• ReachOut are a mentoring and youth development charity that run after school mentoring projects across London and Manchester for young people aged 9-14. We work in partnership with schools, to develop young people’s social and emotional skills with volunteer mentors (referred to as volunteers) building relationships with young people. 
• References to ’we’, ’our’ or ’us’ in this privacy notice are to the entity of ReachOut Youth, incorporated and registered in England and Wales with company number 04604379 and charity number 1096492. ReachOut Youth is registered with the Information Commissioner’s Office as a Data Controller – registration number Z8938339. 

We collect and use volunteer’s information, for the following purposes:

1. to recruit and onboard volunteers 
2. to meet our safeguarding responsibilities including our commitment to safer recruitment practices 
3. to assess the quality of our services and volunteer experience
4. to promote our work to current and future supporters

Under the UK General Data Protection Regulation (UK GDPR), the lawful bases we rely on for processing young people’s information are:

• Explicit Consent
• Legal obligation
• Legitimate interests

We process personal data for our legitimate interests to allow us to run ReachOut as a charitable entity effectively and in pursuit of our objectives. When we process personal information for our legitimate interests, we make sure to consider and balance any potential impact on the individual and their rights under data protection laws. We will always ensure that personal data will not be used where our interests are overridden by the impact on the individual.

As part of our safer recruitment procedures, we may process information relating to criminal convictions or offences where this is disclosed by the volunteer or through the DBS process. Where relevant information is identified, we may carry out a risk assessment to determine suitability for the volunteer role. We only process this information where permitted by law.

Data that we collect about volunteers that is classed as ‘special category data’ – this is always marked as optional at the point of collection

All data is stored on secure servers located in the UK. We take the security of personal data seriously and have internal policies and strict controls in place to try to ensure that data is not lost, accidentally destroyed, misused or disclosed and to prevent unauthorised access.

We will hold personal information on our systems for as long as is necessary for us to provide our services, comply with our legal obligations, maintain records, and carry out reporting.

We are committed to protecting data and therefore it will never be sold to external organisations however there are some specific instances where we will share information with trusted third parties:

• We securely share relevant DBS information with schools where volunteers are based. This may include information such as DBS certificate number and DBS certificate issue or expiry date.
• We may share anonymised or aggregated information about our volunteers and programme, such as the percentage of volunteers who are students or the number of hours volunteered.
• Where a volunteer has been recruited through a partnership with a business, university or other organisation, we may share anonymised information about participation and programme outcomes. We will only share identifiable information, personal stories or testimonials where the volunteer has given consent.
• In the event of a safeguarding concern, risk of harm, or where we are required to do so by law, we may share personal information with relevant agencies, including statutory services, without consent where necessary to protect individuals or fulfil our legal responsibilities.

The UK-GDPR gives individuals certain rights about how their information is collected and used. To make a request for the personal information that we hold, contact our data protection officer at dpo@reachoutuk.org.

Where we are processing personal data with consent, you have a right to withdraw that consent. If you change your mind, or you are unhappy with our use of your personal data, please let us know by contacting our data protection officer at dpo@reachoutuk.org.

You also have the following rights:

• the right to be informed about the collection and use of your personal data – this is called ’right to be informed’.
• the right to ask us for copies of your personal information we have about you – this is called ’right of access’, this is also known as a subject access request (SAR), data subject access request or right of access request.
• the right to ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’.
• the right to ask us to delete your personal information – this is called ‘right to erasure’
• the right to ask us to stop using your information – this is called ‘right to restriction of processing’.
• the ‘right to object to processing’ of your information, in certain circumstances
• rights in relation to automated decision making and profiling.
• the right to complain to the Information Commissioner if you feel we have not used your information in the right way.

We may need to update this privacy notice periodically, so we recommend that you revisit this information from time to time. This version was last updated on 22nd July 2026.