lawful basis to do so..
NCS Trust processes the personal data you provide to us to arrange for the provision of our experiences and services, and to inform you about NCS events and other benefits or opportunities associated with the NCS experience. We may also use this information to help us in understanding any specific needs and interests experience participants may have in order to better tailor products and services to them, and to support ongoing experience improvement.
Here are some of the ways we may use your personal information:
- To allocate participants to a suitable NCS experience
- To ensure participants’ health and safety whilst on an NCS experience
- To understand your needs and interests to better tailor products, information and services to you
- To provide you with information about NCS experiences which you may have requested, or which we consider to be of relevance to you
- To respond to your enquiries, complaints or requests
- To promote our products and services e.g. NCS events, publications, post-experience opportunities, and other services
- To conduct original research, or link with existing government and/ or other data sets to help us evaluate and improve our experience offer and services
- To improve the services offered on our website
- To process Freedom of Information requests and individual rights requests under Data Protection legislation
We might also receive personal data about you from external data sources including publicly available websites, databases or other third parties where they have a lawful basis to disclose your personal data to us - for example, if you have entered an NCS competition on a website and agreed that your personal data can be shared with us. We may combine this with personal data we already hold about you for the purposes of pursuing our goals and functions as set out in legislation.This helps us to update, expand, and analyse our records and identify new prospects and provide products and services which may benefit you.
We will process your personal data under one or more of the following lawful bases:
Where you have given us clear, informed consent
We will ask for your informed consent to process your personal data. In doing so, we will use clear plain language to tell you what we will be doing with your personal data so you can fully understand what you are consenting to.
We will also explain your right to withdraw your consent at any time, and how you can do that.
We will only use the personal data you have provided for the purpose we have obtained your consent for.
The processing is necessary for the performance of a task carried out in the public interest
As a public authority we may process your personal data where we are carrying out a specific task in the public interest or exercising our official authority i.e. functions, duties or powers laid down by law i.e The National Citizens Service Act 2017 and our Royal Charter.
We have a public interest in carrying out the following activities as set out in the National Citizens Service Act 2017 and our Royal Charter:
To provide or arrange for the provision of programmes for young people in England with the purpose of enabling participants from different backgrounds to work together in local communities to participate in projects to benefit society, and enhancing communication, leadership and team-working skills of participants
To promote the programme to young people in England, parents and carers of young people in England, schools and other educational bodies, and local authorities and other public bodies
To promote social cohesion through social integration, by ensuring equality of access to the programme by participants regardless of their background or circumstances, and to seek to expand the number of participants
To promote social mobility
To promote the personal and social development of participants
To promote the employment prospects of participants by equipping them with relevant practical skills
To encourage participants to take an interest in debate on matters of local or national political interest, and promote their understanding of how to participate in national and local elections
The processing is required for the performance of a contract
We may process your personal data as part of an agreement we have with a supplier or contractor. In these instances NCS Trust will ensure that such suppliers or contractors process your personal data in line with data protection laws.
We have a legal obligation to process the data
We may need to share your personal data in exceptional circumstances to comply with the law (i.e. the common law or a statutory obligation). For example, we may be obliged to share personal data with law enforcement agencies or court where it might assist them with an investigation or where we are compelled to by a Court Order or any matter regarding national security (please note these examples are not exhaustive).
The processing is necessary for your vital interest or the vital interests of others
We have a responsibility to ensure that young people are safe and, therefore, we may not always be able to keep information you provide to us as confidential. If we consider that you have given us information about yourself or another person which puts anybody or yourself at risk from harm then we may need to tell someone who can help, for example, the Local Authority regarding safeguarding.
Another example may be where someone has become ill or injured in the workplace or on a NCS experience. In this instance we may need to provide personal data to paramedics or health care staff and next of kin.
We have a genuine and legitimate reason and we are not harming any of your rights and interests
There may be activities that we carry out that are in the legitimate interests of NCS Trust, or which we consider are in your legitimate interests. Whenever we use this justification we will carry out a balancing exercise to ensure that we consider the impact on your rights and freedoms and do not override these. Some examples of how we might process your personal data under legitimate interests are:
- sending you direct marketing specifically via post
- fraud prevention
- ensuring network and information security, or
- business to business contact.
NCS Trust does not sell your personal data to any third parties.
