Privacy Policy

About this notice

This privacy notice explains how Future Projects collects, uses, stores and shares personal information.

It applies across all parts of Future Projects, including:

• Future Support;
• Future Education;
• Future Radio;
• our employment, volunteering and governance activities;
• fundraising, donations and communications;
• projects delivered with partners;
• our websites, online forms and digital services.

It covers information about service users, pupils, parents and carers, employees, volunteers, job applicants, Trustees, Governors, donors, supporters, visitors, partners, suppliers and other people who interact with us.

We may provide additional privacy information for a particular service, project, form, website or activity. Where we do, that information should be read alongside this notice.

Who we are

The data controller is:

The NR5 Project, trading as Future Projects
Charity number: 1103200
Company number: 04358690

Our correspondence address is:

Future Projects
The Baseline Centre
65–67 Knowland Grove
Norwich
NR5 8YD

Telephone: 01603 250 505
General email: info@futureprojects.org.uk

For most of our activities, Future Projects decides why and how personal information is used and is therefore the data controller.

In some partnership or commissioned services, Future Projects may act jointly with another organisation or process information on another organisation’s instructions. Where this materially affects you, we will provide further information explaining the respective responsibilities.

Our Data Protection Officer

Our Data Protection Officer and Data Protection Lead is:

Laura Knight
Finance & Business Support Officer
Email: l.knight@futureprojects.org.uk

You can contact Laura if:

• you have a question about how we use your information;
• you wish to exercise a data protection right;
• you believe information is inaccurate;
• you wish to withdraw consent;
• you have a data protection concern or complaint;
• you need this notice in another format.

You can also write to the Data Protection Officer at our correspondence address above.

What personal information we collect

The information we collect depends on your relationship with us and the service or activity involved.

Basic identity and contact information

We may collect:

• your name, title and previous names;
• address, email address and telephone number;
• date of birth and age;
• photograph or other identity information;
• preferred contact method;
• emergency contact, next of kin or representative details;
• communication, language and accessibility needs.

Service-user and community-support information

Where you receive support from Future Projects, we may collect:

• referral and eligibility information;
• assessments, support plans and case notes;
• information about your needs, goals, circumstances and outcomes;
• housing, homelessness and tenancy information;
• welfare benefits, income, debt and financial information;
• employment, education, training and skills information;
• physical and mental health information where relevant to support;
• disability and reasonable-adjustment information;
• family, caring and household circumstances;
• safeguarding, risk and vulnerability information;
• information about other organisations or professionals involved in your support;
• records of appointments, contact, referrals, actions and outcomes;
• consent, information-sharing and communication preferences;
• complaints, compliments, incidents and feedback.

We collect only information that is relevant to the support being provided or another legitimate organisational purpose.

Future Education information

For pupils, parents and carers, we may collect:

• pupil and parent or carer identity and contact information;
• dates of birth, addresses and emergency contacts;
• unique pupil numbers and other education identifiers;
• admission and placement information;
• attendance, exclusions and absence information;
• education history and previous school information;
• Education, Health and Care Plans;
• special educational needs and disability information;
• attainment, assessment, progress and examination information;
• behaviour, pastoral and personal-development records;
• safeguarding and child-protection information;
• medical, first-aid, allergy and medication information;
• transport and school-meal information;
• photographs, recordings and work produced by pupils;
• information required by local authorities, the Department for Education, examination bodies and inspection authorities.

Future Education may provide additional pupil, parent, workforce or safeguarding privacy notices where more detailed information is required.

Children and young people will be given privacy information in a way that is appropriate to their age and understanding. Their views, rights and best interests will be considered when decisions are made about their information.

Future Radio information

For employees, volunteers, presenters, guests, contributors and participants, we may collect:

• contact and volunteer-registration information;
• skills, interests, experience and availability;
• programme, training and supervision records;
• safeguarding, accessibility and support information;
• contributor agreements and consent records;
• photographs, audio, video and broadcast recordings;
• social media, website and publicity content;
• guest, interview and event information;
• sponsorship, advertising and commercial contact information;
• complaints, broadcast-compliance and incident records.

