Introduction

Mind of the Student recognises the importance of protecting personal data and respecting the privacy of everyone we work with. This includes children and young people, parents and carers, school staff, volunteers, donors, partners, and members of the public.

This Privacy Policy explains how we collect, use, store, and protect personal data when you interact with us, including through our website, services, events, fundraising activities, and other communications.

Mind of the Student is committed to complying with UK data protection law and to handling personal data fairly, lawfully, and transparently.

Purpose

The purpose of this policy is to:

• Explain what personal data Mind of the Student collects and why.

• Set out how personal data is used, stored, and shared.

• Describe individuals' rights in relation to their personal data.

• Confirm the charity's commitment to safeguarding, confidentiality, and data security.

• Ensure compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Who We Are

Mind of the Student

Registered charity number: 1165035

Address: Mind of the Student, Havering Road, Romford RM1 4YY

Email: hello@mots.org.uk

When this policy refers to "we", "us", or "our", it means Mind of the Student.

For the purposes of data protection law, we are a data controller.

Definitions

To ensure transparency, here are the key terms used in this policy:

• Personal Data: Any information relating to an identified or identifiable living person (data subject). This includes names, addresses, identification numbers, and contact details.

• Special Category Data: Personal data that requires higher protection due to its sensitive nature. This includes data revealing racial or ethnic origin, religious or philosophical beliefs, data concerning health, and data concerning a person's sexual orientation.

• Processing: Any operation performed on personal data, such as collection, recording, organising, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, or destruction.

Scope

This policy applies to personal data collected through:

• Our website and online services*.

• Delivery of programmes and activities.

• Events, training, and workshops.

• Volunteering and employment processes.

• Fundraising and donations.

• Communications with individuals and organisations.

*A separate Cookie Policy explains how cookies and similar technologies are used on our website.

How We Collect Personal Data

We collect your personal data (usually directly from you) when you:

• Visit or interact with our website.

• Subscribe to newsletters or updates.

• Contact us by email, phone, or other means.

• Participate in our services, programmes, or events.

• Volunteer or work for or with us, or apply to work for or with us.

• Fundraise for us or make a donation.

• Enter into a contract or partnership with us.

• Provide feedback, complete surveys, or engage with campaigns.

We may also receive personal data from:

• Parents or guardians *if collecting data from children).

• Schools or partner organisations.

• Fundraising platforms such as JustGiving.

• Publicly available sources, where lawful.

• Service providers acting on our behalf.

What Personal Data We Collect

The personal data we collect may include:

• Name and contact details such as email address, telephone number, and postal address.

• Organisation or school name and role.

• Communication preferences.

• Records of engagement with our services or events.

• Donation and fundraising information.

• Volunteer or employment application information.

• Feedback and correspondence.

Special Category Personal Data

In some circumstances, we may process special category personal data, such as information relating to health or wellbeing. This may arise where necessary to:

• Safeguard children and young people.

• Provide appropriate support or reasonable adjustments.

• Meet legal or safeguarding obligations.

Where we process special category data, we will:

• Only collect what is necessary.

• Explain clearly why the information is needed.

• Apply appropriate safeguards.

• Restrict access to authorised staff only.

• Retain the data only for as long as necessary.

Children and Young People's Data

Mind of the Student works directly with children and young people, primarily through schools and structured group activities.

• We take additional care when processing children's personal data.

• Data will only be collected where it is necessary for delivery, safeguarding, or legal purposes.

• Where required, parental or guardian consent will be sought.

• Safeguarding concerns will always override confidentiality.

• We do not knowingly use children's data for marketing purposes.

We will ensure that, where asked, we explain how their personal information is used in clear, age-appropriate language that they can understand.

Lawful Bases for Processing

We only process personal data where we have a lawful basis to do so, including:

• Consent, where required.

• Contract, where processing is necessary to deliver services or agreements.

• Legal obligation, including safeguarding and regulatory duties.

• Legitimate interests, where processing is necessary for the charity's operation and does not override individual rights.

• Vital interests, where necessary to protect someone from harm.

Please note that there may be multiple lawful bases that can be applied.

How We Use Personal Data

We use personal data to:

• Deliver our programmes, services, and activities.

• Communicate with schools, partners, supporters, and volunteers.

• Process donations and fundraising activities.

• Manage volunteering and employment processes.

• Maintain records for safeguarding, governance, and audit purposes.

• Improve our services and understand engagement.

• Meet legal, regulatory, and reporting requirements.

Marketing and Communications

We will only send marketing or fundraising communications where permitted by law and in line with your preferences.

• You will be given clear choices about receiving communications.

• You can opt out at any time.

• We do not sell personal data to third parties.

Requests to change communication preferences can be made by emailing enquiries@mindofthestudent.org.uk.

Sharing Personal Data

We only share personal data where necessary and appropriate, including with:

• Service providers or contractors acting on our behalf.

• Schools or partners involved in programme delivery.

• Professional advisers, auditors, or regulators.

• Statutory bodies where required by law, including safeguarding authorities.

Mind of the Student may share limited personal information about a student with their parent or guardian where it is appropriate, lawful, and in the best interests of the child or young person. This may include:

• Safeguarding concerns, where there is a risk of harm to the child or others.

• Wellbeing concerns that meet agreed school safeguarding thresholds.

• Legal or statutory obligations, including child protection requirements.

• Where parental consent has been obtained, for example, through school agreements or programme participation forms.

• Where the school requires information to be shared as part of its safeguarding responsibilities.

• In these situations, information sharing would normally take place via or in consultation with the school, rather than directly, unless there is a clear reason to do otherwise.

In all cases, we ensure appropriate agreements and safeguards are in place when data is shared.

International Data Transfers

Where personal data is transferred outside the UK (for example, where your information is stored in a software system that is hosted outside of the UK), we ensure appropriate safeguards are in place, such as adequacy decisions or contractual protections, to maintain data security and rights.

Data Retention

We retain personal data only for as long as necessary for the purpose for which it was collected, including legal, safeguarding, and reporting requirements.

When data is no longer needed, it is securely deleted or anonymised.

Your Rights

Under data protection law, you have the right to:

• Access your personal data.

• Request correction of inaccurate data.

• Request deletion or restriction of processing.

• Object to certain processing, including direct marketing.

• Request data portability.

• Withdraw consent, where processing is based on consent.

• Lodge a complaint with the Information Commissioner's Office.

Requests can be made by contacting hello@mots.org.uk.

Data Security

We use appropriate technical and organisational measures to protect personal data, including access controls, secure storage, staff training, and contractual safeguards with third parties.

Complaints

If you have concerns about how your personal data is handled, please contact us first so we can address the issue. You also have the right to complain to the Information Commissioner's Office.

Review

This policy will be reviewed regularly and updated as required to reflect changes in law, guidance, or the charity's activities.

Last Updated: January 2026

Next Review: December 2028