Privacy Policy

1. Data Controller

Youths At Work ("we", "us", "our") is the data controller for personal data collected through this website. We are based in Huddersfield, West Yorkshire, United Kingdom.

For data protection queries, contact us at: privacy@youthsatwork.org

2. What Data We Collect

We collect personal data that you voluntarily provide through our enquiry and sign-up forms:

• Identity data: full name, organisation name (where applicable)
• Contact data: email address, phone number (where provided)
• Enquiry data: messages, goals, needs, and other information you include in your form submission
• Technical data: we do not currently deploy tracking cookies or third-party analytics. If this changes, this policy and our cookie policy will be updated first.

3. Lawful Basis for Processing

We process your personal data on the following lawful bases under UK GDPR:

• Consent (Article 6(1)(a)): you provide explicit consent via our form checkboxes before submission. You can withdraw consent at any time by contacting us.
• Legitimate interests (Article 6(1)(f)): to respond to enquiries, manage our services, and improve our offerings — where this does not override your rights.

4. How We Use Your Data

• To respond to your enquiry or application
• To match young people with appropriate opportunities
• To connect employers with supported candidates
• To manage our service delivery and internal records

5. Data Sharing

We do not sell your personal data. We may share it with:

• Service providers: our hosting and database provider (Supabase) processes data on our behalf under appropriate safeguards
• Employers (job applications): when you apply for a job through our platform, your application details (name, email, phone, cover message, and CV) are shared with the employer who posted that role. This is clearly stated in the application consent checkbox.
• Partner organisations: with your specific consent, we may share relevant information with referral partners as part of matching you with opportunities

6. Data Retention

• Enquiry data: retained for up to 24 months from last contact, then reviewed for deletion
• Active lead records: retained for the duration of active engagement plus 12 months
• Published content (stories, news): retained while published; removed on request or when no longer relevant

7. Your Rights

Under UK GDPR, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase your data ("right to be forgotten")
• Restrict processing
• Object to processing
• Data portability — receive your data in a structured format
• Withdraw consent at any time

To exercise any of these rights, email: privacy@youthsatwork.org

We will respond to rights requests within 30 days.

8. Data Security

We use industry-standard security measures to protect your data, including encrypted connections (HTTPS), database-level access controls, and role-based authentication for administrative access.

9. International Transfers

Our hosting infrastructure may process data outside the UK. Where this occurs, we ensure appropriate safeguards are in place in accordance with UK GDPR requirements.

10. Complaints

If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113

11. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated on this page with an updated "last updated" date.