Radio programmes, podcasts, photographs and recordings may be broadcast, published, archived or shared publicly. We will explain the intended use when information or content is collected, particularly where children or vulnerable people are involved.

Employees, workers, volunteers and Governors

We may collect:

• contact, identity and emergency-contact information;
• application forms, employment and education history;
• references, qualifications and professional information;
• proof of identity and right to work;
• Disclosure and Barring Service information where appropriate;
• driving-licence information where driving is required;
• contracts, job descriptions and working arrangements;
• payroll, bank, tax, pension and expense information;
• attendance, leave and sickness records;
• health, disability and reasonable-adjustment information;
• induction, training, supervision and performance records;
• grievance, disciplinary, capability and whistleblowing information;
• safeguarding, health and safety and incident information;
• photographs and organisational contact information;
• information required for insurance, legal, regulatory or governance purposes.

Equality-monitoring information and information about health, disability, adjustments and criminal records will be kept separate from general selection information where appropriate and accessed only by people who need it.

Job applicants

We may collect:

• application forms and curriculum vitae information;
• employment, volunteering and education history;
• explanations for gaps in employment;
• interview notes and assessment scores;
• references;
• identity and right-to-work information;
• qualifications and professional registration;
• reasonable-adjustment information;
• equality-monitoring information;
• health information where relevant and lawful;
• DBS and criminal-record information where the role requires it;
• correspondence and decisions about the recruitment process.

Donors, fundraisers and supporters

We may collect:

• name and contact details;
• donation and payment information;
• Gift Aid declarations;
• communication and marketing preferences;
• event participation and fundraising activity;
• correspondence, feedback and relationship history;
• photographs or case studies where agreed;
• information required for fraud prevention, financial records and regulatory reporting.

Payment-card information is normally processed directly by an approved payment provider. Future Projects will usually receive confirmation of the transaction and the information needed to administer the donation rather than full card details.

Trustees, Governors, partners and suppliers

We may collect:

• professional and organisational contact details;
• roles, qualifications and experience;
• declarations of interest;
• due-diligence and assurance information;
• meeting attendance, minutes and decisions;
• contracts, invoices and payment information;
• insurance, safeguarding and compliance information;
• correspondence, performance and relationship records.

Relatives, carers, representatives and emergency contacts

We may hold your name, relationship and contact information if another person identifies you as:

• a family member or carer;
• an emergency contact or next of kin;
• an advocate or representative;
• an attorney, deputy or DWP appointee;
• someone who should be consulted about support, safeguarding or welfare.

Being named as a contact does not automatically give someone authority to make decisions or receive confidential information. We will verify authority and consider the wishes and rights of the person concerned before sharing information.

Special-category information

We may process information requiring additional protection, including information about:

• physical or mental health;
• disability;
• racial or ethnic origin;
• religion or philosophical belief;
• political opinions where relevant to a specific activity;
• trade-union membership;
• sex life or sexual orientation;
• biometric or genetic information, in the limited circumstances where this is used.

We may also process information about criminal allegations, investigations, convictions, cautions, barring decisions and related safeguarding measures. Criminal-offence information is protected separately under data protection law.

We will collect this information only where it is relevant, necessary and lawful.

How we collect information

We may collect information:

• directly from you;
• from a parent, carer, advocate or authorised representative;
• through a referral;
• from a local authority, school, college or education provider;
• from an NHS organisation, healthcare professional or social worker;
• from a housing provider, benefits agency or employment service;
• from an employer, training provider or delivery partner;
• from a referee, previous employer or professional body;
• from the Disclosure and Barring Service or government checking service;
• from emergency services, police or safeguarding authorities;
• through our websites, forms, telephone calls, emails and correspondence;
• through meetings, assessments, support sessions and activities;
• through attendance, access, security or incident records;
• from publicly available sources where it is necessary and appropriate.

