Who are Centrepoint?
Centrepoint Soho, a company limited by guarantee (Company Number: 01929421) and a charity registered with the Charity Commission for England and Wales (Charity Number: 292411) which is also registered as a Housing Association (No. H1869) Ofsted URN 2762612 and its trading company CP Trading Limited, a company limited by shares, Company Number: 02951328 both of which have their registered office at The Rowe, 59 - 63 Whitechapel High Street, London,E1 7PF (together Centrepoint). We process your personal data in accordance with the UK Data Protection laws, specifically UK GDPR as defined below, and the Data Protection Act 2018 (together the DPL) and the information set out in this Privacy Notice.
1. Background
1.1.Centrepoint Soho (the Charity) is the UK's leading youth homelessness charity. We support young people aged 16–25 across 60 services in London, Yorkshire, Manchester and the Northeast of England. The Charity undertakes trading activities through CP Trading Limited (CP Trading).
1.2. For the avoidance of doubt GDPR means EU Regulation 2016/679 of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the General Data Protection Regulation) which has been directly imported into the law of England and Wales, Scotland and Northern Ireland (UK Law) by virtue of section 3 of the European Union (Withdrawal) Act 2018 as amended by the Data Protection, Privacy and Electronic Communications (Amendment Etc.) (EU Exit) Regulations 2019.
1.3. Centrepoint’s responsibilities under the Data (Use and Access) Act 2025 are also set out in this Privacy Notice.
1.4. We are registered as a ‘Data Controller’ with the Information Commission of England (IC). The IC is the regulator with the responsibility for protecting the personal data rights of people within the UK, under the General Data Protection Regulation 2016/679 and Data Protection Act 2018 (DPA). Our Registration No. is ZA5455259. As a Data Controller we decide what information we collect, how we collect it, the purpose for which we collect it and what we do with it. This means we have specific responsibilities in relation to the personal data we collect.
1.5. This Notice sets out how Centrepoint processes your personal data. We have a number of specific privacy notices in relation to young people, donors, volunteers, supporters, employees, trustees, celebrity ambassadors and Centrepoint wide. These can be found on our website here. As a Child or Young Person accessing Centrepoint’s Upstream England surveys and support, and as Parent/Carer/Guardian of a Child or Young Person accessing Centrepoint’s Upstream England surveys and/or support, this Notice sets out how Centrepoint processes your personal data. We have made this information available to you following your recent contact.
2. What information do we collect?
2.1 We may collect your:
- Equalities monitoring information.
- Information about how you feel about a range of issues such as your resilience and emotional wellbeing.
- Information about who you live with.
- Your views on school and education and
- Information about housing and experience of homelessness.
3. Why do we collect your personal information? This is called Purpose and Lawful Basis.
3.1 Centrepoint process your personal data and, where you have provided it, and your special category data, for the following purposes:
- To identify pupils who may benefit from additional support.
- To assess the effectiveness of support programmes and wellbeing activities within the school.
- To assess the effectiveness of survey(s) as an early identification tool.
- To assess the effectiveness of support offered to pupils, and
- To contribute to the safeguarding of pupils.
3.2 This informs our fundraising and marketing campaigns, helps us to effectively communicate with our donors and to fundraise. Where permitted by law, Centrepoint may rely on a soft opt-in or legitimate interests to send fundraising or supporter communications by SMS or email. We aim to make our communications relevant, provide a clear and easy way to opt out, and respect any objections. You can object to your personal information being used this way by contacting supportercare@centrepoint.org
3.3 When you take a campaign action with us, such as signing a petition or contacting a public representative, we may collect personal information necessary for the specific action. This may include your name, email address, postcode, and other relevant details. If you contact your MP or other elected representative, for example local Councillor, using one of our supporter actions, your data, including name, email address, and address may be shared with MPs to facilitate this communication. MPs require your name and contact information, including address, to be included in individual campaign emails to consider and respond effectively. When sending emails to MPs on your behalf, these communications are facilitated through external platforms, for example Engaging Networks. Engaging Networks processes your data for purposes including email delivery and managing supporter actions, such as petitions. If you sign a petition to an individual or group (e.g., Prime Minister, or government minister), it may be necessary to hand in the names of those who signed the petition to that individual or group. This information will not be shared with anyone else.
3.4 Centrepoint may use limited, approved AI and automated tools, such as Microsoft Copilot, Perplexity and Zendesk. These tools help us plan communications, handle customer enquiries, and improve how our services and systems work. Any AI tool used by Centrepoint is subject to robust internal approval process and internal controls. Centrepoint does not use automated decision-making that has a significant impact on individuals, and Centrepoint staff will always make all final decisions.
