• ReachOut are a mentoring and youth development charity that run after school mentoring projects across London and Manchester for young people (referenced throughout this document as young people) aged 9-14. We work in partnership with schools, to develop young people’s social and emotional skills.
• References to ’we’, ’our’ or ’us’ in this privacy notice are to the entity of ReachOut Youth, incorporated and registered in England and Wales with company number 04604379 and charity number 1096492. ReachOut Youth is registered with the Information Commissioner’s Office as a Data Controller – registration number Z8938339. 

We collect and use young people’s information & parent/carer information, for the following purposes:

1. to provide appropriate support through our programme
2. to monitor and report on young people’s progress
3. to assess the quality of our services
4. to keep young people safe
5. to promote our work to current and future supporters

Under the UK General Data Protection Regulation (UK GDPR), the lawful bases we rely on for processing young people’s information are:

• Explicit Consent
• Legal obligation
• Legitimate interests

We process personal data for our legitimate interests to allow us to run ReachOut as a charitable entity effectively and in pursuit of our objectives. When we process personal information for our legitimate interests, we make sure to consider and balance any potential impact on the individual and their rights under data protection laws. We will always ensure that personal data will not be used where our interests are overridden by the impact on the individual.

We collect young people & parent/carer information via:

• Parents/carers completing a consent form at the start of the programme and a survey at the end of the programme
• Teachers providing referral and progress information
• Staff & volunteers supporting young people on sessions providing progress information
• Young people providing information about their progress via surveys through the year

All data is stored on secure servers located in the UK. We take the security of personal data seriously and have internal policies and strict controls in place to try to ensure that data is not lost, accidentally destroyed, misused or disclosed and to prevent unauthorised access.

We will hold personal information on our systems for as long as is necessary for us to provide our services, comply with our legal obligations, maintain records, and carry out reporting.

We are committed to protecting data and therefore it will never be sold to external organisations however there are some specific instances where we will share information with trusted third parties:

• We have a Data Sharing Agreement in place with our partner schools which means we share information about young people and their progress to enable to delivery of our service.
• We do not reveal information about identifiable individuals to our stakeholders without consent but may provide external organisations anonymised information.
• In the case of a serious safeguarding concern, we may need to share personal data without consent but this will always be done in line with our legal duties and safeguarding policy.

The UK-GDPR gives parents/carers and young people certain rights about how their information is collected and used. To make a request for the personal information that we hold, contact our data protection officer at dpo@reachoutuk.org.

Where we are processing personal data with consent, you have a right to withdraw that consent. If you change your mind, or you are unhappy with our use of your personal data, please let us know by contacting our data protection officer at dpo@reachoutuk.org.

You and your young person also have the following rights:

• the right to be informed about the collection and use of your personal data – this is called ’right to be informed’.
• the right to ask us for copies of your personal information we have about you – this is called ’right of access’, this is also known as a subject access request (SAR), data subject access request or right of access request.
• the right to ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’.
• the right to ask us to delete your personal information – this is called ‘right to erasure’
• the right to ask us to stop using your information – this is called ‘right to restriction of processing’.
• the ‘right to object to processing’ of your information, in certain circumstances
• rights in relation to automated decision making and profiling.
• the right to complain to the Information Commissioner if you feel we have not used your information in the right way.

We may need to update this privacy notice periodically, so we recommend that you revisit this information from time to time. This version was last updated on 1st September 2025