Where we receive information from someone else, we will normally tell you within the period required by law unless you already have the information, doing so would be impossible or disproportionate, or a lawful exemption applies.

Why we use your information

We use personal information for the following purposes.

Providing services and support

We use information to:

• assess eligibility and understand needs;
• provide advice, advocacy, education, activities and practical support;
• agree and review support plans and outcomes;
• communicate with you;
• make and receive referrals;
• coordinate with other organisations;
• protect health, safety and welfare;
• monitor service quality and accessibility;
• meet funding and contractual requirements.

Depending on the activity, our lawful basis may be:

• performance of a contract or taking steps at your request before entering a contract;
• compliance with a legal obligation;
• performance of a task in the public interest where the task has a clear basis in law;
• our legitimate interests in delivering, managing and improving charitable services;
• protection of vital interests;
• consent, where you have a genuine choice.

Education

We use pupil and parent information to:

• provide education and support;
• meet special educational needs;
• promote attendance, progress, safety and welfare;
• manage admissions, placements and examinations;
• fulfil safeguarding responsibilities;
• communicate with parents, carers, local authorities and professionals;
• meet legal, regulatory, inspection and funding requirements.

Our lawful bases include legal obligation, contract, public task where supported by law, legitimate interests and vital interests. Consent may be used for optional activities, photographs, publicity or other uses where a genuine choice is available.

Safeguarding and protection

We may use and share information to:

• protect a child or adult from abuse, neglect, exploitation or serious harm;
• assess and manage risks;
• respond to emergencies;
• make safeguarding referrals;
• cooperate with statutory enquiries;
• prevent or detect crime;
• protect other people and the public.

Our lawful bases may include legal obligation, vital interests, public task and legitimate interests. Special-category information may be processed for safeguarding, substantial public interest, social protection, health or social care, vital interests or legal claims.

We will not promise absolute confidentiality where information may need to be shared to protect someone from harm.

Employment and volunteering

We use information to:

• recruit and select suitable people;
• complete lawful employment checks;
• administer contracts and volunteer arrangements;
• pay employees and expenses;
• administer tax, National Insurance and pensions;
• provide training, supervision and support;
• manage attendance, wellbeing, performance and conduct;
• provide reasonable adjustments;
• meet safeguarding, health and safety and employment duties;
• respond to claims, disputes and legal requirements.

Our lawful bases include contract, legal obligation and legitimate interests. Special-category information may be used for employment, social-protection, occupational-health, safeguarding and legal-claim purposes.

Fundraising and communications

We use information to:

• process and acknowledge donations;
• administer Gift Aid;
• support fundraising activities and events;
• maintain accurate financial records;
• communicate with supporters;
• provide newsletters and information about our work;
• record preferences and objections.

We use consent where required for electronic marketing and legitimate interests where lawful and appropriate. Every marketing communication will provide a simple way to unsubscribe or change preferences.

We do not sell personal information or provide it to another organisation for that organisation’s unrelated marketing.

Managing the organisation

We use information to:

• manage finance, governance, insurance and risk;
• manage premises, visitors and security;
• respond to complaints, incidents and enquiries;
• investigate suspected fraud, misconduct or security concerns;
• maintain IT systems and service continuity;
• monitor and improve quality;
• evaluate projects and report outcomes;
• comply with contracts, grants and regulatory obligations;
• establish, exercise or defend legal claims.

Our lawful bases may include legal obligation, contract and legitimate interests.

Consent

Where we rely on consent, we will:

• explain what information is needed and why;
• provide a genuine choice;
• record the consent;
• allow consent to be withdrawn as easily as it was given.

Withdrawing consent does not affect processing already carried out lawfully. It may not require us to delete information that we must retain for another lawful reason.

