The event organiser, Your Own Place CIC, has the legal responsibility to tell ticket buyers and event attendees how their personal information will be collected and used. You can find their Privacy Policy below or contact them to request it.
Privacy Policy
Your Own Place CIC
1. Purpose
1.1 Your Own Place CIC ("Your Own Place", "we", "us", "our") is committed to protecting and respecting the privacy of all beneficiaries, participants, partners,volunteers and other individuals whose personal information we process.
1.2 This Privacy Policy explains how we collect, use, store, protect and share personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable data protection legislation.
1.3 This policy applies to current and former beneficiaries and participants in services delivered by Your Own Place CIC.
2. Data controller details
2.1 Your Own Place CIC is the Data Controller responsible for determining how personal information is processed.
Contact Details:
Your Own Place CIC
Carrow House
Norwich
NR1 2TG
Email: ceo@yourownplace.org.uk
Telephone: 07530 028446
2.2 For any questions regarding this policy or the processing of personal information, please contact our Data Protection Lead using the details above.
3. Data Protection Principles
3.1 We will ensure that personal information is:
• Processed lawfully, fairly and transparently;
• Collected only for specified, explicit and legitimate purposes;
• Adequate, relevant and limited to what is necessary;
• Accurate and kept up to date where necessary;
• Retained only for as long as necessary;
• Processed securely using appropriate technical and organisational measures;
• Managed in a way that enables individuals to exercise their rights.
4. Types of Information We Process
4.1 We may collect and process the following categories of personal information:
4.1.1. Personal Information
• Name
• Address
• Date of birth
• Email address
• Telephone number
• Emergency contact details
• Photographs
4.1.2 Support and Service Information
• Housing circumstances
• Education and employment information
• Learning needs and support requirements
• Financial information (such as income, benefits, debts, budgeting information
and financial support needs)
• Care experience or care status
• Family circumstances and dependants
• Participation records
• Outcomes and progress information
4.1.3 Special Category Information
4.1.3.1 Where necessary, we may process:
• Physical health information
• Mental health information
• Ethnic origin
• Religion or belief
• Sexual orientation
• Gender information
• Other information required to ensure support is delivered safely and
appropriately
4.1.4 Criminal Offence Information
4.1.4.1 Where relevant and lawful, we may process information relating to criminal offences, allegations, cautions or convictions for safeguarding and risk management purposes.
5. How We Collect Information
5.1 Information may be collected:
• Directly from you;
• Through referrals from local authorities;
• Through referrals from housing providers;
• From support agencies and partner organisations;
• From educational institutions;
• From professionals supporting you;
• During delivery of our services.
5.2 We will explain how your information will be used when it is collected.
6. Why We Process Personal Information
6.1 We process personal information to:
• Deliver support, training and related services;
• Assess needs and provide appropriate support;
• Safeguard beneficiaries, staff and others;
• Monitor and evaluate outcomes;
• Report to funders and commissioners;
• Improve our services;
• Comply with legal obligations;
• Make reasonable adjustments for disabled individuals;
• Promote equality, diversity and inclusion.
7. Lawful Bases for Processing
7.1 Under Article 6 UK GDPR, we process personal information under one or more of the following lawful bases:
7.1.1 Contractual Necessity – Article 6(1)(b)
Where processing is necessary to provide services or take steps before providing services.
7.1.2 Legal Obligation – Article 6(1)(c)
Where processing is necessary to comply with legal or regulatory requirements.
7.1.3 Vital Interests – Article 6(1)(d)
Where processing is necessary to protect someone's life or safety.
7.1.4 Legitimate Interests – Article 6(1)(f)
Where processing is necessary for the legitimate interests of Your Own Place CIC, provided those interests do not override the rights and freedoms of individuals.
7.1.5 Consent – Article 6(1)(a)
Where specific activities require consent.
Where consent is used, it may be withdrawn at any time.
8 Special Category Data
8.1 Some information we process is classified as Special Category Data under Article 9 UK GDPR.
8.1.1 This includes information relating to:
• Health
• Ethnic origin
• Religion or belief
• Sexual orientation
• Gender information
8.2 We process Special Category Data under one or more of the following conditions:
8.2.1 Article 9(2)(a)
Explicit consent.
8.2.2 Article 9(2)(g)
Substantial public interest.
8.2.3 Article 9(2)(h)
Provision of health, social care or support services where applicable.
We use this information to:
• Understand support needs;
• Deliver safe and effective services;
• Make reasonable adjustments;
• Promote equality and inclusion;
• Meet safeguarding responsibilities.
9. Criminal Offence Data
9.1 Where necessary, we may process criminal offence information to assess risks and fulfil safeguarding responsibilities.
9.2 Such processing is carried out only where:
• A lawful basis under Article 6 UK GDPR applies; and
• A condition under Schedule 1 of the Data Protection Act 2018 permits the
processing.
9.3 This may include safeguarding children and adults at risk.
10. Sharing Information
10.1 We only share personal information where necessary and lawful.
10.2 Information may be shared with:
• Employees and facilitators of Your Own Place CIC;
• Local authorities;
• Commissioners and funders;
• Referring organisations;
• Housing providers;
• Support agencies;
• Professional advisers;
• Auditors;
• Regulators;
• Secure IT, database and cloud service providers.