3.5 Where AI tools access personal data (for example, to help analyse enquiries or create draft communications), they do so under strict controls. These tools do not make decisions about you, and a Centrepoint staff member always reviews outputs.
3.6 Centrepoint need to process your personal information and special category data where you have provided it in order to provide our services to you and to make sure we meet our legal obligations as set out above.
3.7 If you do not provide your personal information to us, we may not be able to provide you with some, or all, of the services you have requested.
3.8 The lawful basis on which the above processing takes place is to comply with legal obligations, legitimate interests and consent shared by Centrepoint, and you as set out below.
3.9 The lawful basis of legitimate interests which permits the processing set out above to take place are:
- You are completing the Upstream England survey.
- You are accessing support as part of the Upstream England programme.
- We need to comply with regulatory requirements.
- That the processing is reasonable in relation to the activities to which they relate.
- That the processing is such as you would reasonably expect to be undertaken by Centrepoint in respect of the management of our operations.
- That the processing is necessary in respect of the activities that are undertaken and is in the interests of Centrepoint and the relevant third parties and does not limit your interests or fundamental freedoms guaranteed by data protection law.
- That if you sought to terminate your consent to Centrepoint processing your personal data, we would still be required to retain information for a time that is reasonable, to fulfil the purpose in this notice, meaning that consent is not freely available.
3.10 We rely on legitimate interests for certain types of processing. When we do so, we carry out a Legitimate Interests Assessment to balance our interests against your rights and freedoms. You can request a copy of this assessment by contacting us at dataprotection@centrepoint.org.
3.11 When you made contact with Centrepoint you created a relationship between us. Where you have opted in to receiving electronic communications from us, we have treated your action as consent to send you communications electronically (commonly called “a soft opt in”). As the lawful basis of the processing, Centrepoint undertakes in relation to electronic communications is your consent, please note that you may withdraw this consent at any time by contacting us.
4. Where we get your personal information from? (Source of Personal Information)
4.1 Centrepoint gathers your personal information from:
- You directly, by completing the Upstream survey.
- Staff from your school.
5. How does Centrepoint share and, or transfer my personal information? (Recipients of personal information)
5.1 Centrepoint may share or transfer your personal information with the following organisations or category of organisations:
- Third parties with whom we have a relationship including our sub-contractors providing services to us and other charities combatting homelessness.
- Local authorities and central government agencies for research and statistical purposes.
- Funders who require the information as part of our funding agreement and monitoring.
- Regulatory organisations and quality mark organisations to undertake inspection and audit activities, to ensure the quality of our work and improve the delivery of the services we provide.
- Police, probation, and Social Care Services where we have a legal duty to share information for the prevention and detection of crime, and
- Local Authorities to report any safeguarding concerns.
6. International Transfers
6.1 Centrepoint intends that your personal information will stay within the countries of the European Union (EU) and the European Economic Area (the EEA) and countries where the EU has decided that the country has adequate data protection laws in line with those in the United Kingdom.
6.2 Your personal information will only be transferred outside of the EEA or another country which has been declared as having adequate data protection laws, where:
- The transfer is necessary for the performance of any contract with you.
- You have entered the information into our website and the information has been transmitted from your server to our server using systems based outside of the EEA.
- We have entered into an appropriate contract protecting your rights and freedoms, which is enforceable by you or the data protection authorities; or
- We have obtained your explicit consent.
6.3 Generally, we do not expect that your personal information will be transferred outside of the EEA.
7. How long do you keep my personal information? (Storage)
7.1 Centrepoint will store your personal information for the duration of our relationship with you, unless a longer retention period is permitted. We will store your personal information in accordance with our data retention policy and procedures.
7.2 Different types of data will have different retention periods. For example, we will retain donor and gift aid information for 7 years. We will retain financial information for 7 years. We will retain recruitment information for 6 months, unless you become employed. We will retain supported accommodation records until a young person reaches the age of 35. We will retain the care records of Looked After Children until their 75th birthday.
8. What are my data rights?
8.1 You have a right to ask Centrepoint to confirm whether or not your personal information is being processed by Centrepoint. You also have the right to ask for access to your personal information. To ask for access to your information you have to submit what is called a Subject Access Request (SAR). Centrepoint’s data protection staff can help you complete your SAR if you would like them to. You can submit a SAR via email or phone or in writing. You can email dataprotection@centrepoint.org, ask your support worker for help, call our Supporter Care Team free on 0800 23 23 20 or write to The Data Protection Officer, Centrepoint, The Rowe, 59 - 63 Whitechapel High Street, London, E1 7PF.