We will not rely on consent where providing or refusing consent is not genuinely optional.

Special-category and criminal-offence information

Where we use special-category information, we must have both an ordinary lawful basis and an additional legal condition.

Depending on the circumstances, these conditions may include:

• employment and social-protection obligations;
• health or social-care purposes;
• safeguarding and other substantial public-interest purposes;
• protecting someone’s vital interests;
• establishing, exercising or defending legal claims;
• information made manifestly public by the individual;
• explicit consent.

Criminal-offence information will be processed only where authorised by law and with appropriate safeguards. This may include safer recruitment, DBS checking, safeguarding, fraud prevention, security and ongoing suitability for a role.

Confidential health and care information

Where information has been given in circumstances creating a duty of confidence, we will also consider the common-law duty of confidentiality.

We may use or share confidential health or care information where:

• you have given valid consent;
• there is a legal requirement or lawful authority;
• it is necessary to protect life or prevent serious harm;
• safeguarding responsibilities require it;
• an overriding public interest justifies the disclosure.

We will share only the information that is necessary and proportionate.

Who we share information with

We may share information with:

• organisations providing services jointly with us;
• funders, commissioners, lead providers and delivery partners;
• local authorities and safeguarding services;
• NHS organisations, GPs and other health or social-care professionals;
• schools, colleges, education providers and local-authority education teams;
• the Department for Education, examination bodies and inspection authorities;
• housing providers and homelessness services;
• the Department for Work and Pensions and employment services;
• employers and training providers, where relevant and lawful;
• police, courts, emergency services and law-enforcement agencies;
• the Disclosure and Barring Service;
• HM Revenue and Customs;
• pension, payroll and employee-benefit providers;
• occupational-health, counselling and employee-support providers;
• insurers, auditors, accountants and professional advisers;
• banks, payment processors and fundraising providers;
• website, email, cloud, IT, security and database providers;
• landlords, contractors and premises providers;
• regulators, statutory bodies and government departments;
• a parent, carer, advocate, attorney or representative where authorised or otherwise lawful;
• any other person or organisation where you have asked us to share information.

We may also share anonymised or aggregated information that does not identify individuals for evaluation, planning, reporting, research or public information.

Before sharing identifiable information, we will consider:

• whether there is a lawful basis;
• whether the recipient is authorised;
• whether the sharing is necessary and proportionate;
• whether consent is required;
• how the information can be transferred securely;
• what information actually needs to be shared.

Our processors and suppliers must follow contractual confidentiality, security, retention and data-protection requirements.

National Data Opt-Out

The National Data Opt-Out allows people to choose whether confidential patient information can be used for certain research and planning purposes beyond their individual care.

At present, Future Projects does not use or disclose confidential patient information for research or planning in circumstances where the National Data Opt-Out applies.

We review new and existing health-related processing to determine whether the opt-out applies. If we begin processing information within its scope, we will apply the National Data Opt-Out and update this notice.

International transfers

Most of our information is intended to be stored and accessed within the United Kingdom.

Some cloud, communications, website, payment or specialist service providers may store or access information in another country. Where personal information is transferred outside the UK, we will ensure that a lawful safeguard is in place.

This may include:

• a UK adequacy regulation;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved contractual clauses;
• another safeguard permitted by data protection law.

We will also consider the security and privacy risks associated with the transfer.

Our websites and online services

When you visit a Future Projects website or use an online service, we may collect:

• your IP address;
• browser and device information;
• date, time and duration of visits;
• pages visited and links followed;
• referring website information;
• security and error logs;
• cookie identifiers and preferences;
• information entered into contact, donation, application, booking or registration forms;
• newsletter and communication preferences.

We use this information to:

• operate and secure our websites;
• respond to enquiries and requests;
• process forms, bookings and applications;
• understand how the website is used;
• improve accessibility and performance;
• prevent misuse, fraud and cyber incidents;
• administer donations and communications.