10.3 Where possible, information shared for reporting purposes will be anonymised or aggregated.
10.4 All third parties are required to process personal information securely and only in accordance with applicable law.
11. International Transfers
11.1 We do not routinely transfer personal information outside the United Kingdom.
11.2 Where a supplier or service provider processes information outside the UK, we will ensure appropriate safeguards are in place in accordance with UK GDPR requirements.
12. Protecting Personal Information
12.1 Your Own Place CIC takes appropriate technical and organisational measures to protect personal information, including:
• Encryption;
• Secure cloud-based systems;
• Password protection and access controls;
• Multi-factor authentication where available;
• Staff training;
• Confidentiality obligations;
• Secure disposal arrangements;
• Regular reviews of information security measures.
13. Data Retention
13.1 We retain personal information only for as long as necessary.
13.2 Unless contractual, safeguarding or legal requirements dictate otherwise, beneficiary records (including referral information, case records, safeguarding information, support documentation and outcomes data) will normally be retained for up to seven years following the end of support.
13.3 Retention periods are documented within the organisation's Data Retention and Destruction Schedule and reviewed regularly.
13.4 When information is no longer required, it will be securely deleted, destroyed or anonymised.
14. If You Do Not Provide Information
14.1 Where information is required to deliver services, fulfil legal obligations or safeguard individuals, we may be unable to provide support if that information is not supplied.
15 Automated Decision Making
15.1 Your Own Place CIC does not make decisions about individuals solely through automated processing where those decisions have legal or similarly significant effects.
16 Your Information Rights
16.1 Under UK data protection law, you have the right to:
• Be informed about how your information is used;
• Access your personal information;
• Correct inaccurate information;
• Request deletion of information in certain circumstances;
• Restrict processing in certain circumstances;
• Receive a portable copy of information where applicable;
• Object to processing based on legitimate interests;
• Withdraw consent where consent is relied upon;
• Not be subject to solely automated decision-making.
16.2 Requests relating to these rights should be made using the contact details contained within this policy. Any concerns about how personal data is handled may also be raised as a complaint under Section 17.
17. Data Protection Complaints Procedure
17.1 If you are unhappy with how we have handled your personal information, responded to a request, or exercised your information rights, you may make a data protection complaint. Any expression of dissatisfaction about personal data handling will be treated as a data protection complaint, regardless of how it is received (for example, verbally, by email, in writing or via a third party).
17.2 Complaints may be submitted using the contact details in this policy (section 2.1).
17.3 All staff, facilitators and volunteers are responsible for recognising potential data protection complaints and must promptly escalate them to the Data Protection Lead.
17.4 Where a complaint is made on behalf of another individual, we may take reasonable steps to verify the identity of the individual and confirm the authority of the person acting on their behalf before disclosing or discussing personal information.
17.5 Upon receiving a complaint, we will:
• Acknowledge receipt as soon as possible and in any event within 30 days;
• Investigate the complaint without undue delay;
• Make reasonable enquiries where necessary;
• Keep the complainant informed of progress;
• Provide the outcome of the investigation promptly, including any action taken;
• Explain the decisions made.
17.6 We will seek to resolve complaints fairly, consistently and transparently.
17.7 All data protection complaints will be recorded and logged, including:
• The nature of the complaint;
• Actions taken;
• Outcomes reached;
• Any remedial measures implemented.
These records will be reviewed periodically to identify trends, improve practices and reduce the risk of reoccurrence.
17.8 In the event that the Data Protection Lead is unavailable, responsibility for managing and responding to complaints will be delegated to an appropriately trained senior member of staff to ensure continuity and timely handling.
18. Complaints to the Information Commissioner's Office
18.1 If you remain dissatisfied following our response, or believe we have not complied with data protection law, you may complain to the Information Commissioner's Office (ICO).
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk
18.2 We encourage individuals to contact us first so that we have an opportunity to investigate and resolve concerns.
19. Data Protection Lead
19.1 Your Own Place CIC has appointed a Data Protection Lead responsible for overseeing data protection compliance and responding to information rights requests and complaints.
Data Protection Lead: Zoe Webb
Email: ceo@yourownplace.org.uk
Telephone: 07530 028446
In the absence of the Data Protection Lead, the ceo@yourownplace.org.uk email inbox is monitored.
20. Review of this Policy
20.1 This policy will be reviewed annually, or sooner where required by changes in legislation, regulatory guidance or organisational practice.
SIGNED:
Name: Zoe Webb
Organisation: Your Own Place CIC
Reviewed: June 2026
Next review: June 2027
Appendix A – Lawful Basis and Processing Activities Table
The table below explains the main reasons why Your Own Place CIC processes personal information and the legal basis that allows us to do so.
Processing Activity Purpose Personal
Criminal Offence Data
Where criminal offence information is processed, Your Own Place CIC relies upon an appropriate lawful basis under Article 6 UK GDPR and a relevant condition under Schedule 1 of the Data Protection Act 2018, including safeguarding children and individuals at risk.
Legitimate Interests
Where we rely on legitimate interests under Article 6(1)(f), we assess and balance our organisational interests against the rights and freedoms of the individuals concerned to ensure that processing remains fair and proportionate.
Consent
Where consent is relied upon, individuals may withdraw their consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before consent was withdrawn.