Privacy Notice

YHA (England & Wales) (‘YHA’, ‘us’, ‘we’, ‘our’) is committed to protecting your personal information. This privacy notice concerns the use of personal data of employees, volunteers and applicants for roles at YHA. It explains how we collect information, including personal data, about you, why and how we use the information, and the rights you have with regard to that data.

We will review and update this notice on a periodic basis so that it continues to reflect our processing of your personal data. This privacy notice was last updated on the 6th November 2024.

1. Who we are

YHA (England & Wales) is one of the UK’s leading charities for young people, providing a wide range of hostel accommodation and programmes. Our aim is to improve health, wellbeing and life skills through travel and real adventure. You can read more about YHA on our website, www.yha.org.uk/about-yha

We are a data Controller (determining what data is used, why and how) as defined in the UK General Data Protection Regulation (GDPR) and Data Protection Act 2018, we are registered with the Information Commissioner’s Office (ICO).

• ICO registration Number: Z6434257

2. How and when we collect and use your information

Information about you will be collected by us from you directly, such as when you complete an application form, and from third parties, such as your referees and former employers or HMRC.

This information is collected and used in various ways, and at various times, depending on your relationship with YHA, including:

• When you apply for a YHA role on our jobs and volunteering websites
• When you accept a role and provide required additional information,
•  During your employment or volunteering placement
• To administrate pensions and other benefits
• After you leave, such as reference requests from a new employer

3. What personal information we collect and process

We may collect, process and store the following types of personal data about you depending on your relationship with YHA:

• Name and contact information (address, email and telephone number)
• Emergency contact details
• Information provided on your application and gathered during the selection process (for any roles you apply for at YHA)
• Bank or building society details for pay and/or expenses
• National Insurance and tax details
• Date of birth
• Details of your right to work in the UK status
• Proof of your identity, including passport or other photographic ID
• Any YHA pension scheme arrangements
• Details of referees provided by you and copies of any references we obtain
• A photograph to be used for identification purposes during your employment or placement
• Attendance, conduct and performance records
• Salary, benefits and contractual information
• Recordings and transcripts of virtual interviews, meetings and training sessions which you attend (using solutions such as Microsoft Teams and Zoom and AI meeting notes tools). You will be made aware when recording, transcribing or automated notetaking is in use.
• Information necessary for your YHA membership account
• In addition, YHA will process the following special category personal data, which we will take additional measures to protect on your behalf:
  • Health information including physical or mental health, and sickness and absence records
  • Racial or ethnic origin, sex and sexual orientation, religious or similar beliefs information provided by you and used to monitor our equality and diversity impact
  • Criminal records information, including the results of Disclosure and Barring Service (DBS) checks
  • Trade union membership while employed by YHA

4. Why we collect your information

We collect your data at the application stage to assess your suitability for a role and to help us develop and improve our recruitment process, to process your application, then to administrate any employment or volunteering relationship with YHA.

We rely upon the following lawful bases, as set out in the UK GDPR:

• Application stage: Art 6(1)b, Contract, is relied upon to process your application, which is taking steps to enter into a contract with us. Though some application data is voluntary to provide, such as applicant demographic data, we rely upon Art 6(1)a Consent (and Art 9(2)a for any special category data) you choose to provide at the application stage. We also rely upon Art 6(1)(f) Legitimate Interest to process applicant data.
• To administrate your employment or volunteering relationship with YHA, from an initial offer to termination, we rely upon
  • Art 6)1 (a), Consent, for data voluntarily provided by you and Art 9(2)a for any such special category data;
  • Art 6 (1) (c) Legal Obligation for compliance with our obligations as an employer, including with regard to your health and safety. We rely upon Art 9 (2)b for such data that is special category data, and DPA (2018) Schedule 1 part 1(1) when processing the data for employment purposes.
  • We also rely upon Art 6(1)f legitimate interest, where we want to use employee data to achieve our aims, including management reporting against our objectives. Also to provide employee benefits. We take care to ensure our use of your data for these purposes does not infringe your rights. Where this includes special category data we rely upon Art 9(2)a, you can choose whether to provide the information requested.

5. How we store your personal information

We store our data on YHA and third party systems based in the UK or EU, including in the cloud.

Where your data is stored and processed by a third party on our behalf, we have data processing agreements in place to ensure it is held securely and only used for agreed purposes.