Essential cookies and similar technologies may be used where necessary to operate and secure a website. Non-essential analytics, advertising or similar cookies will be used only where the appropriate information and choice have been provided.

You can manage cookies through the cookie settings available on the relevant website and through your browser settings.

Where you follow a link to an external website, donation platform, payment service, social media site or other third-party service, that organisation may process your information under its own privacy notice. Future Projects is not responsible for the privacy practices of an external website that it does not control.

Website and email communications are not guaranteed to be completely secure. Please do not include highly sensitive information in a general website contact form. Contact us directly where you need to discuss confidential information.

Photographs, recordings, broadcasts and case studies

We may take or receive photographs, video, audio, interviews, broadcasts, testimonials and case studies relating to our services and activities.

Before using identifiable material, we will consider:

• the intended purpose and audience;
• whether consent or another lawful basis is appropriate;
• the person’s age, capacity and circumstances;
• safeguarding, dignity and potential future impact;
• where and for how long the material will be available.

Where consent is used, you may withdraw it for future use. We may not always be able to remove material already lawfully printed, broadcast, archived or shared by others, but we will explain this when consent is requested.

Additional protections will be applied to material involving pupils, children and vulnerable adults.

Automated decisions and artificial intelligence

Future Projects does not currently make decisions about people using solely automated processing where the decision would have a legal or similarly significant effect.

Approved digital tools may be used to support administrative work, analysis or drafting, but an appropriate person remains responsible for significant decisions.

Personal, confidential, safeguarding, pupil, service-user or employee information must not be entered into an unapproved public artificial-intelligence system.

If we introduce significant automated decision-making in the future, we will provide specific information about:

• the processing involved;
• how the decision is made;
• the likely effect;
• the safeguards and human-review arrangements;
• your relevant rights.

How we protect information

We use proportionate organisational, physical and technical security measures, including:

• individual user accounts and role-based access;
• multifactor authentication;
• approved devices and systems;
• security monitoring, malware protection and software updates;
• secure email and file-sharing arrangements;
• backups and recovery procedures;
• locked storage for confidential paper records;
• confidential-waste disposal;
• staff training and confidentiality requirements;
• supplier checks and data-protection agreements;
• incident and personal-data-breach procedures.

Access is limited to people who need the information for an authorised purpose.

No system can be guaranteed completely secure. If a personal data breach occurs, we will take action to contain it, assess the risks and notify the Information Commissioner’s Office and affected people where legally required.

How long we keep information

We keep information only for as long as it is needed for the purpose for which it was collected and to meet legal, safeguarding, insurance, contractual and operational requirements.

Typical retention periods include:

Record	Typical retention
Adult service-user case records	Seven years after case closure or last meaningful contact
Adult safeguarding records	Normally at least seven years after closure, and longer where risk, allegations or legal action require
Pupil and education records	In accordance with the Future Education retention schedule and applicable education requirements
Child safeguarding records	In accordance with the relevant safeguarding and school retention schedule
Employee personnel records	Six years after employment ends
Training, competency and supervision records	Duration of employment or role plus six years
Unsuccessful applications and interview records	Six months after recruitment closes
Right-to-work evidence	Duration of employment plus two years
Copies of DBS certificates	Normally no longer than six months after the decision
Incident, accident and near-miss records	Six years after closure, subject to longer safeguarding, insurance or legal periods
Routine complaints and compliments	Three years after closure
Serious complaints, claims or regulatory matters	Normally six years or longer according to risk
Donor and supporter records	Six years after the last financial transaction or active relationship
Marketing consent and preference records	While relied upon and normally six years after last use
Routine enquiries and correspondence	Twelve months after resolution
Visitor and routine sign-in records	Normally twelve months
Security and access logs	Normally twelve months
CCTV, where used	Normally 30 days unless footage is required for an incident, claim or investigation
Financial and tax records	Normally six years after the relevant financial or tax year

Some information may be kept for longer where:

• safeguarding concerns remain relevant;
• a child’s age requires a longer period;
• a contract or funder specifies a period;
• there is an incident, complaint, investigation, claim or legal dispute;
• information is required by an insurer or regulator;
• a legal hold prevents destruction;
• there is a continuing risk or operational need.