8.2 Please note - we will only provide personal information to you if we are satisfied you have established your identity. This may include us asking to see a copy of your passport or other identification document(s). We will only provide information to you at an address which we have verified as belonging to you.
8.3 You have a right to ask us to correct any inaccurate or incomplete personal information which we process about you. To do this please contact dataprotection@centrepoint.org. Giving an explanation of why you believe the information is inaccurate will help us correct the information.
8.4 You have the right to ask Centrepoint to delete certain personal information relating to you, in certain circumstances. Please contact dataprotection@centrepoint.org setting out the reasons why you would like your personal information deleted. Where certain circumstances apply when we need to use legal, contract or vital interests as lawful bases for processing your data, deletion may not be possible.
8.5 Where certain grounds apply you will be entitled to ask Centrepoint to restrict the processing of personal information relating to you. If you would like to do this, email dataprotection@centrepoint.org setting out the reasons why you would like the personal information Centrepoint holds about you restricted.
8.6 You have the right to object to your personal information being processed, for example, automated decision making, direct marketing and profiling activities. You can contact dataprotection@centrepoint.org if you would like to exercise this right.
8.7 You have the right to data portability - that is to ask us to transfer your personal information electronically to another organisation but only in certain circumstances. Those circumstances include where the lawful basis for processing your information includes contract, legal or vital interests. Contact dataprotection@centrepoint.org if you would like to exercise this right.
8.8 Sometimes the law might stop us from doing as you ask us to do. You might ask us to delete all information we hold about you. However, this might not be possible, for example, if you have Gift Aided a donation to us, HMRC requires that we keep Gift Aid and donation information for seven years. We will clearly communicate to you when we are not able to complete your request.
8.9 If you have any queries or concerns on any data protection related issue, please contact dataprotection@centrepoint.org where the team will be happy to help.
9. I’m not satisfied with how Centrepoint handles my personal information. How do I make a complaint?
9.1 If you have any complaint(s) about the processing of your personal data undertaken by Centrepoint, please contact complaints@centrepoint.org. All complaints will be acknowledged, investigated and responded to within 30 days. You can:-
- Email us at dataprotection@centrepoint.org.
- Write to us, addressed to the Data Protection Officer, Centrepoint, The Rowe, 59 – 63 Whitechapel, High Street, London, E1 7PF.
- Call our Supporter Care Team on 0800 23 23 20.
- Or email complaints@centrepoint.org.
9.2 Following your complaint, if you are still not satisfied, you have a right to make a complaint about the processing of your personal data by Centrepoint by contacting the Information Commission of England (IC). The IC can be contacted at: Wycliffe House, Water Lane, Wilmslow, SK9 5AF. Telephone No. 0303 123 1113. Alternatively, https://IC.org.uk.
9.3 Please address all communications in relation to personal information or data protection to dataprotection@centrepoint.org.
10. Cookies
10.1 In order to improve our website, we use ‘cookies’ and similar technologies. Cookies are small pieces of information sent by us to your computer or mobile device and stores on your device to allow us to recognise you when you next visit. For information, please see our Cookies Policy, which can be found here.
10.2 We only set non-essential cookies with your consent, and this is obtained via our cookie banner.
10.3 We will not use your personal data for purposes that are materially different, incompatible or unexpected without informing you and updating this Privacy Notice.
11. Provision of Personal Data
11.1 Please note that Centrepoint is processing your personal data to provide you our services and to manage our legal obligations, as set above. If you do not provide your personal data, we may not be able to undertake our obligations in relation to the provision of our services to you. This means we will not be able to provide you with some or all of the services you have requested.
12. Definitions
12.1 The following terms have the following meaning in this Privacy Notice:
- Personal Data means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
- Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
- Data Controller means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
- Data Processor means a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the data controller.
- Special Category Data means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation.
13. Contact
13.1 The Data Protection Officer can be contacted:
- In writing at Centrepoint, The Rowe, 59 - 63, Whitechapel High Street, London, E1 7PF.
- By email at dataprotection@centrepoint.org or
- By calling our Supporter Care Team 0800 23 23 20 or
- Via our website.
14. Further Information
14.1 It is not intended that Centrepoint will undertake any further processing of your personal information other than that which is set out in this Privacy Notice. However, if this position does change Centrepoint will provide you with further information.
14.2 If you require this Privacy Notice in an alternative format or language, please contact us at dataprotection@centrepoint.org.
14.3 This notice was last updated on 1 June 2026.