Privacy Policy

This privacy policy serves as a comprehensive document that outlines how Positive Steps collects, uses, stores, and shares personal data. It is designed to inform our service users, donors, volunteers, and partners about their rights and our responsibilities regarding their personal information. The policy covers all aspects of data handling across our various services, ensuring transparency and accountability.

Positive Steps can act in two different roles when it comes to handling personal data:

Data Controller:

• What It Is: The data controller decides why and how your personal information is used.
• What They Do: They choose what information to collect and how to use it. They must follow data protection laws and keep your information safe.

Example: When Positive Steps decides to offer early help advice and determines what information is needed from a client, they are acting as a data controller. This means they decide why and how this information will be used to provide the service.

Data Processor:

• What It Is: The data processor handles your personal information on behalf of the data controller.
• What They Do: They follow the instructions given by the data controller and do not decide how the information is used. They must keep your information secure and help the data controller comply with data protection laws.

Example: Data Processor: If the council sends Positive Steps the data and instructs them to use it only for offering careers advice, Positive Steps acts as a data processor. They follow the council’s instructions on how to handle the data and ensure it is kept secure

The data collected and processed by Positive Steps shall be lawful only if at least one of the following conditions applies:

• Consent: The data subject has given consent for their personal data to be processed for one or more specific purposes.

• Contractual Necessity: Processing is necessary for the performance of a contract to which the data subject is a party, or to take steps at the request of the data subject prior to entering a contract.

• Legal Obligation: Processing is necessary for compliance with a legal obligation to which the controller is subject.

• Vital Interests: Processing is necessary to protect the vital interests of the data subject or another natural person.

• Public Interest or Official Authority: Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

• Legitimate Interests: Processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, particularly if the data subject is a child.

You have the right to withdraw your consent at any time. If you wish to so please contact our Service Support team at:

Address: Medtia Place, 80 Union Street, Oldham, OL1 1DJ

Phone: 0161 621 9400

Email: servicesupport@positive-steps.org.uk

We could collect personal information which could identify you such as:

• Name
• DOB
• Address
• Contact details (email address, phone number etc.)
• Location information
• Unique identity number

We may also collect special category information which could include:

• Ethnicity
• Gender
• Race
• Special educational needs
• Assessment information
• Religious or philosophical beliefs
• Health data
• Sexual orientation
• Ongoing notes about our work with you (such as interview notes, telephone calls made, appointments booked, contact with other professionals on your behalf etc)

Additional data may be held on you depending on which service you are accessing.

Positive Steps is dedicated to protecting your personal data. The Data Protection Act (2018) states that by law, any personal data we hold must be:

• Used legally, fairly and transparently.
• Collected and used for specified and explicit purposes.
• Used in a way that is adequate, relevant, and limited to what is necessary.
• Accurate and kept up to date where necessary.
• Kept for no longer than required.
• Handled in a way that ensures appropriate security, including protection against unlawful or unauthorized processing, access, loss, destruction, or damage.

Under The Data Protection Act (2018), you have the right to know what information Positive Steps, holds about you. This includes the right to:

• Be Informed: Know how your data is being used.

• Access Data: Request access to your personal data.
  • Example: You can request a copy of all the information Positive Steps has about you, such as your contact details and service history.

• Rectification: Have incorrect data updated.
  • Example: If your address has changed, you can ask Positive Steps to update their records with your new address.

• Erasure: Have certain data erased.
  • Example: You can request Positive Steps to delete your data if you no longer use their services and there is no legal reason to keep it.

• Restrict Processing: Stop or limit how your data is processed.
  • Example: If you believe your data is incorrect, you can ask Positive Steps to stop using it until it is verified and corrected.

• Data Portability: Obtain and reuse your data for different services.
  • Example: You can request a copy of your data in a format that allows you to transfer it to another service provider.

• Object: Object to how your data is processed in certain circumstances.

We do not use your data for automated decision making (This means that any decision making will always have human involvement)

We will never use your data for profiling. (This means we will not analyse or predict your behaviour, interests, or preferences based on your personal information).

If you wish to exercise any of your rights or make a complaint, please contact our Service Support team at Positive Steps:

• Address: Medtia Place, 80 Union Street, Oldham, OL1 1DJ
• Email: servicesupport@positive-steps.org.uk
• Phone: 0161 621 9400

You can also make a complaint to the Information Commissioner’s Office (ICO) at https://ico.org.uk.

As a data controller, we determine the purposes and means of collecting and processing personal data.

This includes data from the following services:

• Careers Guidance (Schools based in Oldham and Rochdale)

We use data collected under section 507B of the Education Act 1996. This helps us provide impartial career guidance and support. The data belongs to each local authority.

Under the Education and Skills Act 2008, education institutions and public bodies (such as the Department for Education (DfE), police, probation, and health services) can share information with us to support this service.

We share data with the DfE under section 3 of The Education (Information About Individual Pupils) (England) Regulations 2013. This data sharing supports school funding, educational policy, and monitoring. It helps produce statistics, assess our performance, track young people’s destinations after school or college, and evaluate government-funded programs.

Years 9-11 (ages 13 to 16)

On behalf of each local authority, we collect and use information about young people in school.

Ages 16 – 17 (and up to age 25 for those on an EHCP)

On behalf of each local authority, we collect and use information about young people who live in the local authority area regardless of where they attended school.

• Careers Guidance (Schools based outside Oldham and Rochdale)

We collect and use information about young people in years 7-11 attending specific schools outside Oldham and Rochdale. This is for providing impartial career advice and guidance under section 507B of the Education Act 1996. The data belongs to Positive Steps and the schools we work with.

