Privacy Notice

Walsall Community Active Projects CIC

Company number 17051741

Privacy Notice

---

1. Introduction

This Privacy Notice explains how Walsall Community Active Projects CIC ("we", "us", "our") collects, uses and protects personal information about you. It is written in plain language so it is easy to understand.

We are a community interest company registered in England. Our work supports children, young people and adults in Walsall and the wider West Midlands.

If you have any questions about how we use your information, you can contact us at:

Martin O'Connor, Founder and Director
Walsall Community Active Projects CIC
[contact email and phone to be added]

2. Who This Notice Applies To

This notice covers personal information we collect about:

• Participants in our sessions and events
• Parents and carers
• Staff, volunteers and trustees
• Visitors to our website
• Partners, funders and supporters
• Anyone who contacts us

3. What Information We Collect

Depending on how you interact with us, we may collect:

• Contact details: name, address, phone number, email.
• Personal details: date of birth, gender, emergency contacts.
• Health and access information: medical conditions, dietary needs, support requirements.
• Safeguarding information: where this is needed to keep someone safe.
• Equality monitoring: race, ethnicity, sexual orientation, religion (always given voluntarily).
• Attendance and progress records: for participants in our programmes.
• Photographs and video: where consent has been given.
• Payment information: for staff, contractors and (rarely) participants who pay session fees.
• Website information: such as cookies, IP address and pages visited.

4. How We Collect It

We collect information:

• Directly from you, when you sign up, attend a session, send us a message or apply for a role
• From parents and carers, for participants under 18
• From referring organisations such as schools, the local authority or housing providers, where you have agreed to a referral
• From our website and online systems
• From publicly available sources, such as Companies House

5. Why We Use Your Information

We use personal information to:

• Provide and improve our services
• Keep participants safe
• Communicate with you about sessions, events and updates
• Monitor and report on our impact to funders and partners
• Manage staff, volunteers and trustees
• Process payments and donations
• Run our website and respond to enquiries
• Meet our legal and regulatory duties

6. Our Lawful Basis

Under UK GDPR, we always need a lawful basis to process your information. We rely on:

• Consent: for things like marketing, photography and optional services. You can withdraw consent at any time.
• Contract: where we have an agreement with you, such as employment or a paid service.
• Legal obligation: such as safeguarding duties or tax records.
• Vital interests: in an emergency where someone's life is at risk.
• Legitimate interests: for running our services, communicating with participants and managing our organisation, where this does not override your rights.

For special category data (such as health, race or religion), we also rely on additional bases, including explicit consent and substantial public interest for safeguarding.

7. Who We Share Information With

We will only share your information where there is a clear, lawful reason. We may share with:

• Schools, local authorities, housing providers and the NHS, where this is part of agreed support
• The police and other emergency services, where there is a safeguarding or legal need
• Funders, where required to report on the use of grants (information is anonymised wherever possible)
• Our accountant and other professional advisers, under strict confidentiality
• HMRC, Companies House, the CIC Regulator and other authorities, where the law requires it
• Service providers, such as email and cloud storage providers, who handle data on our behalf under contract

We never sell your personal information to third parties.

8. How Long We Keep It

We keep personal information only for as long as we need it. Typical retention periods are:

• Participant records: up to 7 years after your last contact, longer for safeguarding
• Safeguarding records: usually until the person reaches 25, then reviewed
• Staff and volunteer records: up to 7 years after your involvement ends
• Financial records: at least 6 years
• Photos and marketing materials: while consent is in place, reviewed regularly
• Website cookies: see Section 13 below

9. Where Your Information is Held

Most of our information is held within the UK or the European Economic Area (EEA). Some of our service providers may store information outside the EEA. Where this happens, we make sure appropriate safeguards are in place, in line with UK GDPR.

10. Keeping Your Information Secure

We protect your information through:

• Strong passwords and two-factor authentication
• Encryption where appropriate
• Restricted access, on a need-to-know basis
• Secure storage of paper records
• Anti-virus and firewall protection
• Staff training on data protection

If anything goes wrong, we will act quickly to fix it and tell you and the Information Commissioner's Office where required.

11. Your Rights

Under UK GDPR, you have the right to:

• Be informed about how we use your information (this notice)
• Ask for a copy of the information we hold about you
• Ask us to correct anything that is wrong
• Ask us to delete your information ('right to be forgotten') in certain circumstances
• Restrict how we use your information
• Ask us to transfer your information to another organisation
• Object to how we use your information
• Rights around automated decisions and profiling (we do not use these techniques)

You can exercise any of these rights by contacting us. We will respond within one month.

12. Children's Information

Where we collect information about children under 18, we ask for consent from a parent or carer for those under 13. For older children, we explain how we use their information in age-appropriate language and seek their own views where it is right to do so.

13. Cookies and Our Website

Our website may use cookies and similar technologies to:

• Make the site work properly
• Remember your preferences
• Understand how visitors use the site, so we can improve it

You can manage cookies through your browser settings. Most browsers let you block or delete cookies. Blocking some cookies may affect how the site works for you.

We may use analytics tools, such as Google Analytics, to understand how visitors use our site. These tools use information in an aggregated and anonymised way.

14. Links to Other Websites

Our website may link to other websites we think you will find useful. We are not responsible for the privacy practices of those sites. We encourage you to read their privacy notices before sharing any personal information with them.

15. Photography and Video

We sometimes take photographs and videos at sessions and events to celebrate our work, promote what we do and report to funders. We only use identifiable images of participants where we have valid consent. You can ask us to remove your image at any time.

More detail is in our Photography, Filming and Consent Policy, which is available on request.

16. Marketing and Communications

We will only send you marketing or fundraising communications if you have asked to receive them, or if you have a clear ongoing relationship with us. You can unsubscribe at any time by:

• Clicking the unsubscribe link in any email
• Replying to ask us to remove you from our list
• Contacting us using the details at the top of this notice

17. Complaints

If you are unhappy with how we have handled your information, please contact us first, so we have the chance to put it right. You can use our Complaints and Compliments Procedure.

You also have the right to complain to the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113
• Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

18. Changes to This Notice

We review this Privacy Notice at least once a year, and update it when needed. The most recent version will always be available on our website. Significant changes will be brought to your attention where we can.

This Privacy Notice was adopted on 14 February 2026. The next scheduled review is February 2027.

---

Signed on behalf of the Board