NCS Trust works with its partners who are based around the country to deliver experiences for young people across England and Northern Ireland. We share personal data across this network that is necessary for the purposes of facilitating the delivery of experiences and services to you.
We may also share your personal data with other third party suppliers such as approved contractors who provide services to the NCS Trust to support our work. We carry out an assessment of all our third party suppliers prior to engaging in a contractual relationship. All our third party suppliers are required to take appropriate security measures to protect your personal data in line with our policies. We do not allow them to use your personal data for their own purposes and only allow them to use your personal data for specified purposes and in accordance with our instructions.
We may also share your personal data with schools, relevant government bodies and fraud detection organisations or law enforcement agencies.
Where your personal data is shared with third parties, we will share the minimum amount necessary.
The NCS website interacts with social media platforms including Facebook, Instagram, Twitter, Snapchat, YouTube, Sprinklr and others. If you choose to ‘like’ or share information from the NCS website through these services, you should review the privacy policy of that service. Interacting with a like or share interface on our website may allow your activity to be connected to your personal page or profile on the given platform.
NCS Trust conducts research to help us understand the experience’s impact on participants and society in general, and to support experience improvement and the wider objectives of NCS Trust. This includes, but is not limited to, surveys, focus groups, interviews, observation and ethnography which may be conducted in person, online, via telephone or by post. NCS Trust considers it in our public interests to carry out research of this nature.
Participation in research is voluntary and you can request to be withdrawn at any time without giving a reason. We will always tell you at the beginning of the research how your personal data will be used. Some of our research findings may be published. It will not be possible to identify research participants from the research findings we produce, unless consent has been expressly given by those participants in advance.
NCS Trust also publishes case studies of young people with a particularly interesting story through, or as a consequence of, attending an NCS experience. These case studies are used in printed marketing materials, on our online channels and social media platforms, as well as with other third party media channels. Participation in case studies is voluntary, and consent is actively sought at the start of any of these conversations and before publication.
NCS Trust may also, either directly or through an approved third party, link your personal data to existing data sets held by the government or other bodies such as the Office of National Statistics for the purposes of evaluating the experience - for example, the longer-term educational or employment outcomes of young people attending NCS.
NCS Trust may also use your personal data to optimise and improve its services, by performing analysis and extracting insight from that analysis. NCS Trust takes great care in ensuring that any analysis is in the public interest, and particularly in the interest of advancing NCS’s mission and its obligations set out in the National Citizen Service Act 2017 and NCS Royal Charter. NCS Trust carries out a Data Protection Impact Assessment and uses the UK Government’s Data Ethics Framework Workbook to establish the public benefits of the analysis and how data protection and information security risks can be mitigated.
If you use your credit or debit card to pay for a place on the NCS experience, or for other goods and services, we will make sure this is done securely, and in accordance with the Payment Card Industry Data Security Standard (PCI DSS). The payment will be processed by a PCI DSS compliant third party and NCS Trust will not store your card details. This applies whether you pay online or over the phone.
We do retain payment related personal data for financial audit purposes including account name, account reference and card type.
NCS Trust might collect the following personal data about individuals who apply for a job with NCS Trust:
- contact details such as name, title, addresses, telephone numbers, and personal email addresses
- evidence of how you meet the requirements of the job, including CVs and references
- the status of your application and updates on how it moves forward
- information about your right to work in the UK
We will use the personal data you provide as part of your application to move your application forward, check that you are the right candidate for the role, get in contact with you and send you notifications for future opportunities.
Where you applied for a role at NCS but were not successful in securing it, we may wish to keep your personal data to contact you about other roles and opportunities with NCS Trust in the future.
The NCS “workforce” is anyone over the age of 18 who wants to work on the NCS experience with one of our partners. They might submit an expression of interest and make an application to work on the experience to NCS Trust or to the partner. If successful the individual is recruited and employed by the partner.
Where you apply to work on the NCS experience via the NCS website we will use your personal data to allocate you a position on the NCS experience. We will also share your personal data with the relevant partner.
If you are successful in your application NCS Trust will continue to process your personal data for monitoring and safeguarding purposes. We may also use your personal data for research and analytics. We would advise you to read the ‘How we use your personal information for research and analytics’ section of this Policy.