Under parts 1 and 2 of the Education and Skills Act 2008, education institutions and other public bodies (including the Department for Education (DfE), police, probation, and health services) may share information with us to support this service.

• Non-Statutory Virtual Guidance Sessions – Access Creative College

We collect and use the information provided at the point of booking. By completing the booking form, you consent to us offering our services and storing this information. The information collected is used solely to provide the requested service and will be passed back to your educational institute that commissioned our service.

• Oldham Youth Justice

The Youth Justice Service collects and lawfully processes information about young people under the following acts:

1. Crime and Disorder Act 1998
2. Criminal Justice Act 2003
3. Legal Aid Sentencing and Punishment of Offenders Act 2012
4. Police and Criminal Evidence Act 1994
5. Children Act 1989
6. Children Act 2004
7. Offender Management Act 2007

We collect, use, and share information on behalf of Oldham Local Authority to deliver the statutory Youth Justice Service. This includes details about young people’s offending history. Other public bodies, such as the Department of Justice (DoJ), police, probation, and health services, may pass information to us to support these provisions. We share anonymised data with the DoJ for policy, monitoring, and performance assessment purposes.

• Oldham Missing from Home

We collect and use information under The Fostering Services (England) Regulations 2011 (SI 2011 No 581, Regulation 13 (3)) to deliver the independent Missing from Home interview function. We receive data from agencies like the police or social services when a ‘missing from home’ incident is identified. We hold information about these young people, including details of their missing incidents and our subsequent contacts. Anonymised statistics are shared with Oldham Local Authority.

• Oldham Young Carers Respite

We collect and use information on behalf of Oldham Local Authority to deliver respite services for young carers in Oldham. This includes details of the respite activities provided. Anonymised statistics are shared with Oldham Local Authority.

• Oldham Early Help (including the two-year-old Childcare offer)

We collect and use this information on behalf of Oldham Local Authority to deliver contracted elements of the Oldham Early Help offer. Written consent is required for accessing Early Help. This consent explains what data we will collect and hold, why we hold it, and how long we will hold it for

• Empowering Oldham and Engaging Rochdale (UKSPF funded)

We collect and use this information on behalf of The Greater Manchester Combined Authority (GMCA) to deliver contracted elements of the Empowering Oldham and Engaging Rochdale offer.

We process your information in line with the GMCA privacy statement. The types of data we require from individuals accessing this program and the UKSPF privacy notice can be found here.

As a data processor, we handle personal data on behalf of other organizations according to their instructions.

These organisations may include but are not limited to:

• Local authorities (Oldham council, Rochdale council)
• Local schools
• Training providers (such as North Lancs TRAINING Group, Kip McGrath)
• YMCA England and Wales
• Law enforcement agencies
• The NHS
• Doctors

***Please note that this list is non-exhaustive and may change over time. ***

We may also share your personal information with other organizations that assist us in providing addition al support services and those that perform technical operations such as data storage and hosting on our behalf.

The practical arrangements and legal requirements for sharing and disclosing personal information can vary between services. Therefore, each of our key service areas provides additional information about how we collect and use your information.

We may use processors to support our service delivery. When this is necessary, we ensure that appropriate governance is in place to protect your data and ensure it is used only in accordance with the purposes outlined in the service’s individual privacy notice.

We do not share your information without your consent unless we have a legal obligation to do so. Your information will not be transferred or stored outside the EU.

Careers Guidance (Schools based in and outside of Oldham and Rochdale) – Records are destroyed when the client turns 22, or 26 for clients with special needs.

Non-Statutory Virtual Guidance Sessions – Access Creative College – Records are destroyed when the client turns 22, or 26 for clients with special need.

Oldham Youth Justice – Records are kept for 25 years from the date of birth, or until the end of a supervision order or license if the offender is over 18 and the case cannot be transferred. For category one convictions, records are kept for 75 years from the date of birth.

Oldham Missing from Home – Records are destroyed on the client’s 22nd birthday, or 26th birthday for clients with special needs.

Oldham Young Carers Respite – Records are kept for 25 years from the client’s date of birth unless the child has been or becomes looked after (75 years from the date of birth) or is adopted (100 years from the date of the adoption order).

Oldham Early Help (including the two-year-old Childcare offer) – Records are kept for 10 years after the user’s last contact with Positive Steps.

UKSPF projects – Records are kept for 10 years after the user’s last contact with Positive Steps

DBS – Records are kept for 6 months after completion.

Safeguarding involves protecting individuals from abuse or neglect, preventing impairment of their health and development, and ensuring they grow up or live in safe and effective care environments. If we receive personal data indicating that someone is at risk of a safeguarding issue, we will store and share this data with appropriate agencies as part of our duty to protect vulnerable adults and young people.

At Positive Steps, we are committed to maintaining the highest standards of quality in all our services and operations. Our teams are dedicated to continuous improvement, ensuring that we meet and exceed the expectations of our supporters and beneficiaries. We regularly monitor and evaluate our processes to uphold our commitment to excellence, transparency, and accountability.

If you have any questions or concerns about how we handle your personal data, you can contact our Data Protection Officer (DPO):

Email: dpo@positive-steps.org.uk

Our DPO is responsible for overseeing our data protection strategy and ensuring compliance with data protection regulations.

We conduct Disclosure and Barring Service (DBS) checks on behalf of other organisations and for potential staff and volunteers working with us. No one undergoes a DBS check without their knowledge. For the sole purpose of verifying ID information, we use an external agency, uCheck. You can find their privacy policy here.