Privacy Notice for Young People

Who are Centrepoint?

Centrepoint Soho is a registered Charity and Housing provider who works with and supports young people aged 16–25 across 60 services in London, Yorkshire, Manchester, and the North East of England. 

Centrepoint is the UK's leading youth homelessness charity who helps young people to find safe and affordable housing and therefore helping young people to avoid homelessness. 

Centrepoint Soho, a company limited by guarantee (Company Number: 01929421) and a charity registered with the Charity Commission for England and Wales (Charity Number: 292411) which is also registered as a Housing Association (No. H1869) and its trading company CP Trading Limited, a company limited by shares, Company Number: 02951328 both of which have their registered office at Central House, 25 Camperdown Street, London, E1 8DZ (together Centrepoint). We process your personal data in accordance with the UK Data Protection laws, specifically GDPR as defined below and the Data Protection Act 2018 (together the DPL) and the information set out in this information statement. 

What the law says Centrepoint must do

Processing the personal data of young people is a requirement by law. The law set out by UK Data Protection laws, in particular General Data Protection Regulation (GDPR) and the Data Protection Act 2018. 

Together, the GDPR and the Data Protection Act 2018 are called Data Protection Law. 

As part of the important work we do, Centrepoint is required to process the personal data of young people and this privacy notice along with the information set out in this privacy statement outlines what data we collect and how we use this data. 

Centrepoint are registered as a “Data Controller” with the ICO and as a Data Controller, Centrepoint decide what information we collect, how we collect it, the purpose for which we collect it and what we do with it. 

This means we have specific responsibilities in relation to the personal data we collect. 

This privacy notice outlines out how Centrepoint processes your personal data. 

Legally we must have different notices for the different data we collect - young people, donors, volunteers, supporters etc. These can be found at https://centrepoint.org.uk/privacy.

Legal Jargon

What information do we collect?

We may collect your:

• Name;
• Address and previous three addresses;
• Email address;
• Telephone number (mobile);
• Contact preference; 
• Gender identity; 
• Racial or ethnic origin; 
• Religious or philosophical beliefs; 
• Physical and mental health information; 
• Sexual orientation; 
• Actual or alleged criminal offences;
• Employment details;
• Work history; 
• Education history, including school, college etc. and qualifications;
• Unique learner reference number; 
• Outcome of initial assessments; 
• Current housing status and housing history; 
• Information in relation to your hobbies and interests; 
• Details of your next of kin; 
• Bank account details; 
• Debit/credit card details;
• Date of birth;
• Biographical details;
• National Insurance Number;
• Identification details, such as passport, driving licence etc. 
• NHS number; 
• Next of kin/emergency contact information; 
• Health care providers (GP, Dentist etc.);
• Key worker information from external support agencies;
• Immigration status; 
• Language requirements; 
• Survey responses; 
• Risk assessment information; 
• Records of your engagement and communication with us; 
• Your photo and CCTV image; 
• Any content featuring you that has been produced for our website, publications, social media, articles, and blog posts;
• Photographs and video recordings, and; 
• Information you have entered on to our website.

Why do we collect your information?

We collect your information in order to: 

• provide and administer Centrepoint’s accommodation services; 
• manage your tenancy or licence agreement; 
• provide information, advice, and guidance services; 
• respond to enquiries; 
• process personal details to administer training courses; 
• comply with all statutory and regulatory compliance;
• process any enquiries or complaints raised by you and responding to any communications from you;
• share your information to third parties with whom we have a relationship under which your personal data are protected; 
• administer Centrepoint’s bursary fund; 
• administer events; 
• communicate with you about our fundraising, campaigns, and the work that Centrepoint does; 
• manage your communication preferences; 
• undertake research, conduct surveys and gather feedback;
• ensure we comply with our contractual obligations to our funders, and; 
• carry out risk assessments and manage your activities/behaviour; 
• contact emergency services if there is an immediate risk to life, and; 
• use your case study in our campaign materials (with your consent).

Please note that Centrepoint needs to process your personal information and special category data where you have provided it in order to provide our services to you and to make sure we meet our legal obligations as set out above. 

If you do not provide your personal information to us, we may not be able to provide you with some, or all, of the services you have requested. 

You can object to your personal data being used by Centrepoint by contacting our Data Protection Team.

Processing your data

In order to process personal data the law says Centrepoint must have a legal basis to do so. 

In the instance that a young person should like to withdraw their consent of us processing their personal data, we would still be required to retain some personal data for a set period of time that is reasonable for Centrepoint to fulfil the purpose in this notice, meaning that consent is not freely available.

When contact is made with Centrepoint, you created an agreement between us and part of this agreement was for us to process your data so we may provide you with the suitable support in our training or accommodation. 

Where you did not opt out of receiving electronic communications from us, we have treated this as consent to send you communications electronically (commonly called “a soft opt in”). 

As the legal basis of processing your data, Centrepoint uses these electronic communications as your consent. 

Please note that you may withdraw this consent at any time. 

It is not intended that Centrepoint will use any processing of your personal data other than that which is set out in this privacy notice. 

However, if this changes Centrepoint will provide you with further information.

Where do we get your personal data from?