In the UK individuals (we will refer to them here as ‘young persons’) over the age of 13 are considered able to provide consent. The Trust does not process the data of anyone below the age of 13.
We endeavour to seek a young person’s consent to data processing wherever this is appropriate. When we approach a young person (usually those aged between 15-17) with information about the experience we will be clear and transparent about how their personal data will be used if they express an interest in learning more about or participating in NCS experiences. We will ensure we use plain, age-appropriate language and explain how their data will be used in a way which they can understand, in line with the Information Commissioner's Office’s guidance.
We will seek parent or guardian consent to the processing of some of their young person’s data where it is necessary or appropriate, for example, when we need to collect health or medical information.
A young person has the same rights as an adult over their personal data. Please see the section entitled ‘Your Rights’ in this privacy policy.
We understand that our online services will be used by young people, and NCS Trust considers the best interests of the young person in the design and development of our online services. This will include age-friendly design, language and appropriate safeguards.
You have the following rights under the data protection laws:
Right to be informed - told in a clear and transparent way how we process your personal data
- Right of access - you can request a copy of the personal data we hold about you
- Right of rectification - you can update or amend the personal data we hold about you if it is incorrect
- Right to restrict processing - you can ask us to stop using your personal data
- Right to erasure- you can ask us to delete your personal data from our records
- Right to object - you can object to the processing of your personal data for marketing purposes
- Right to data portability - you can obtain and reuse your personal data for your own purposes
- Right related to automated decision making and profiling - you can request to not be subject to a decision when it is based on making a decision solely by automated means without any human involvement and/or automated processing of personal data to evaluate certain things about an individual
If you would like to make a request for any of the above, please submit it to the Data Protection Team at dataprotectionofficer@ncstrust.org.uk
We would like to tell you about what we do and send you information about our news and updates, and promotions about our experiences and campaigns.
We will not use your personal data to send you marketing communications if you have told us that you do not want to be contacted for this purpose.
You can change your marketing preferences, such as the method by which we contact you (email, phone, text or post), or opt out of receiving marketing communications from us at any time by visiting our website.
Where you choose to opt out or unsubscribe from our emails and texts we will stop sending you marketing communications. Please note that we may still contact you for research purposes, as this does not involve the communication of advertising or marketing material (participation remains voluntary).
The NCS website collects, and stores safely, certain personal information automatically. The personal information may include your internet protocol (IP) address, the region or general location where your computer or device is accessing the internet, and other usage information about the use of the NCS website, including a history of the pages you view. We use this information to help us design our site to better suit our users’ needs.
NCS Trust also uses cookies on our website. It does not track users when they cross to Third Party websites and does not provide targeted advertising from those Third Parties. For more information please see our Cookies Policy.
The personal data we collect is stored securely in one or more databases hosted by third parties located within the European Economic Area (EEA), or in locations which have demonstrated they have adequate standards of data protection compliance, or where we have implemented safeguards to ensure that your personal data is safe and secure.
To help protect your privacy, we maintain physical, technical and administrative safeguards. These safeguards are designed to prevent unauthorised access, disclosure, use and modification of data. We regularly review our security procedures, and consider appropriate new technologies and methods.
We train our employees about the importance of confidentiality and maintaining the privacy and security of your information, and your personal data is only accessed by appropriately trained staff.
We carry out comprehensive checks on all our partners and other suppliers we use who process your personal data on our behalf. All sharing of personal data is done under contract which sets out our expectations and requirements, especially regarding how they manage the personal data they have collected or have access to on our behalf.
We will ensure that your personal data is only kept for as long as is necessary for the purpose we collected it from you, and that it is securely destroyed in accordance with our retention schedule. Where possible we will inform you of how long we will retain the personal data you are providing to us.
In some cases we may be legally required to hold on to some personal data for longer in order to fulfil statutory obligations e.g. where we are required to keep it under the law.
NCS Trust has appointed an internal Data Protection Officer for you to contact if you have any questions or concerns about NCS Trust personal data policies or practices. Their name and contact information are as follows:
Hina Khan
National Citizen Service Trust,
1st Floor,
48 Chancery Lane,
London,
WC2A 1JF
Further information and advice about data protection law and compliance is available from the Information Commissioner's Office. You can contact them using the details below:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow, Cheshire
SK9 5AF
Phone: +44 (0) 01625 545 745
Website: www.ico.org.uk
