Data Protection Policy

Home > Employee Handbook > Data Protection Policy

Purpose of this policy

Stomping Grounds North East CIO (“SGNE”, “we”, “our”) is committed to protecting the privacy and personal data of the children, young people, families, staff, and volunteers who engage with our provision.
We comply with:

• The UK General Data Protection Regulation (UK GDPR)

• Data Protection Act 2018

• Human Rights Act 1998

• Common Law Duty of Confidentiality

• Relevant Ofsted and safeguarding guidance

This policy explains what personal data we collect, why we collect it, how we use and store it, how long we keep it, and the rights of the individuals whose data we process.

2.1 Children, Young People & Families

• Name, date of birth, contact details

• Medical information (allergies, conditions, medications, GP details)

• Emergency contact details

• Participation history

• School attended

• Feedback, evaluations, monitoring information

• Demographic information (ethnicity, gender, disability) — for anonymised impact reporting only

• Photographs or digital images (if consent given)
  
  

2.2 Staff & Volunteers

From your Single Central Record (SCR), we hold:

• Employment/volunteer status

• DBS number, issue date, update service status, next check date

• Prohibition checks, Section 128, barred list checks

• Qualifications, right-to-work documentation

• References and recruitment checks

• Contact information (email, phone, address)

• Date of birth and previous names

• Medical conditions and dietary needs (only where necessary for duty of care)

• Emergency contact details

• Onboarding dates, role, start date

• ID verification information

• Self-disclosure forms

• Any relevant overseas checks

This data is highly sensitive and handled with strict access control.

3. Our Purposes for Processing Data

We use personal data to:

• Deliver safe, high-quality forest school, youth work, AP and kindergarten provision

• Administer bookings and communications

• Ensure medical, welfare, and safeguarding needs are met

• Keep children safe during activities

• Meet legal obligations (e.g. safeguarding, right to work, DBS checks)

• Monitor and improve our services

• Produce anonymised impact and evaluation reports

• Advertise our work (images only with explicit consent)

• Manage staff and volunteer recruitment, training and HR records

We will only collect the minimum data necessary for each purpose (“data minimisation”).

4. Our Lawful Bases for Processing Data

Under UK GDPR, we rely on the following lawful bases:

4.1 For children, young people & families

• Contractual necessity – to deliver booked sessions

• Legitimate interests – safe delivery, communications, evaluation

• Vital interests – medical emergencies and safeguarding

• Legal obligation – safeguarding and child-protection requirements

• Consent – photographs, special category data where required

4.2 For staff & volunteers

• Legal obligation – safer recruitment, right to work, DBS, safeguarding

• Contractual necessity – employment or volunteer agreements

• Legitimate interests – operational management

• Explicit consent – medical information where required for duty of care

4.3 Special Category Data (Article 9)

We process health and demographic data under:

• Article 9(2)(a) — explicit consent

• Article 9(2)(c) — vital interests

• Article 9(2)(h) — health and social care / safeguarding

• Article 9(2)(j) — statistical purposes (anonymised only)

4.2 For staff & volunteers

• Legal obligation – safer recruitment, right to work, DBS, safeguarding

• Contractual necessity – employment or volunteer agreements

• Legitimate interests – operational management

• Explicit consent – medical information where required for duty of care

4.3 Special Category Data (Article 9)

We process health and demographic data under:

• Article 9(2)(a) — explicit consent

• Article 9(2)(c) — vital interests

• Article 9(2)(h) — health and social care / safeguarding

• Article 9(2)(j) — statistical purposes (anonymised only)

5. How We Store and Protect Your Data

We use secure digital and physical systems, including:

• Google Workspace (password-protected, two factor authentication enforced, access-controlled, encrypted at rest and transfer)

• Monday.com (role-based access, activity logs)

• Locked office (when not in use) for paper records

• Restricted access for sensitive information

• Portable devices secured with passwords/encryption

• Immediate deletion of images from devices once transferred

• Regular staff training

• “Least access necessary” principle

6. How Long We Keep Information (Retention)

We retain data only as long as necessary:

Children & families

• Session, health & contact records: usually 7 years from last contact (to meet safeguarding / insurance requirements).

• Photographs: maximum 5 years, or earlier if consent is withdrawn.

• anonymised evaluation data: retained indefinitely (non-identifiable).

Staff & volunteers

• Personnel files: 7 years after leaving

• DBS information: single record kept in line with safer recruitment guidance

• SCR entries: retained as long as individual is active + up to 6 years

• Right-to-work documents: 2 years after end of employment

• Recruitment records (unsuccessful): 6 months unless consent given to retain longer

We can create a full retention schedule if you want.
7. Sharing Your Information

We only share data when:

• We have your explicit consent

• There is a safeguarding concern

• It is necessary in a medical emergency

• We are required by law

• We work with partner organisations (schools, social services, local authority)

• A third-party processor provides secure systems (e.g. Google Workspace, Monday.com)

• For anonymised statistical reports

We never sell personal data.

Any processor we use is required to comply with UK GDPR.

8. Photographs and Digital Images

• Parents/carers must provide explicit consent for each child

• Consent can be withdrawn at any time

• Images used only for agreed purposes (communication, marketing)

• Images deleted from devices immediately after secure upload

• Stored securely for no longer than 5 years

• We will never identify children by name without separate written consent

9. Your Rights

Under UK GDPR, you have the right to:

• Access the data we hold

• Request correction of inaccurate data

• Request deletion (“Right to be Forgotten”)

• Withdraw consent (e.g. for photographs)

• Restrict or object to processing (in some situations)

• Request data portability (where applicable)

To exercise your rights, contact our Data Protection Lead (TBC).

10. Data Breaches

Although we have had no data breaches requiring ICO reporting, SGNE keeps an internal breach log (one entry to date).

A breach may include:

• Loss or theft of data

• Unauthorised access

• Accidental sharing

Our process:

1. Identify and contain the breach

2. Assess the severity and risks

3. Notify the Data Protection Lead

4. Record in the breach log

5. Report to ICO within 72 hours if required

6. Inform affected individuals when appropriate

7. Apply corrective actions and learning

11. Data Protection by Design & Default

We are committed to:

• Data minimisation

• Only collecting necessary information

• Conducting Data Protection Impact Assessments (DPIAs) when required

• Using secure systems and access controls

• Reviewing our processes regularly

13. Complaints

If you have concerns about how we handle your data:

1. Contact our Data Protection Lead.

2. If unresolved, you may contact the Information Commissioner’s Office (ICO).