When information is no longer required, paper records are placed in approved confidential waste and electronic information is securely erased or destroyed. Information may be anonymised and retained for statistical, historical or evaluation purposes where individuals can no longer be identified.

A copy of our more detailed retention schedule is available from the Data Protection Officer.

Your data protection rights

Your rights depend on the information involved and the lawful basis being used.

You may have the right to:

Be informed

You have the right to clear information about how and why we use your personal data.

Access your information

You may ask for confirmation that we hold information about you and request a copy.

Correct information

You may ask us to correct inaccurate information or complete information that is incomplete.

Erase information

You may ask us to delete information in certain circumstances. This right does not apply where we must keep the information for a legal, safeguarding, contractual or other lawful reason.

Restrict processing

You may ask us to restrict how information is used in certain circumstances, including while accuracy or an objection is being considered.

Object to processing

You may object where we rely on legitimate interests or public task. You also have an absolute right to object to direct marketing.

Data portability

In certain circumstances, you may ask us to provide information you gave us in a structured, commonly used and machine-readable format, or to transfer it to another organisation.

Withdraw consent

Where processing is based on consent, you may withdraw consent at any time. This will not affect processing already carried out lawfully.

Rights concerning automated decisions

You may have rights concerning a solely automated decision that has a legal or similarly significant effect.

Rights are not absolute. We will explain if a legal exemption or another person’s rights prevent us from fully complying with a request.

We may ask for proportionate proof of identity or authority to ensure that information is not disclosed to the wrong person.

We will respond without undue delay and normally within one calendar month. The law allows the response period to be extended in some circumstances. We may also ask for clarification or further information where reasonably necessary to identify the information requested.

There is normally no charge for exercising a data protection right.

To make a request, contact:

Laura Knight, Data Protection Officer
l.knight@futureprojects.org.uk

or write to the Data Protection Officer at our correspondence address.

Data protection complaints

You can complain to us if you believe that:

• we have used your information unfairly or unlawfully;
• information has been disclosed inappropriately;
• information is inaccurate or insecure;
• we have not dealt properly with a data protection request;
• we have not explained clearly how information is being used.

Please contact:

Laura Knight, Data Protection Officer
Email: l.knight@futureprojects.org.uk

You may also write to:

Data Protection Officer
Future Projects
The Baseline Centre
65–67 Knowland Grove
Norwich
NR5 8YD

Please provide:

• your name and preferred contact details;
• a description of the concern;
• relevant dates, people, services or correspondence;
• the outcome you are seeking, where appropriate.

We will:

• record your complaint;
• acknowledge it within 30 days;
• make appropriate enquiries without undue delay;
• keep you informed where a response is not immediate;
• explain the outcome and any action taken without undue delay.

You may also complain to the Information Commissioner’s Office if you are unhappy with how we have used your information or handled your complaint:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113
Website: https://ico.org.uk/make-a-complaint/

We would welcome the opportunity to consider your concern first, but you are not prevented from contacting the Information Commissioner’s Office.

Accessibility

We can provide this notice in alternative formats, including:

• larger print;
• electronic format;
• Easy Read;
• another reasonable accessible format.

Please contact us if you require support to understand this notice or exercise your rights.

Changes to this notice

We will review this privacy notice regularly and update it when:

• our services or use of information changes;
• we introduce a new system or significant processing activity;
• legal or regulatory requirements change;
• a review, complaint or incident identifies a need for clarification.

The date at the beginning of the notice will show when it was last updated. Where a change materially affects how we use information, we will take reasonable steps to bring it to the attention of the people affected.