6. How long we keep your information

We retain your personal information for as long as it is needed for the purposes set out above. This will usually be for the entirety of your employment or active volunteering with YHA, and for a period of up to 7 years afterwards as is required to comply with our legal obligations and address our legitimate interests. Health records may be retained longer than 7 years, where we are legally obliged to do so.

When your information is no longer required, we will securely dispose of, or anonymise it.

7. How we keep your information safe

We follow good security practices (including appropriate technical and organisational measures) in the processing, storage and use of information we hold. We require our processors to take the same care of your data.

You will be required to verify your identity before we are able to discuss your application, employment or volunteer placement data.

8. Information about young people

We welcome young people to volunteer and undertake work experience with YHA and we are required to capture relevant personal information to enable this. We take care to ensure they understand our purposes and processes when handling information about young people.

9. CCTV

We use Closed Circuit Television (CCTV) at some of our properties, and you may be recorded when you visit them.

We use CCTV in order to help protect YHA guests, employees, volunteers and visitors, and to protect YHA’s premises from criminal activities. CCTV footage will only be viewed when necessary – for example to detect a crime or for staff disciplinary purposes.

We comply with the ICO’s Code of Practice on the use of CCTV.

10. Disclosing your information to other organisations

We use trusted third parties to process your information on our behalf, including HireRoad (Vacancy Filler) for job applications, Kinetic for volunteer data, iTrent for employee records and WorkBuzz for staff surveys and feedback. We use a third party to process our Disclosure and Barring Checks (DBS) and will provide information at the point when checks are proposed. We have data processing agreements in place with these Processors, including clearly defined processing, storage and retention instructions. We will only transfer your personal information on the understanding that the third party has undertaken to us that they have in place adequate technical and organisational measures to protect that information.

Provision of employee benefits requires the sharing of data with external providers, such as the pension provider, the employee assistance scheme and BUPA. YHA is the Controller of the data shared with these third parties, except where the recipient goes on to provide a service directly to the employee, such as PerkBox and Cushon, which services staff may opt in to use. In these circumstances the service providers become data Controllers in their own right when you use their services. You should read their privacy notice to understand how they will use and manage your data.

We may release your information to the police, other authorities and third parties where we are under a legal obligation to do so, where it is in our interests to do so, or where doing so is in your vital interests. We identify our lawful basis for doing so before sharing any data.

11. Recruitment of Trustees

The recruitment of members to YHA’s Board of Trustees is carried out by a Nominations Panel, supported by YHA’s recruitment team.

The members of the Nominations Panel are not employees of YHA and are elected by YHA’s Company Members.

Throughout this recruitment process the Nominations Panel will use YHA defined systems and processes, and candidate data is protected as described in this notice.

12. Your rights

You may, at any time:

• Ask us what information we hold about you and what we are doing with it
• Request copies of the information we hold about you
• Ask us to correct your information if it is inaccurate
• Request that we delete your information
• Ask us to change the way we process your information
• Object to our processing of your information

In certain circumstances your request may be declined or limited where YHA has legal reasons to retain or process this data. This includes requests made for copies of job references, which are given and received ‘in confidence’, that is in the expectation that they will not be shared with the applicant.

The ICO website has useful information about these rights and what you should expect when making a request.

13. How to get in touch

If you have any questions about this privacy notice or wish to exercise your data privacy rights, please contact us as follows:

• Email us: [email protected]
• Write to us: Data Protection Team, YHA (England & Wales), Trevelyan House, Dimple Road, Matlock, DE4 3YH

14. What to do if you have a complaint

If you have a question or complaint, please contact our Data Protection Team in the first instance, [email protected]. If you are unsatisfied with the outcome, after giving us a chance to review the matter, you can raise the matter with the Information Commissioner at ico.org.uk/concerns or by phone on 0303 123 1113.

Free YHA membership for staff

All staff while employed by YHA are entitled to free YHA membership.

Where you take up the offer of free YHA membership your personal data (name, home address and contact email) will be added to the Customer Relationship Management (CRM system) and may be accessed by colleagues who use this data for work purposes. If, for any reason, you prefer to use a YHA address, rather than your home address on your membership record please inform Shared Services so they can provide Membership with the correct data for the issue of your free membership pack. If you use your home address or personal email please remember to inform the Membership team of any changes in the future, so your record remains accurate and up to date.

The free membership is not automatically renewed and staff are required to notify Membership if they wish to renew their membership.
Membership records are retained until 7 years after the last account activity after which they are anonymised.