1. Who we are
YHA (England & Wales) is one of the UK’s leading charities for young people, providing a wide range of hostel accommodation and programmes. Our aim is to improve health, wellbeing and life skills through travel and real adventure.
YHA (England & Wales) is a data controller and a data processor in terms of the General Data Protection Regulation (GDPR) and UK Data Protection Act 2018 and is registered with the Information Commissioner’s Office (ICO).
- ICO registration Number: Z6434257
- Company Registration Number: 282555
- Registered Charity Number: 306122
2. How and when we collect and use your information
Information about you will be collected by YHA (England & Wales) from you directly, from relevant third parties where we either have a legal obligation or you have provided your consent.
This information is collected through a range of communication channels at various stages and used throughout your relationship with YHA, including:
- When you apply for a role
- When you accept a role and complete the onboarding process
- During your employment or volunteering placement, including employee communications
- For a relevant period after your employment or placement
3. What personal information we collect and process
YHA (England & Wales) may collect, process and retain the following types of personal data about you:
- Name and contact information (address, email and telephone number)
- Emergency contact details
- Information provided on your application and gathered during the selection process (for any roles you apply for at YHA)
- Your bank or building society details
- Your National Insurance and Tax details
- Date of Birth
- Your Nationality and details of your Right to Work in the UK
- Proof of your identity, including a copy of your Passport
- Your pension arrangements
- Details of referees provided by you and copies of any references we obtain
- A photograph for identification purposes
- Your attendance, conduct and performance records
- Salary, benefits and contractual information
- Recordings of virtual interviews, meetings and training sessions which you attend (using solutions such as Microsoft Teams and Zoom)
In addition, YHA will process the following sensitive personal data, which we will take additional measures to protect on your behalf:
- Medical information including physical or mental health, and sickness and absence records
- Your racial or ethnic origin, sex and sexual orientation, religious or similar beliefs
- Criminal records information, including the results of Disclosure and Barring Service (DBS) checks
- Your trade union membership
4. Why we collect your information
We will typically collect and use this information for the following purposes (other purposes that may also apply are explained in our data protection policy):
- for the performance of a contract (if an employee) or agreement (if a volunteer) with you, or to take steps to enter into a contract or agreement;
- for compliance with a legal obligation (e.g. our obligations to you as your employer under health safety legislation);
- for the purposes of our legitimate interests (e.g. business-related communications to employees or volunteers)
We seek to ensure that our information collection and processing is always proportionate. We will notify you of any material changes to information we collect or to the purposes for which we collect and process it.
5. How we store your personal information
The data that we collect from you will be securely stored and processed in the United Kingdom and may be transferred to, processed or stored at a trusted third-party destination within Europe.
Where your data is stored and processed by a third party we have contracts in place to ensure that the data is afforded the same protections as it would be if it were hosted in the United Kingdom and in line with the requirements of the UK Data Protection Act 2018 and EU GDPR legislation.
6. How long we keep your information
We retain your personal information for as long as it is needed for the purposes set out above. This will usually be for the entirety of your employment or active volunteering with YHA, and for a period of up to 7 years afterwards as is required to comply with our legal obligations.
When your information is no longer required, we will delete it securely.
7. How we keep your information safe
We follow good security practices (including appropriate technical and organisational measures) in the processing, storage and disclosure of information which you have given us.
Our security procedures mean that we will need to confirm your identity before we are able to discuss your employment or volunteer placement data.
8. Information about young people
We welcome young people to volunteer and undertake work experience with YHA and are required to capture relevant personal information to enable this. We take extra care when handling information about young people.
We use Closed Circuit Television (CCTV) at some of our properties, and you may be recorded when you visit them.
We use CCTV in order to help protect YHA guests, employees, volunteers and visitors, and to protect YHA’s premises from criminal activities. CCTV footage will only be viewed when necessary – for example to detect a crime.
We comply with the ICO’s Code of Practice on the use of CCTV.
10. Disclosing your information to other organisations
We may use trusted third parties to process your information on our behalf and when we do, appropriate data privacy contracts and clearly defined processing, storage and retention instructions will be in place. We will only transfer your personal information on the understanding that the third party has undertaken to us that they have in place adequate technical and organisational measures to protect that information.
We may release your information to the police or other authorities where we are under a legal obligation to do so, or where doing so is in your vital interests.
11. Recruitment of Trustees
The recruitment of members to YHA’s Board of Trustees is carried out by a Nominations Panel, supported by YHA’s recruitment team.
The members of the Nominations Panel are not employees of YHA and are elected by YHA’s Company Members.
Throughout this recruitment process the Nominations Panel will use YHA defined systems and processes and candidate data is protected as described in this Policy.
12. Kickstart Employees and Intermediary
If you apply to become a kickstart employee, your data will be stored by YHA upon referral by the Department for Work and Pensions and upon submitting a CV and application. YHA has a requirement to report back to the Department for Work and pensions regarding referrals, successful and unsuccessful applications and progress if recruited. Successful candidates will have the option to register with Skills to Succeed – a third party training provider – and in doing so must agree to their terms and conditions and privacy notice.
YHA also acts as an intermediary to provide support for Kickstart to other organisations. If you are a kick start employee or a Kick starter from another company, YHA will collect your name and email address to register you on our e-learning platform and send you a link to Skills to Succeed (which you can sign up to separately and will need to agree to their privacy notice). YHA will retain your details on our e-learning platform for 6 months after your training scheme has ended.
13. Your rights
You may, at any time:
- Ask us what information we hold about you and what we are doing with it
- Request copies of the information we hold about you
- Ask us to correct your information if it is inaccurate
- Request that we delete your information
- Ask us to change the way we process your information
- Object to our processing of your information
In certain circumstances your request may be declined or limited where YHA has legal reasons to retain or process this data.
14. How to get in touch
If you have any questions about this Privacy Notice or wish to exercise your data privacy rights, please contact us as follows:
- Email us: [email protected]
- Write to us: Data Protection Team, YHA (England & Wales), Trevelyan House, Dimple Road, Matlock, DE4 3YH
- Company Registration Number: 282555
- Registered Charity Number: 306122
- Registration Number with ICO: Z6434257
15. What to do if you have a complaint
If you have a question or complaint, please contact our Data Protection Team in the first instance. If you are unsatisfied with the outcome, you may then inform the Information Commissioner at ico.org.uk/concerns/ or telephone: 0303 123 1113.