Centrepoint gathers your personal information from:-

• You directly, by completing forms, by contacting our helpline and web-chat, by face to face or email conversations with a member of Centrepoint’s staff; 
• Digital forms completed through our website and online surveys;  
• CCTV images from our premises;  
• Your social media pages, 
• Our social media pages and;   
• Third party companies and websites. 

How do you share and/or transfer my personal data?

Centrepoint may share or transfer your personal data with the following types of organisations:

• Service providers in order to provide you with the services you have requested. For example, web hosting providers, telephone system providers, cloud storage providers, marketing companies, payment companies for the processing of donations and payments;  
• Third parties with whom we have a relationship including our sub-contractors providing services to us and other charities combatting homelessness;  
• Regulatory organisations and Quality Mark organisations to undertake inspection and audit activities, to ensure the quality of our work and improve the delivery of the services we provide;  
• Data analysis companies and agents who undertake analysis and profiling activities to help us measure and improve the effectiveness of our marketing, communication, and fundraising activities;   
• Police and Social Care Services where we have a legal duty to share information for the prevention and detection of crime;  
• Local Authorities to report performance indicators on homelessness and to cross reference funding and outcomes for young people; 
• Relevant government departments responsible for housing, currently Department for Levelling-up, Housing and Communities to record details of lettings and sales in social housing and to provide statistical information on trends in social housing, characteristics of tenancies and types of tenancy agreements. 

Centrepoint intends that your personal information will stay within the countries of the European Union (EU) and the European Economic Area (the EEA) and countries where the EU has decided that the country has adequate data protection laws in line with those in the United Kingdom.

Generally, Centrepoint does not expect that personal data will be transferred outside of the EEA. 

How long do you keep my personal data?

Centrepoint will store your personal information for the duration of our relationship with you, unless a longer retention period is permitted. We will store your personal information in accordance with our data retention policy and procedures. 

What are my personal data rights?

• You have a right to ask Centrepoint to confirm whether or not your personal  information is being processed by Centrepoint.  
• You also have the right to ask for access to  your personal information.  
• To ask for access to your information you have to submit what is called a Subject Access Request (SAR).  
• Centrepoint’s data protection staff can help you complete your SAR if you would like them to.  
• You can submit a SAR via email or phone or in writing.  
• You can email dataprotection@centrepoint.org, call our Supporter Care line free on 0800 23 23 20 or write to The Data Protection Officer, Centrepoint, Central House, 25 Camperdown Street, London, E1 8DZ. 

Please note - we will only provide personal information to you  if we are satisfied you have established your identity. This may include us asking to see a copy of your passport or other identification document(s). We will only provide information to you at an address which we have verified as belonging to you. 

• You have a right to ask us to correct any inaccurate or incomplete personal information which we process about you. To do this please contact our Data Protection Team.  Giving an explanation of why you believe the information is inaccurate will help us correct the information. 
• You have the right to ask Centrepoint to delete certain personal information relating to you, in certain circumstances. Please contact the Data Protection Team setting out the reasons why you would like your personal information deleted. Certain circumstances apply when we need to use legal, contract or vital interests as lawful bases for processing your data.  
• Where certain grounds apply you will be entitled to ask Centrepoint to restrict the processing of personal information relating to you. If you would like to do this email dataprotection@centrepoint.org setting out the reasons why you like the personal information Centrepoint holds about you restricted. 
• You have the right to object to your personal information being processed, for example, automated decision making, direct marketing and profiling activities. You can contact our Data Protection Team if you would like to exercise this right. 
• You have the right to data portability - that is to ask us to transfer your personal information electronically to another organisation but only in certain circumstances. Those circumstances include where the lawful basis for processing your information includes contract, legal or vital interests. Contact our Data Protection Team if you would like to exercise this right. 

How do I complain? 

If you would like to make a complaint please contact our Head of Compliance who also acts as our Data Protection Officer. You can do this by: 

You also have the right to lodge a complaint about the processing of your personal data by Centrepoint by contacting the Information Commissioner’s Office (ICO). The ICO can be contacted at: Wycliffe House, Water Lane, Wilmslow, SK9 5AF. Telephone No. 0303 123 1113, or https://ICO.org.uk. 

Cookies

In order to improve our website, we use ‘cookies’ and similar technologies. Cookies are small pieces of information sent by us to your computer or mobile device and stores on your device to allow us to recognise you when you next visit. 

We will ask you whether you give your consent for the use of cookies when you enter our website. 

For further information, please see our Cookies Policy, which can be found - https://centrepoint.org.uk/cookie-policy. 

Provision of Personal Data

Please note that Centrepoint is processing your personal data to provide you our services and to manage our legal obligations, as set above. If you do not provide your personal data, we may not be able to undertake our obligations in relation to the provision of our services to you. This means we will not be able to provide you with some or all of the services you have requested.  

Definitions

The following terms have the following meaning in this Privacy Notice:

• Personal data means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
• Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
• Controller means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law. 
• Processor means a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller.
• Special Categories of personal data means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation.

Contact

The Data Protection Officer can be contacted:

In writing at Centrepoint, Central House, 25 Camperdown Street, London E1 8DZ;

By email at dataprotection@centrepoint.org; or

By telephone by calling 0800 587 5158.

Further Information